Trying to install SO for Eval or Standalone hangs for hours

[gilesco]

Trying the 2.4.100 iso for testing in a Virtualbox VM. I know that my hard disk is not likely to be fast enough in this, but I need to get a bit hands-on with the tool before moving to production equipment.

Installs get as far as "Executing command 'so-elasticsearch-wait' in directory '/root'

Then it just hangs for hours. This is a quick eval as we want to get some hardware provisioned, but is this step supposed to take a long time?

[gilesco]

I've cancelled the install, downloaded the 20240903 hot fix and trying again. Last ISO was the vanilla 2.4.100, so maybe some fixes since then?

[gilesco]

I left the install to run overnight, and this morning I had the dialog that there were errors in the installtion. I attach the errors.log file here.
errors.log

Looks like a timeout or something? Anyone have any ideas?

[dougburks]

I know that my hard disk is not likely to be fast enough in this

Please provide more information about your hard disk. You can review the Elastic storage requirements at:
https://docs.securityonion.net/en/2.4/hardware.html#elastic-stack

Also, please provide more information about the specs of the VM and the host. The specs listed in the form at https://github.com/Security-Onion-Solutions/securityonion/discussions/new?category=2-4 would be helpful.

You can review all hardware requirements at:
https://docs.securityonion.net/en/2.4/hardware.html

[gilesco]

It's a ST8000DM004, Normal SATA desktop class drive (unfortunately, my SSD doesn't have the capacity to meet the requirements). So I'm guessing that causes the timeouts? Is there any way of scaling down Elastic Search? This is a PoC test to assess suitability so I will not see more than 1Mbps of monitoring traffic at most, probably of the order of a few 100kbps most of the time.

The other specs should be OK, assigned 8 cores, 32GB RAM.

Although the host system in truth only has 6 physical cores with Hyperthreading showing 12 threads available.

[dougburks]

It looks like ST8000DM004 is a 5400 RPM drive and that definitely would not be appropriate for a production deployment. It might be OK for a small PoC like you're talking about but there may be other issues at play.

How much RAM does the host have?

Are there other VMs running at the same time?

Are there other applications running in the host at the same time?

Have you tried a different hypervisor?

Have you tried installing on a dedicated machine without virtualization?

Here's another documentation page that might be helpful:
https://docs.securityonion.net/en/2.4/best-practices.html

[gilesco]

Yeah, from the start I was concerned about the disk.

The host has 64GB ram installed.

There shouldn't have been any contention with other VMs as I shut them down for the purposes of the PoC.

Otherwise host was idle.

I have halted investigation into the product for the time being.

It's not your fault, but this looks like it is too resource hungry for our use case these days. Might work on production hardware, but too risky to take that on.

[dougburks]

If you're willing to try one more experiment, you might try a different hypervisor or on bare metal. I've seen cases where Virtualbox can have performance issues similar to this.

[gilesco]

Thanks, unfortunately we're on a tight timeline to get something in place, main reason to not proceed at this time with SO, is that there's going to be too much of a learning curve to upgrade to 2.4, and hardware procurement times within the company (red tape etc... corporate approvals and so on) won't allow us to meet the deadline.