securityonion

mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-06-12 13:19:22 +02:00

Files

T

History

Josh Patterson f088a27159 so-boot-mine-update: warm master pillar cache before highstate

A complete mine is not enough: elasticsearch:nodes, redis:nodes,
logstash:nodes (tgt_type=pillar) and hypervisor:nodes (tgt_type=compound)
resolve their target against the master's per-minion data cache
(grains+pillar in data.p), which is populated only when a minion's pillar
is recompiled -- separately from the mine. After a reboot a node can be in
the mine (so node_data/glob sees it) yet absent from that cache, so it
fails the elasticsearch:enabled:true pillar match and is dropped from
elasticsearch:nodes -> so-elasticsearch ExtraHosts -> container recreate.

After the mine-completeness wait, run salt '*' saltutil.refresh_pillar
wait=True to synchronously cache every up node's pillar (the same lever
deploy_newnode.sls uses), then verify with salt-run cache.pillar and retry
stragglers, bounded by MINE_UPDATE_MAX_WAIT. Also log elasticsearch:nodes
alongside node_data for inspection.

2026-06-09 13:52:19 -04:00

files

update 2.4 references to 3

2026-03-05 11:05:19 -05:00

tools

so-boot-mine-update: warm master pillar cache before highstate

2026-06-09 13:52:19 -04:00

defaults.yaml

add configurable realert threshold per agent

2025-09-10 10:56:09 -05:00

elasticsearch.sls

the great ssl refactor