so-elastic-agent missing after node reboot.

[dwlr09]

Version

2.4.110

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

1TB

Storage for /

1080.2 GB

Storage for /nsm

16469.1 GB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

---

      ID: so-elastic-agent
Function: docker_container.running
  Result: False
 Comment: Created container 'so-elastic-agent'. Failed to start container 's                                                                                                                                                                                                                                                                                                                                                           o-elastic-agent': 'Error 500: driver failed programming external connectivity on                                                                                                                                                                                                                                                                                                                                                            endpoint so-elastic-agent (4b55a0d1b5f0c1afaeda733c025a7c6ffcd75b9a8b67006db3b8                                                                                                                                                                                                                                                                                                                                                           1930e79f9466): failed to bind port 0.0.0.0:514/udp: Error starting userland prox                                                                                                                                                                                                                                                                                                                                                           y: listen udp4 0.0.0.0:514: bind: address already in use'.
 Started: 17:18:20.835025
Duration: 806.566 ms
 Changes:

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dwlr09]

[dwlr09]

Ran the sudo so-eslatsic-clear this was the result

[dwlr09]

This to my knowledge is just the normal airgap setup we don't make changes to binding ports. Is there way to check that somewhere.

[dwlr09]

Everything I find in the configurartion tab has default. No 514 listed in an ports section

[dwlr09]

I think this might be the fix. Since the so-elastic-agent is missing I am not sure if I need to do the start and stop of the docker container
sudo service docker stop
sudo rm /var/lib/docker/network/files/local-kv.db
sudo service docker start

[dwlr09]

udp6 0 0 :::514 :::* 20742/agentbeat
This came from netstat -nlutp | grep 514

[dwlr09]

Its like the container is just gone
[leeroy@ncheavy05 ~]$ sudo docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
44f23021b140 manager01:5000/security-onion-solutions/so-elasticsearch:8.14.3 "/bin/tini -- /usr/l…" 2 days ago Up 2 days 0.0.0.0:9200->9200/tcp, 0.0.0.0:9300->9300/tcp so-elasticsearch
d20a2a89a676 manager01:5000/security-onion-solutions/so-zeek:2.4.110 "/usr/local/sbin/zee…" 3 days ago Up 2 days (healthy) so-zeek
021e1e8e0066 manager01:5000/security-onion-solutions/so-suricata:2.4.110 "/usr/local/sbin/so-…" 3 days ago Up 2 days so-suricata
d053da47c6db manager01:5000/security-onion-solutions/so-steno:2.4.110 "/usr/local/sbin/so-…" 3 days ago Up 2 days so-steno
92bba8cebee9 manager01:5000/security-onion-solutions/so-strelka-backend:2.4.110 "strelka-backend" 7 days ago Up 2 days so-strelka-backend
ab7853a781f4 manager01:5000/security-onion-solutions/so-strelka-filestream:2.4.110 "strelka-filestream" 2 months ago Up 2 days so-strelka-filestream
3588de057859 manager01:5000/security-onion-solutions/so-strelka-manager:2.4.110 "strelka-manager" 2 months ago Up 2 days so-strelka-manager
7a1d4c46f028 manager01:5000/security-onion-solutions/so-strelka-frontend:2.4.110 "strelka-frontend" 2 months ago Up 2 days 0.0.0.0:57314->57314/tcp so-strelka-frontend
7f647ac69727 manager01:5000/security-onion-solutions/so-redis:2.4.110 "redis-server --save…" 2 months ago Up 2 days 0.0.0.0:6381->6379/tcp so-strelka-gatekeeper
a344abe69488 manager01:5000/security-onion-solutions/so-redis:2.4.110 "redis-server --save…" 2 months ago Up 2 days 0.0.0.0:6380->6379/tcp so-strelka-coordinator
fc746ee6eb62 manager01:5000/security-onion-solutions/so-redis:2.4.110 "redis-server /usr/l…" 2 months ago Up 2 days 0.0.0.0:6379->6379/tcp, 0.0.0.0:9696->9696/tcp so-redis
803eec738c11 manager01:5000/security-onion-solutions/so-telegraf:2.4.110 "/entrypoint.sh tele…" 2 months ago Up 2 days so-telegraf
d39b8e4fddf8 manager01:5000/security-onion-solutions/so-soc:2.4.110 "/opt/sensoroni/sens…" 2 months ago Up 2 days so-sensoroni
[leeroy@ncheavy05 ~]$ sudo docker images -a
REPOSITORY TAG IMAGE ID CREATED SIZE
manager01:5000/security-onion-solutions/so-soc 2.4.110 f30129366a81 2 months ago 627MB
manager01:5000/security-onion-solutions/so-zeek 2.4.110 fc25eeec83be 2 months ago 907MB
manager01:5000/security-onion-solutions/so-suricata 2.4.110 b7cb70a2c7d7 2 months ago 1.01GB
manager01:5000/security-onion-solutions/so-strelka-backend 2.4.110 51d0c84cb2a4 3 months ago 2.92GB
manager01:5000/security-onion-solutions/so-telegraf 2.4.110 c7b905ddeb7b 3 months ago 272MB
manager01:5000/security-onion-solutions/so-redis 2.4.110 0c44b4f25928 3 months ago 40.7MB
manager01:5000/security-onion-solutions/so-steno 2.4.110 e80df7880572 3 months ago 827MB
manager01:5000/security-onion-solutions/so-elastic-agent 2.4.110 7aa51d77dae2 3 months ago 3.87GB
manager01:5000/security-onion-solutions/so-strelka-frontend 2.4.110 f925334520e1 3 months ago 45.4MB
manager01:5000/security-onion-solutions/so-strelka-manager 2.4.110 f5b6e16affa0 3 months ago 23.5MB
manager01:5000/security-onion-solutions/so-strelka-filestream 2.4.110 b99830e0c288 3 months ago 23.8MB
manager01:5000/security-onion-solutions/so-elasticsearch 8.14.3 ca78354f82ea 3 months ago 1.35GB
manager01:5000/security-onion-solutions/so-soc 2.4.100 10122cc171a4 4 months ago 601MB
manager01:5000/security-onion-solutions/so-zeek 2.4.100 fd757e1062f6 4 months ago 832MB
manager01:5000/security-onion-solutions/so-suricata 2.4.100 984cc91dfb0e 4 months ago 926MB
manager01:5000/security-onion-solutions/so-strelka-backend 2.4.100 a100acc84a91 4 months ago 2.9GB
manager01:5000/security-onion-solutions/so-strelka-frontend 2.4.100 a4da6dc8c424 4 months ago 45.4MB
manager01:5000/security-onion-solutions/so-strelka-manager 2.4.100 45669dce11ae 4 months ago 23.5MB
manager01:5000/security-onion-solutions/so-redis 2.4.100 cac0e130aba7 4 months ago 40.7MB
manager01:5000/security-onion-solutions/so-elasticsearch 2.4.100 c55a321a5a63 4 months ago 1.35GB
manager01:5000/security-onion-solutions/so-telegraf 2.4.100 91295f724bae 4 months ago 272MB
manager01:5000/security-onion-solutions/so-logstash 2.4.100 fa26f06607a9 4 months ago 1.56GB
manager01:5000/security-onion-solutions/so-steno 2.4.100 3d04153e104c 4 months ago 755MB
manager01:5000/security-onion-solutions/so-strelka-filestream 2.4.100 a4f126978d31 4 months ago 23.8MB
manager01:5000/security-onion-solutions/so-elastic-agent 2.4.100 5860ad7b420f 4 months ago 3.87GB
manager01:5000/security-onion-solutions/so-logstash 2.4.80 e98c596ee607 6 months ago 1.44GB