From 416c28fded8c7c482594dfa93f321990ee20e20f Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Mon, 31 Oct 2022 14:42:23 -0400
Subject: [PATCH] Update init.sls

---
 salt/strelka/init.sls | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/salt/strelka/init.sls b/salt/strelka/init.sls
index 3bc7ddf0e..dac07f717 100644
--- a/salt/strelka/init.sls
+++ b/salt/strelka/init.sls
@@ -119,11 +119,19 @@ strelkaportavailable:
     - name: netstat -utanp | grep ":57314" | grep -qvE 'docker|TIME_WAIT' && PROCESS=$(netstat -utanp | grep ":57314" | uniq) && echo "Another process ($PROCESS) appears to be using port 57314.  Please terminate this process, or reboot to ensure a clean state so that Strelka can start properly." && exit 1 || exit 0
 
 # Filecheck Section
+filecheck_logdir:
+  file.directory:
+    - name: /opt/so/log/strelka
+    - user: 939
+    - group: 939
+    - makedirs: True
+    
 filecheck_history:
   file.directory:
     - name: /nsm/strelka/history
     - user: 939
     - group: 939
+    - makedirs: True
 
 filecheck_conf:
   file.managed: