From 8b874e46d0b8b6430cddae2911998ef0c3df4c3e Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Mon, 31 Mar 2025 09:09:15 -0400
Subject: [PATCH] heavy node exclude so-import-pcap and so-pcap-import

---
 salt/common/init.sls | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/salt/common/init.sls b/salt/common/init.sls
index d4d90cbed..55f0d2031 100644
--- a/salt/common/init.sls
+++ b/salt/common/init.sls
@@ -129,6 +129,10 @@ common_sbin:
     - group: 939
     - file_mode: 755
     - show_changes: False
+{% if GLOBALS.role == 'so-heavynode' %}
+    - exclude_pat:
+      - so-pcap-import
+{% endif %}
 
 common_sbin_jinja:
   file.recurse:
@@ -139,6 +143,20 @@ common_sbin_jinja:
     - file_mode: 755
     - template: jinja
     - show_changes: False
+{% if GLOBALS.role == 'so-heavynode' %}
+    - exclude_pat:
+      - so-import-pcap
+{% endif %}
+
+{% if GLOBALS.role == 'so-heavynode' %}
+remove_so-pcap-import_heavynode:
+  file.absent:
+    - name: /usr/sbin/so-pcap-import
+
+remove_so-import-pcap_heavynode:
+  file.absent:
+    - name: /usr/sbin/so-import-pcap
+{% endif %}
 
 {% if not GLOBALS.is_manager%}
 # prior to 2.4.50 these scripts were in common/tools/sbin on the manager because of soup and distributed to non managers