Security Onion Console (SOC) includes a Grid interface which allows you to quickly check the status of all nodes in your grid.
Starting at the top of the page, there is a
Grid EPS value in the upper right corner that shows the sum of all Consumption EPS measurements in the entire grid. Below that you will find a list of all nodes in your grid.
Please note that new nodes start off showing a red Fault and may take a few minutes to fully initialize before they show a green OK.
You can drill into individual nodes to see detailed information including Node Status, Container Status, and Appliance Images.
This section includes an overview of node status.
Online Since field shows how long the node has been online.
Consumption EPS field is the number of Events Per Second consumed.
Process Status field shows
Fault, you can check the
Container Status section to determine which process has failed.
Connection Status field shows whether or not the node is currently connected to the grid.
If you are using an official Security Onion Solutions appliance with RAID support, then you will see the corresponding status appear in this field.
Description field shows the optional Description you may have entered during Setup.
Icons in Lower Left Corner¶
There are a few icons in the lower left of the
Node Status section depending on what kind of node you are looking at:
Clicking the first icon takes you to the InfluxDB dashboard for that particular node to view health metrics.
If the node is a network sensor, then there will be an additional icon for sending test traffic to the sensor.
Depending on the node type, there may be an additional icon for uploading your own PCAP or EVTX file. Clicking this icon results in an upload form. Once you’ve selected a file and initiated the upload, a status message appears. Uploaded PCAP files are automatically imported via so-import-pcap and EVTX files are automatically imported via so-import-evtx. Once the import is complete, a message will appear containing a hyperlink to view the logs from the import. Please note that this is designed for smaller files. If you need to import files larger than 25MB, then you will need to manually import via so-import-pcap or so-import-evtx.
If any containers show anything other than
running, then you might want to double-check the configuration for that container and check the corresponding logs in
If you have purchased our official Security Onion Solutions appliances, then the grid page will show pictures of the front and rear of the appliances, useful for walking through connectivity discussions with personnel in the data center. If you are not using official Security Onion Solutions appliances, then it will simply display a message to that effect.