Elastic and Sec Onion manger not getting Zeek logs

Elastic Stack Elasticsearch
1

Hello,

I have setup a Sec onion search manager and a sec onion sensor setup in esxi. The manager has accepted the sensor into the grid and its says everything is working. But when I go to hunt in the sec onion web interface or elastic I can not see any zeek logs. When i check to see if the sensor is getting netwrok traffic I can see that it is, and the zeek logs are filling up with netwrok traffic. I can not find any errors in any of my logs?

I am guessing I am just missing something really dumb. But I could really use some help.

I found the ANSWER, See below.

2

From Elastic Search to Elasticsearch

3

ANSWER:

I setup the Sec onion VM on ESXI and when setting up Sec Onion I selected centos7 which was making the problem. Once I read Sec Onions documentation on how to setup Security Onion on ESXI I saw that I needed to select the OS as linux and Oracle Linux 9.x.
Here is the link to the documentation:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.