From a0558ace16e3bcb5b94cb7c6b60a35d7051a04a1 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Thu, 24 Oct 2024 10:33:16 -0400
Subject: [PATCH] replace: False to remove state warning

---
 salt/common/init.sls               | 1 +
 salt/strelka/filestream/config.sls | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/salt/common/init.sls b/salt/common/init.sls
index 8dd727f72..f385bd96d 100644
--- a/salt/common/init.sls
+++ b/salt/common/init.sls
@@ -182,6 +182,7 @@ sostatus_log:
   file.managed:
     - name: /opt/so/log/sostatus/status.log
     - mode: 644
+    - replace: False
 
 # Install sostatus check cron. This is used to populate Grid.
 so-status_check_cron:
diff --git a/salt/strelka/filestream/config.sls b/salt/strelka/filestream/config.sls
index 0f9f38914..2809bd8b1 100644
--- a/salt/strelka/filestream/config.sls
+++ b/salt/strelka/filestream/config.sls
@@ -99,12 +99,14 @@ filecheck.log:
     - name: /opt/so/log/strelka/filecheck.log
     - user: {{ filecheck_runas }}
     - group: {{ filecheck_runas }}
+    - replace: False
 
 filecheck_stdout.log:
   file.managed:
     - name: /opt/so/log/strelka/filecheck_stdout.log
     - user: {{ filecheck_runas }}
     - group: {{ filecheck_runas }}
+    - replace: False
 
 {% if GLOBALS.md_engine == 'ZEEK' %}