From 90dcad7e6f4920187a9675c961feeef931ce4682 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Fri, 18 Dec 2020 11:00:24 -0500
Subject: [PATCH 1/2] make sure timestamp on steno log line has changed so we
 dont snapshot the drop%

---
 salt/telegraf/scripts/stenoloss.sh | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/salt/telegraf/scripts/stenoloss.sh b/salt/telegraf/scripts/stenoloss.sh
index d078284a4..9cdf7f99c 100644
--- a/salt/telegraf/scripts/stenoloss.sh
+++ b/salt/telegraf/scripts/stenoloss.sh
@@ -15,7 +15,6 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-
 APP=stenoloss
 lf=/tmp/$APP-pidLockFile
 # create empty lock file if none exists
@@ -25,7 +24,22 @@ read lastPID < $lf
 [ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
 echo $$ > $lf
 
-# Get the data
-DROP=$(tac /var/log/stenographer/stenographer.log | grep -m1 drop | awk '{print $14}' | awk -F "=" '{print $2}')
+TSFILE=/var/log/telegraf/laststenodrop.log
+if [ -f "$TSFILE" ]; then
+    LASTTS=$(cat $TSFILE)
+else
+    LASTTS=0
+fi
 
-echo "stenodrop drop=$DROP"
+# Get the data
+LOGLINE=$(tac /var/log/stenographer/stenographer.log | grep -m1 drop)
+CURRENTTS=$(echo $LOGLINE | awk '{print $1}')
+
+if [[ "$CURRENTTS" != "$LASTTS" ]]; then
+  DROP=$(echo $LOGLINE | awk '{print $14}' | awk -F "=" '{print $2}')
+  echo $CURRENTTS > $TSFILE
+else
+  DROP=0
+fi
+
+echo "stenodrop drop=$DROP"
\ No newline at end of file

From 96bd1e72a7fe7cc9788d5250b914ec063cb74251 Mon Sep 17 00:00:00 2001
From: Mike Reeves <luke@geekempire.com>
Date: Fri, 18 Dec 2020 11:55:24 -0500
Subject: [PATCH 2/2] Update soup

---
 salt/common/tools/sbin/soup | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup
index 4f8a00a82..4e9f46a74 100755
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -240,7 +240,7 @@ rc1_to_rc2() {
   while read p; do
       local NAME=$(echo $p | awk '{print $1}')
       local EHOSTNAME=$(echo $p | awk -F"_" '{print $1}')
-	    local IP=$(echo $p | awk '{print $2}')
+      local IP=$(echo $p | awk '{print $2}')
       echo "Adding the new cross cluster config for $NAME"
       curl -XPUT http://localhost:9200/_cluster/settings -H'Content-Type: application/json' -d '{"persistent": {"search": {"remote": {"'$NAME'": {"skip_unavailable": "true", "seeds": ["'$EHOSTNAME':9300"]}}}}}'
   done </tmp/nodes.txt