securityonion

mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-06-10 20:35:19 +02:00

Files

T

Josh Patterson 27c7702325 so-boot-mine-update: wait for a complete mine before highstate

Mine-backed pillars (node_data, elasticsearch:nodes, redis:nodes,
logstash:nodes, hypervisor:nodes) include a node only if it returned an
IP from the mine, and the configs they build are rebuilt fresh every
highstate. After a manager reboot with a flushed mine, the first boot
highstate could run before an up node re-reported network.ip_addrs,
dropping it from e.g. so-elasticsearch ExtraHosts and forcing a
container recreate.

After the initial broad mine.update, poll until every currently-up
minion actually has network.ip_addrs in the mine, re-pushing mine.update
to stragglers, before releasing the boot highstate. Shares the existing
MINE_UPDATE_MAX_WAIT backstop so a slow/down node never blocks boot, and
still logs the rendered node_data for inspection.

2026-06-09 10:10:32 -04:00

files

update 2.4 references to 3

2026-03-05 11:05:19 -05:00

tools

so-boot-mine-update: wait for a complete mine before highstate

2026-06-09 10:10:32 -04:00

defaults.yaml

add configurable realert threshold per agent

2025-09-10 10:56:09 -05:00

elasticsearch.sls

the great ssl refactor