Merge pull request #16105 from Security-Onion-Solutions/fixESHEAP

Add default esheap value so nodes highstate without the pillar value
2026-07-27 03:06:36 +02:00 · 2026-07-23 16:02:49 -04:00 · 2026-07-23 15:16:26 -04:00 · 2026-07-22 08:44:08 -04:00 · 2026-07-21 16:29:37 -04:00 · 2026-07-21 16:29:24 -04:00
6 changed files with 11 additions and 7 deletions
@@ -1,5 +1,6 @@
 elasticsearch:
  enabled: false
+  esheap: '600m'
  version: 9.3.7
  index_clean: true
  data_retention_method: DLM
@@ -1998,11 +1998,11 @@ main() {
    # Testing that salt-master is up by checking that is it connected to itself
    check_saltmaster_status

-    # update the salt-minion configs here and start the minion
+    # update the salt-master and salt-minion configs here and start the minion
    # since highstate are disabled above, minion start should not trigger a highstate
    echo ""
-    echo "Ensuring salt-minion configs are up-to-date."
-    salt-call state.apply salt.minion -l info queue=True
+    echo "Ensuring salt-master and salt-minion configs are up-to-date."
+    salt-call state.apply salt.master -l info queue=True
    echo ""

    # ensure the mine is updated and populated before highstates run, following the salt-master restart
@@ -94,7 +94,9 @@ salt_master_service:
      - file: checkmine_engine
      - file: pillarWatch_engine
      - file: engines_config
-    - order: 9002
+    - require:
+      - cmd: wait_for_salt_minion_ready
+    - order: last

 {% else %}

@@ -1532,7 +1532,7 @@ soc:
          agentMapping:
            Orchestrator: Claude Sonnet
            Investigator: Claude Sonnet
-            DetectionEngineer: Claude Sonnet
+            Detection Engineer: Claude Sonnet
        onionconfig:
          saltstackDir: /opt/so/saltstack
          bypassEnabled: false
@@ -786,7 +786,7 @@ soc:
            Investigator:
              description: This agent investigates alerts, explains events and records, and hunts through event data. It can also acknowledge alerts and escalate to cases.
              global: True
-            DetectionEngineer:
+            Detection Engineer:
              description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
              global: True
      client:
@@ -1,10 +1,11 @@
 {% import 'vars/init.map.jinja' as INIT %}
+{% import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS %}

 {%
  set ELASTICSEARCH_GLOBALS = {
    'elasticsearch': {
      'es_cluster_name': INIT.PILLAR.elasticsearch.config.cluster.name,
-      'es_heap': INIT.PILLAR.elasticsearch.esheap
+      'es_heap': INIT.PILLAR.elasticsearch.get('esheap', ELASTICSEARCHDEFAULTS.elasticsearch.esheap)
    }
  }
 %}
Author	SHA1	Message	Date
Josh PattersonandGitHub	9ad632a63a	Merge pull request #16105 from Security-Onion-Solutions/fixESHEAP Add default esheap value so nodes highstate without the pillar value	2026-07-23 16:02:49 -04:00
Josh Patterson	6bd3c414bb	Add default esheap value so nodes highstate without the pillar value Previously salt/vars/elasticsearch.map.jinja read the elasticsearch heap size via a raw pillar access (INIT.PILLAR.elasticsearch.esheap). If the esheap key was missing from a minion pillar, building GLOBALS raised 'dict object has no attribute esheap', cascading into every state that imports GLOBALS (elasticsearch.enabled, logstash.config, telegraf.config, etc.) and blocking highstate entirely. Add an esheap default ('600m', matching the es_heapsize() floor) to elasticsearch/defaults.yaml and fall back to it via dict .get() so a missing pillar value degrades gracefully. The per-node pillar value still wins when present.	2026-07-23 15:16:26 -04:00
Josh PattersonandGitHub	e2fc9e0325	Merge pull request #16094 from Security-Onion-Solutions/saltthangs Saltthangs	2026-07-22 08:44:08 -04:00
Josh Patterson	a21186ccce	Merge remote-tracking branch 'origin/3/dev' into saltthangs	2026-07-21 16:29:37 -04:00
Josh Patterson	f77fad8087	apply salt.master state instead of just salt.minion	2026-07-21 16:29:24 -04:00
Josh Patterson	ac46636196	ensure salt-master service restarted last	2026-07-21 16:05:18 -04:00
Josh PattersonandGitHub	ce0095154b	Merge pull request #16082 from Security-Onion-Solutions/saltthangs add date and time to output	2026-07-17 16:10:47 -04:00
Josh PattersonandGitHub	7b58c67a02	Merge pull request #16080 from Security-Onion-Solutions/saltthangs Saltthangs	2026-07-17 11:55:09 -04:00
Josh PattersonandGitHub	28b3a54a27	Merge pull request #16077 from Security-Onion-Solutions/saltthangs so-salt-minion-wait: report ready immediately when already ready	2026-07-17 10:14:55 -04:00
Josh PattersonandGitHub	403d846a89	Merge pull request #16076 from Security-Onion-Solutions/saltthangs Saltthangs	2026-07-16 18:10:50 -04:00
Josh PattersonandGitHub	33ed6359bb	Merge pull request #16072 from Security-Onion-Solutions/saltthangs Saltthangs	2026-07-15 15:31:08 -04:00