diff --git a/debian/changelog b/debian/changelog
index c137cfa..9584a9f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+securityonion-sostat (20120722-0ubuntu0securityonion111) xenial; urgency=medium
+
+  * merge pr 30 
+
+ -- Doug Burks <doug.burks@gmail.com>  Tue, 18 Sep 2018 12:48:40 -0400
+
 securityonion-sostat (20120722-0ubuntu0securityonion110) xenial; urgency=medium
 
   * merge pr 29 
diff --git a/debian/patches/merge-pr-30 b/debian/patches/merge-pr-30
new file mode 100644
index 0000000..31aeb45
--- /dev/null
+++ b/debian/patches/merge-pr-30
@@ -0,0 +1,49 @@
+Description: <short summary of the patch>
+ TODO: Put a short summary on the line above and replace this paragraph
+ with a longer explanation of this change. Complete the meta-information
+ with other relevant fields (see below for details). To make it easier, the
+ information below has been extracted from the changelog. Adjust it or drop
+ it.
+ .
+ securityonion-sostat (20120722-0ubuntu0securityonion111) xenial; urgency=medium
+ .
+   * merge pr 30
+Author: Doug Burks <doug.burks@gmail.com>
+
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: <vendor|upstream|other>, <url of original patch>
+Bug: <url in upstream bugtracker>
+Bug-Debian: https://bugs.debian.org/<bugnumber>
+Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
+Forwarded: <no|not-needed|url proving that it has been forwarded>
+Reviewed-By: <name and email of someone who approved the patch>
+Last-Update: <YYYY-MM-DD>
+
+--- securityonion-sostat-20120722.orig/bin/sostat
++++ securityonion-sostat-20120722/bin/sostat
+@@ -624,9 +624,9 @@ if [ "$ELASTICSEARCH_ENABLED" = "yes" ];
+                         docker stats --no-stream so-freqserver
+ 			echo
+ 			echo "Testing freq_server now..."
+-			FREQ_SERVER_RESPONSE=`docker exec -it so-logstash curl -s http://so-freqserver:10004/measure/google.com`
+-			FREQ_RESULT=$(awk -vx=$FREQ_SERVER_RESPONSE 'BEGIN{ print x>=y?1:0}')
+-			if [ $FREQ_RESULT -eq 1 ]; then
++			FREQ_SERVER_RESPONSE=`docker exec -it so-logstash curl -s http://so-freqserver:10004/measure/google.com` | awk '{print $2}'| cut -d ')' -f1
++                        FREQ_RESULT=$(awk -vx=$FREQ_SERVER_RESPONSE 'BEGIN{ print x>=y?1:0}')
++                        if [[ "$FREQ_RESULT" -eq 1 ]]; then
+ 				echo
+ 				echo "Freq Server is working."
+ 			else
+@@ -649,7 +649,7 @@ if [ "$ELASTICSEARCH_ENABLED" = "yes" ];
+ 			echo "Testing domain_stats now..."
+ 			DOMAIN_STATS_RESPONSE=`docker exec so-logstash curl -s http://so-domainstats:20000/alexa/google.com`
+ 			DOMAIN_STATS_RESULT=$(awk -vx=$DOMAIN_STATS_RESPONSE 'BEGIN{ print x>=y?1:0}')
+-			if [ $DOMAIN_STATS_RESULT -eq 1 ]; then
++			if [[ "$DOMAIN_STATS_RESULT" -eq 1 ]]; then
+ 				echo
+ 				echo "Domain_stats is working."
+ 			else
diff --git a/debian/patches/series b/debian/patches/series
index 075fda3..3c1fb89 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -106,3 +106,4 @@ issues-1263-and-1264
 soup:-avoid-issues-with-mysql-5.7-and-systemd-#1283
 soup:-install-gnome-screensaver-if-necessary-#1296
 merge-pr-29
+merge-pr-30