From ef83450107ce82935eb6fa46339e36a348160615 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 7 Jul 2026 16:54:06 -0400
Subject: [PATCH 1/4] recollate

---
 salt/manager/tools/sbin/soup | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 6725cc95c..f0be61546 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -789,7 +789,7 @@ bootstrap_so_soc_database() {
   # and runs automatically only on a fresh data directory. Hosts upgrading from
   # 3.1.0 already have /nsm/postgres populated, so the so_soc bootstrap block
   # added in 3.2 never fires. Re-run the script explicitly; it's idempotent.
-  echo "Bootstrapping so_soc database via init-db.sh."
+  echo "Bootstrapping database via init-db.sh."
   # The postgres image has no USER directive, so `docker exec` defaults to
   # root, and the container env intentionally omits POSTGRES_USER (the upstream
   # entrypoint defaults it transiently during first-init only). Recreate both
@@ -800,10 +800,10 @@ bootstrap_so_soc_database() {
     return 0
   fi
   if ! $exec_cmd; then
-    FINAL_MESSAGE_QUEUE+=("WARNING: init-db.sh failed inside so-postgres during the 3.2.0 upgrade; the so_soc database may not have been bootstrapped. Re-run manually: $exec_cmd")
+    FINAL_MESSAGE_QUEUE+=("WARNING: init-db.sh failed inside so-postgres during the 3.2.0 upgrade; the database may not have been bootstrapped. Re-run manually: $exec_cmd")
     return 0
   fi
-  echo "so_soc bootstrap complete."
+  echo "Database bootstrap complete."
 }
 
 # Existing grids should keep ILM unless an admin explicitly opts in to DLM.
@@ -873,6 +873,16 @@ update_kafka_metadata() {
     fi
 }
 
+recollate_postgres() {
+  for db in postgres securityonion so-telegraf; do
+    exec_cmd="docker exec so-postgres psql -U postgres $db -c \"reindex database $db; alter database $db refresh collation version;\""
+    if ! $exec_cmd; then
+      FINAL_MESSAGE_QUEUE+=("WARNING: recollating $db database failed. Re-run manually: $exec_cmd")
+      return 0
+    fi
+  done
+}
+
 up_to_3.2.0() {
   fix_logstash_0013_lumberjack_pipeline_name
 
@@ -884,6 +894,9 @@ up_to_3.2.0() {
 post_to_3.2.0() {
   bootstrap_so_soc_database
 
+  # Recollate due to image OS rebase
+  recollate_postgres
+
   # Including agent regen script here since it was missed in post_to_3.1.0
   echo "Regenerating Elastic Agent Installers"
   /sbin/so-elastic-agent-gen-installers

From 7f6014096b199e4aa38bc36fa17e4433ee9aa20e Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 7 Jul 2026 22:01:27 -0400
Subject: [PATCH 2/4] recollate db

---
 salt/manager/tools/sbin/soup | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index f0be61546..9264d9dca 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -874,12 +874,9 @@ update_kafka_metadata() {
 }
 
 recollate_postgres() {
-  for db in postgres securityonion so-telegraf; do
-    exec_cmd="docker exec so-postgres psql -U postgres $db -c \"reindex database $db; alter database $db refresh collation version;\""
-    if ! $exec_cmd; then
-      FINAL_MESSAGE_QUEUE+=("WARNING: recollating $db database failed. Re-run manually: $exec_cmd")
-      return 0
-    fi
+  for db in postgres securityonion so_telegraf; do
+    docker exec so-postgres psql -U postgres $db -c "reindex database $db"
+    docker exec so-postgres psql -U postgres $db -c "alter database $db refresh collation version"
   done
 }
 

From 8a8f2c4a336a103ea90449414b0fa16cb8b2d962 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 7 Jul 2026 22:22:00 -0400
Subject: [PATCH 3/4] change order to recollate first

---
 salt/manager/tools/sbin/soup | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 9264d9dca..56f4c66dd 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -889,11 +889,11 @@ up_to_3.2.0() {
 }
 
 post_to_3.2.0() {
-  bootstrap_so_soc_database
-
   # Recollate due to image OS rebase
   recollate_postgres
 
+  bootstrap_so_soc_database
+
   # Including agent regen script here since it was missed in post_to_3.1.0
   echo "Regenerating Elastic Agent Installers"
   /sbin/so-elastic-agent-gen-installers

From d131d167de8e2b5633b84076a8f9116497185dcd Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Wed, 8 Jul 2026 07:00:38 -0400
Subject: [PATCH 4/4] provide explanation text

---
 salt/manager/tools/sbin/soup | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 56f4c66dd..aee767db7 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -874,10 +874,14 @@ update_kafka_metadata() {
 }
 
 recollate_postgres() {
+  echo ""
+  echo "Recollating PostgreSQL databases. The following output may contain warnings about a version mismatch, followed by a note indicating that the collation version has been changed."
   for db in postgres securityonion so_telegraf; do
     docker exec so-postgres psql -U postgres $db -c "reindex database $db"
     docker exec so-postgres psql -U postgres $db -c "alter database $db refresh collation version"
   done
+  echo "Recollating PostgreSQL databases complete."
+  echo ""
 }
 
 up_to_3.2.0() {