How to tidy up after 2.3.130 upgrade?

[b-u-g-s]

Hi everyone,

I have been running SO 2.x for about a year now on a small internal network for testing, it runs happily and about every month (or when I see a major update announcement for SO), I log in to the console and do a soup.

It is a VM setup as a standalone.

I recently noticed that when I do a so-status I am getting 3x items that are "missing", I was just wondering how can I get them removed from the so-status list as my understanding those components have been removed in the last few months (since 2.3.100?).

the 3x missing are:

• so-cortext
• so-thehive
• so-thehive-es

Is there some instructions on how to tidy up after such upgrade and remove those items from the so-status/installation? or this will be removed eventually and I don't need to do anything?

so-aptcacherng ---------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-cortex ---------------------------------------------------------------------------------------------------------------------------------- [ MISSING ]
so-curator -------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-dockerregistry ------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-elastalert ----------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-elasticsearch -------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-filebeat ------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-fleet ---------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-grafana -------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-idstools ------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-influxdb ------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-kibana --------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-kratos --------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-logstash ------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-mysql ---------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-nginx ---------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-playbook ------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-redis ---------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-sensoroni ------------------------------------------------------------------------------------------------------------------------------------ [ OK ]
so-soc ------------------------------------------------------------------------------------------------------------------------------------------ [ OK ]
so-soctopus ------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-steno ---------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-strelka-backend ------------------------------------------------------------------------------------------------------------------------------ [ OK ]
so-strelka-coordinator -------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-strelka-filestream --------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-strelka-frontend ----------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-strelka-gatekeeper --------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-strelka-manager ------------------------------------------------------------------------------------------------------------------------------ [ OK ]
so-suricata ------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-telegraf ------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-thehive --------------------------------------------------------------------------------------------------------------------------------- [ MISSING ]
so-thehive-es ------------------------------------------------------------------------------------------------------------------------------ [ MISSING ]
so-wazuh ---------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
so-zeek ----------------------------------------------------------------------------------------------------------------------------------------- [ OK ]

[b-u-g-s]

To provide a bit more context...
The reason I did a so-status and noticed the "missing" component is because there is "FAULT" on my dashboard grid.
It just says, "fault", so I did a: 1) a reboot, 2) so-status
and saw the missing components... hence this post.

since then, I also did a so-docker-refresh as I saw that being recommended else where
#5934

Anyway...
these might be 2x unrelated issues, or linked.
(Missing components + grid fault)

Any help for pointing me in the right direction would be welcome
Thanks.
B

[Sahale]

Hello.
sed -i '/so-thehive-es/d;/so-thehive/d;/so-cortex/d' /opt/so/conf/so-status/so-status.conf should help

[Sahale]

It should work automatically, but I faced with same problem earlier :)

[b-u-g-s]

Ok, great to know.
Actually... looks like there is more problem with the transition from TheHive to Case... I am getting some error 400 when I acknowledge alerts... I will try a bit of troubleshooting but then may just reinstall everything from scratch (something I don't like to do ;)

[dougburks]

soup should have automatically removed the 3 old processes from so-status.conf. Since it appears it didn't, it's possible that soup didn't complete successfully which may also be related to the 400 error you're getting when acknowledging alerts. If you continue to have problems, you could look at /root/soup.log to see if there are any clues. You could also look at /opt/so/log/ for additional clues.

[b-u-g-s]

Thanks Doug and sorry I tool so long to respond. In the end I decided to re-install everything with the 2.3.140 version as this is in a test lab and my customisation is minimal. If something like that happens again, I will check those logs and report back.

[b-u-g-s]

Although I don't think you will change back from Case to the Hive ;)