From 278235b0cafeba0a44d730767aad93fcba44a78d Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 28 Feb 2022 12:15:23 -0500
Subject: [PATCH 1/7] update so-common lookup_salt_value to accept local
 option. soup get minion id from grains with local option

---
 salt/common/tools/sbin/so-common | 7 ++++++-
 salt/common/tools/sbin/soup      | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common
index bc11da57b..fd1443a89 100755
--- a/salt/common/tools/sbin/so-common
+++ b/salt/common/tools/sbin/so-common
@@ -249,6 +249,7 @@ lookup_salt_value() {
 	group=$2
 	kind=$3
 	output=${4:-newline_values_only}
+	local=$5
 
 	if [ -z "$kind" ]; then
 		kind=pillar
@@ -258,7 +259,11 @@ lookup_salt_value() {
 		group=${group}:
 	fi
 
-	salt-call --no-color  ${kind}.get ${group}${key} --out=${output}
+	if [[ "$local" != "--local" ]] || [[ "$local" != "local" ]]
+		local=""
+	fi
+
+	salt-call --no-color  ${kind}.get ${group}${key} --out=${output} ${local}
 }
 
 lookup_pillar() {
diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup
index f43948fb3..223181f73 100755
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -255,7 +255,7 @@ check_log_size_limit() {
     fi
   else
     local minion_id
-    minion_id=$(lookup_salt_value "id" "" "grains")
+    minion_id=$(lookup_salt_value "id" "" "grains" "local")
 
     local minion_arr
     IFS='_' read -ra minion_arr <<< "$minion_id"

From cd981fa2aebf42a243a8ffb2069f9d4a2876b8e1 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 28 Feb 2022 12:25:06 -0500
Subject: [PATCH 2/7] forgot then for if

---
 salt/common/tools/sbin/so-common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common
index fd1443a89..5f5cc8575 100755
--- a/salt/common/tools/sbin/so-common
+++ b/salt/common/tools/sbin/so-common
@@ -259,7 +259,7 @@ lookup_salt_value() {
 		group=${group}:
 	fi
 
-	if [[ "$local" != "--local" ]] || [[ "$local" != "local" ]]
+	if [[ "$local" != "--local" ]] || [[ "$local" != "local" ]]; then
 		local=""
 	fi
 

From c5bf818049391285aa2af1e1ece3a93fb55533ee Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 28 Feb 2022 13:39:50 -0500
Subject: [PATCH 3/7] debug messages and pass local to lookup_salt_value

---
 salt/common/tools/sbin/soup | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup
index 223181f73..12613bcff 100755
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -245,7 +245,7 @@ check_sudoers() {
 }
 
 check_log_size_limit() {
-
+  echo "called check_log_size_limit"
   local num_minion_pillars
   num_minion_pillars=$(find /opt/so/saltstack/local/pillar/minions/ -type f | wc -l)
   
@@ -255,7 +255,9 @@ check_log_size_limit() {
     fi
   else
     local minion_id
-    minion_id=$(lookup_salt_value "id" "" "grains" "local")
+    echo "getting id grain in check_log_size_limit"
+    minion_id=$(lookup_salt_value "id" "" "grains" "" "local")
+    echo "found minion_id to be $minion_id"
 
     local minion_arr
     IFS='_' read -ra minion_arr <<< "$minion_id"
@@ -263,7 +265,9 @@ check_log_size_limit() {
     local node_type="${minion_arr[0]}"
     
     local current_limit
+    echo "getting log_size_limit pillar in check_log_size_limit"
     current_limit=$(lookup_pillar "log_size_limit" "elasticsearch")
+    echo "found log_size_limit to be $current_limit"
     
     local percent
     case $node_type in

From dc24cb711d8048f9f0dcb1330062afbd6c366106 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 28 Feb 2022 13:50:08 -0500
Subject: [PATCH 4/7] need local to be --local

---
 salt/common/tools/sbin/so-common | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common
index 5f5cc8575..a7677a754 100755
--- a/salt/common/tools/sbin/so-common
+++ b/salt/common/tools/sbin/so-common
@@ -259,7 +259,9 @@ lookup_salt_value() {
 		group=${group}:
 	fi
 
-	if [[ "$local" != "--local" ]] || [[ "$local" != "local" ]]; then
+	if [[ "$local" == "--local" ]] || [[ "$local" == "local" ]]; then
+		local="--local"
+	else
 		local=""
 	fi
 

From 80e5198f9e28b48d58c7bed4a5d57ada5161633c Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 28 Feb 2022 14:35:16 -0500
Subject: [PATCH 5/7] combine local and default pillars to get pillar values
 locally

---
 salt/common/tools/sbin/soup | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup
index 12613bcff..9515c0828 100755
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -266,8 +266,17 @@ check_log_size_limit() {
     
     local current_limit
     echo "getting log_size_limit pillar in check_log_size_limit"
-    current_limit=$(lookup_pillar "log_size_limit" "elasticsearch")
+
+    # since it is possible for the salt-master service to be stopped when this is run, we need to check the pillar values locally
+    # we need to combine default local and default pillars before doing this so we can define --pillar-root in salt-call
+    local epoch_date=$(date +%s%N)
+    mkdir -p /opt/so/saltstack/soup_tmp_${epoch_date}/
+    cp -r /opt/so/saltstack/default/pillar/ /opt/so/saltstack/soup_tmp_${epoch_date}/
+    # use \cp here to overwrite any pillar files from default with those in local for the tmp directory
+    \cp -r /opt/so/saltstack/local/pillar/ /opt/so/saltstack/soup_tmp_${epoch_date}/
+    current_limit=$(salt-call pillar.get elasticsearch:log_size_limit --local --pillar-root=/opt/so/saltstack/soup_tmp_${epoch_date}/pillar)
     echo "found log_size_limit to be $current_limit"
+    rm -rf /opt/so/saltstack/soup_tmp_${epoch_date}/
     
     local percent
     case $node_type in

From 710059211d0027c5e4ecfbf8069600dc96ebf27f Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 28 Feb 2022 14:54:39 -0500
Subject: [PATCH 6/7] remove debug echo, mkdir verbose

---
 salt/common/tools/sbin/soup | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup
index 9515c0828..90bffc94e 100755
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -245,7 +245,6 @@ check_sudoers() {
 }
 
 check_log_size_limit() {
-  echo "called check_log_size_limit"
   local num_minion_pillars
   num_minion_pillars=$(find /opt/so/saltstack/local/pillar/minions/ -type f | wc -l)
   
@@ -255,9 +254,7 @@ check_log_size_limit() {
     fi
   else
     local minion_id
-    echo "getting id grain in check_log_size_limit"
     minion_id=$(lookup_salt_value "id" "" "grains" "" "local")
-    echo "found minion_id to be $minion_id"
 
     local minion_arr
     IFS='_' read -ra minion_arr <<< "$minion_id"
@@ -265,17 +262,14 @@ check_log_size_limit() {
     local node_type="${minion_arr[0]}"
     
     local current_limit
-    echo "getting log_size_limit pillar in check_log_size_limit"
-
     # since it is possible for the salt-master service to be stopped when this is run, we need to check the pillar values locally
     # we need to combine default local and default pillars before doing this so we can define --pillar-root in salt-call
     local epoch_date=$(date +%s%N)
-    mkdir -p /opt/so/saltstack/soup_tmp_${epoch_date}/
+    mkdir -vp /opt/so/saltstack/soup_tmp_${epoch_date}/
     cp -r /opt/so/saltstack/default/pillar/ /opt/so/saltstack/soup_tmp_${epoch_date}/
     # use \cp here to overwrite any pillar files from default with those in local for the tmp directory
     \cp -r /opt/so/saltstack/local/pillar/ /opt/so/saltstack/soup_tmp_${epoch_date}/
     current_limit=$(salt-call pillar.get elasticsearch:log_size_limit --local --pillar-root=/opt/so/saltstack/soup_tmp_${epoch_date}/pillar)
-    echo "found log_size_limit to be $current_limit"
     rm -rf /opt/so/saltstack/soup_tmp_${epoch_date}/
     
     local percent

From a51f833f36796da6fb1a6265002c4f435cf98174 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 28 Feb 2022 16:13:43 -0500
Subject: [PATCH 7/7] output only the value for log_size_limit

---
 salt/common/tools/sbin/soup | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup
index 90bffc94e..73da9bc24 100755
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -269,7 +269,7 @@ check_log_size_limit() {
     cp -r /opt/so/saltstack/default/pillar/ /opt/so/saltstack/soup_tmp_${epoch_date}/
     # use \cp here to overwrite any pillar files from default with those in local for the tmp directory
     \cp -r /opt/so/saltstack/local/pillar/ /opt/so/saltstack/soup_tmp_${epoch_date}/
-    current_limit=$(salt-call pillar.get elasticsearch:log_size_limit --local --pillar-root=/opt/so/saltstack/soup_tmp_${epoch_date}/pillar)
+    current_limit=$(salt-call pillar.get elasticsearch:log_size_limit --local --pillar-root=/opt/so/saltstack/soup_tmp_${epoch_date}/pillar --out=newline_values_only)
     rm -rf /opt/so/saltstack/soup_tmp_${epoch_date}/
     
     local percent