mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-11-11 23:20:20 +01:00
Josh Patterson
cc970892ed
For a setting saved for a single node, push_pillar replaced the app's target from pillar_push_map.yaml with the node id. The app's state was then applied to that node even if the node does not run the app. Seen in the lab: the SOC config test saves elasticsearch.config.cluster.routing.allocation.disk.threshold_enabled for the first node SOC lists, and SOC lists nodes in random order. When that node was a sensor, the elasticsearch state was applied to it and failed to render (so_roles has no so-sensor entry), and so-push-drainer logged "push failed". Narrow the app's target to the node instead of replacing it: "L@<node> and ( <app target> )". A node outside the app's target then matches nothing, and so-push-drainer skips the action.