Merge pull request #13863 from Security-Onion-Solutions/issue/13851

Issue/13851

salt/common/init.sls

@@ -182,6 +182,7 @@ sostatus_log:
   file.managed:
     - name: /opt/so/log/sostatus/status.log
     - mode: 644
+    - replace: False
 
 # Install sostatus check cron. This is used to populate Grid.
 so-status_check_cron:

salt/elasticfleet/enabled.sls

@@ -143,7 +143,9 @@ so-elastic-fleet-integrations:
 so-elastic-agent-grid-upgrade:
   cmd.run:
     - name: /usr/sbin/so-elastic-agent-grid-upgrade
-    - retry: True
+    - retry:
+        attempts: 12
+        interval: 5
 
 so-elastic-fleet-integration-upgrade:
   cmd.run:

salt/strelka/filestream/config.sls

@@ -99,12 +99,14 @@ filecheck.log:
     - name: /opt/so/log/strelka/filecheck.log
     - user: {{ filecheck_runas }}
     - group: {{ filecheck_runas }}
+    - replace: False
 
 filecheck_stdout.log:
   file.managed:
     - name: /opt/so/log/strelka/filecheck_stdout.log
     - user: {{ filecheck_runas }}
     - group: {{ filecheck_runas }}
+    - replace: False
 
 {% if GLOBALS.md_engine == 'ZEEK' %}