Soup failure in 2.4.10

[rosswakelin]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

upgrading

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Just ran soup on my 2.4.10 installation and it failed - can't find apply_hotfix:

[root@chl-osom-v02 etc]# soup

SOUP - Security Onion UPdater

Please review the following for more information about the update process and recent updates:
https://docs.securityonion.net/en/2.4/soup.html
https://blog.securityonion.net

Press Enter to continue or Ctrl-C to cancel.

### Preparing soup at Mon Aug 21 04:25:47 AM UTC 2023 ###

Checking if we can talk to the salt master
local:
    ----------
    base:
        - cron.running
        - repo.client
        - ntp
        - schedule
        - logrotate
        - salt.minion
        - patch.os.schedule
        - motd
        - salt.minion-check
        - salt.lasthighstate
        - docker
        - common
        - salt.master
        - ca
        - ssl
        - registry
        - sensoroni
        - nginx
        - telegraf
        - influxdb
        - soc
        - kratos
        - firewall
        - manager
        - backup.config_backup
        - idstools
        - suricata.manager
        - mysql
        - elasticsearch
        - logstash
        - redis
        - elastic-fleet-package-registry
        - kibana
        - curator
        - elastalert
        - utility
        - soctopus
        - playbook
        - elasticfleet
        - docker_clean
This node can communicate with the salt-master.
Checking to see if this is a manager.

This is a manager, so we can proceed.

The manager's pillars can be rendered. We can proceed with SOUP.

Checking to see if this is an airgap install.

Found that Security Onion 2.4.10 is currently installed.

Cloning Security Onion github repo into /tmp/sogh/securityonion.
Removing previous upgrade sources.
Cloning the Security Onion Repo.
Cloning into 'securityonion'...
remote: Enumerating objects: 79469, done.
remote: Counting objects: 100% (1771/1771), done.
remote: Compressing objects: 100% (718/718), done.
remote: Total 79469 (delta 1140), reused 1590 (delta 1029), pack-reused 77698
Receiving objects: 100% (79469/79469), 38.44 MiB | 1.11 MiB/s, done.
Resolving deltas: 100% (52581/52581), done.
Verifying we have the latest soup script.
This version of the soup script is up to date. Proceeding.
Checking for OS updates.
Looks like you have an updated OS
Let's see if we need to update Security Onion.
Checking to see if there are hotfixes needed
We need to apply a hotfix
You have enough space for upgrade. Proceeding with soup.
Checking for Salt Master and Minion updates.
You are already running the correct version of Salt for Security Onion.
 hotfixg 
/sbin/soup: line 768: apply_hotfix: command not found

Starting crond service at 04:26:39.249598
Successfully started crond.


Starting salt-master service at 04:26:39.259350
Successfully started salt-master.


Starting salt-minion service at 04:26:39.268352
Successfully started salt-minion.

Enabling highstate.
local:
    ----------
    msg:
        Info: highstate state already enabled.
    res:
        True

Soup failed with error 127: Unhandled error
Unhandled error occured, please check /root/soup.log for details.
[root@chl-osom-v02 etc]# 

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[rosswakelin]

Given that I'm now seeing three different errors on this new install that indicate some files are missing from the install, I'm going to blow away my grid and start again.....

[defensivedepth]

There is currently no update for 2.4, so running SOUP after the 2.4 install should not do anything. That said, the hotfix error you are seeing is a known issue and will be fixed soon (with a hotfix!).