Add another pcap job fp

Run zeekctl cron so LogExpireInterval and the other expire settings take effect

salt/common/tools/sbin/so-log-check

@@ -154,6 +154,8 @@ if [[ $EXCLUDE_FALSE_POSITIVE_ERRORS == 'Y' ]]; then
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|id.orig_h"                    # false positive (zeek test data)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|emerging-all.rules"           # false positive (error in rulename)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|invalid query input"          # false positive (Invalid user input in hunt query)
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|no data available for the requested dates" # false positive (pcap cypress test submits a job with an empty time frame)
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|no job processor"             # false positive (same empty-time-frame job on import nodes, where no pcap processor runs)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|example"                      # false positive (example test data)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|status 200"                   # false positive (request successful, contained error string in content)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|app_layer.error"              # false positive (suricata 7) in stats.log e.g. app_layer.error.imap.parser | Total | 0

salt/zeek/defaults.yaml

@@ -15,7 +15,7 @@ zeek:
       MailHostUpDown: 0
       LogRotationInterval: 3600
       LogExpireInterval: 0
-      StatsLogEnable: 0
+      StatsLogEnable: 1
       StatsLogExpireInterval: 0
       StatusCmdShowAll: 0
       CrashExpireInterval: 0

salt/zeek/soc_zeek.yaml

@@ -69,24 +69,10 @@ zeek:
         regexFailureMessage: Enter 0, or a positive number optionally followed by "day" or "hr" (for example 7, "7 days", or "12 hr"). Minutes are not accepted because a log expire interval shorter than the log rotation interval prevents Zeek from starting.
         helpLink: zeek
         advanced: True
-      StatsLogEnable:
-        description: >-
-          Set to 1 to have "zeekctl cron" write node statistics to /nsm/zeek/logs/stats. This is
-          disabled because the CPU and memory portion depends on the "top" command, which the Zeek
-          container does not include, so every run records an error for each node instead. The
-          interface packet counters it also collects are not used anywhere in Security Onion, which
-          tracks Zeek packet loss separately through packetloss.log and Telegraf. It is read only
-          for that reason.
-        regex: ^[01]$
-        regexFailureMessage: You must enter 0 or 1.
-        helpLink: zeek
-        advanced: True
-        readonly: True
       StatsLogExpireInterval:
         description: >-
           Number of days to keep entries in the Zeek stats log, or 0 to keep them forever.
-          Applied by "zeekctl cron", which runs every 5 minutes. This has no effect unless
-          StatsLogEnable is turned on, which it is not by default.
+          Applied by "zeekctl cron", which runs every 5 minutes.
         regex: ^[0-9]+$
         regexFailureMessage: You must enter a whole number of days, or 0 to keep entries forever.
         helpLink: zeek