Adding additional sensor node - doesn't show up in grid

[ejgh-oe]

Version

2.4.200

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

128

Storage for /

500G

Storage for /nsm

30T

Network Traffic Collection

span port

Network Traffic Speeds

more than 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

Hi,

Tried adding another sensor but the new node never shows up in the grid - not even hours after installation.

Symptoms:
Went through installation (S.O. ISO) which went OK and in the end the new "node candidate" showed up under Administration > Grid Members under Pending Members. After ACKing the node it shows up under "Accepted Members" with a green checkmark like all the others:

Normally I'd expect the new node to show up in the grid, but it never did; even after several hours it didn't show up.
ssh-ed into the node and did a so-status

[root@onion-pcap-core ~]# so-status
so-status not yet available
[root@onion-pcap-core ~]#

salt-call state.highstate run on the new sensor node ran into several errors like

...
[ERROR   ] Rendering exception occurred
Traceback (most recent call last):
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/cmdmod.py", line 781, in _run
    proc = salt.utils.timed_subprocess.TimedProc(cmd, **new_kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/timed_subprocess.py", line 53, in __init__
    self.process = subprocess.Popen(args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/subprocess.py", line 971, in __init__
    self._execute_child(args, executable, preexec_fn, close_fds,
  File "/opt/saltstack/salt/lib/python3.10/subprocess.py", line 1863, in _execute_child
    raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: '/usr/sbin/so-bpf-compile'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/templates.py", line 468, in render_jinja_tmpl
    output = template.render(**decoded_context)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/jinja2/environment.py", line 1295, in render
    self.environment.handle_exception()
  File "/opt/saltstack/salt/lib/python3.10/site-packages/jinja2/environment.py", line 942, in handle_exception
    raise rewrite_traceback_stack(source=source)
  File "<template>", line 11, in top-level template code
  File "/opt/saltstack/salt/lib/python3.10/site-packages/jinja2/environment.py", line 1405, in make_module
    return TemplateModule(self, ctx)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/jinja2/environment.py", line 1537, in __init__
    body_stream = list(template.root_render_func(context))
  File "/var/cache/salt/minion/files/base/bpf/pcap.map.jinja", line 16, in top-level template code
    {% set PCAP_BPF_CALC = salt['cmd.run_all']('/usr/sbin/so-bpf-compile ' ~ GLOBALS.sensor.interface ~ ' ' ~ PCAPBPF|join(" "), cwd='/root') %}
  File "/opt/saltstack/salt/lib/python3.10/site-packages/jinja2/sandbox.py", line 401, in call
    return __context.call(__obj, *args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 162, in __call__
    ret = self.loader.run(run_func, *args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1248, in run
    return self._last_context.run(self._run_as, _func_or_method, *args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1263, in _run_as
    ret = _func_or_method(*args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/cmdmod.py", line 2382, in run_all
    ret = _run(
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/cmdmod.py", line 788, in _run
    raise CommandExecutionError(msg)
salt.exceptions.CommandExecutionError: Unable to run command '['/usr/sbin/so-bpf-compile', 'bond0', '(not', 'port', '443)', 'and', '(not', 'host', '192.168.9.19)', 'and', '(not', 'net', '46.228.135.0/24)', 'and', '(not', 'net', '46.228.136.0/23)']' with the context '{'cwd': '/root', 'shell': False, 'env': {'SHELL': '/bin/bash', 'SUDO_GID': '1000', 'HISTCONTROL': 'ignoredups', 'HISTSIZE': '1000', 'HOSTNAME': 'onion-pcap-core', 'SUDO_COMMAND': '/bin/bash', 'SUDO_USER': 'onionroot', 'PWD': '/root', 'LOGNAME': 'root', 'HOME': '/root', 'LANG': 'en_US.UTF-8', 'LS_COLORS': 'rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=01;37;41:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=01;36:*.au=01;36:*.flac=01;36:*.m4a=01;36:*.mid=01;36:*.midi=01;36:*.mka=01;36:*.mp3=01;36:*.mpc=01;36:*.ogg=01;36:*.ra=01;36:*.wav=01;36:*.oga=01;36:*.opus=01;36:*.spx=01;36:*.xspf=01;36:', 'TERM': 'xterm-color', 'LESSOPEN': '||/usr/bin/lesspipe.sh %s', 'USER': 'root', 'SHLVL': '1', 'S_COLORS': 'auto', 'DEBUGINFOD_IMA_CERT_PATH': '/etc/keys/ima:', 'which_declare': 'declare -f', 'PATH': '/root/.local/bin:/root/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin', 'SUDO_UID': '1000', 'MAIL': '/var/spool/mail/root', 'OLDPWD': '/var/log', 'BASH_FUNC_which%%': '() {  ( alias;\n eval ${which_declare} ) | /usr/bin/which --tty-only --read-alias --read-functions --show-tilde --show-dot $@\n}', 'SSL_CERT_DIR': '/etc/pki/tls/certs', 'SSL_CERT_FILE': '/etc/pki/tls/cert.pem', 'LC_CTYPE': 'C', 'LC_NUMERIC': 'C', 'LC_TIME': 'C', 'LC_COLLATE': 'C', 'LC_MONETARY': 'C', 'LC_MESSAGES': 'C', 'LC_PAPER': 'C', 'LC_NAME': 'C', 'LC_ADDRESS': 'C', 'LC_TELEPHONE': 'C', 'LC_MEASUREMENT': 'C', 'LC_IDENTIFICATION': 'C', 'LANGUAGE': 'C'}, 'stdin': None, 'stdout': -1, 'stderr': -1, 'with_communicate': True, 'timeout': None, 'bg': False, 'close_fds': True}', reason: [Errno 2] No such file or directory: '/usr/sbin/so-bpf-compile'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/templates.py", line 211, in render_tmpl
    output = render_str(tmplstr, context, tmplpath)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/templates.py", line 490, in render_jinja_tmpl
    raise SaltRenderError(
salt.exceptions.SaltRenderError: Problem running salt function in Jinja template: Unable to run command '['/usr/sbin/so-bpf-compile', 'bond0', '(not', 'port', '443)', 'and', '(not', 'host', '192.168.9.19)', 'and', '(not', 'net', '46.228.135.0/24)', 'and', '(not', 'net', '46.228.136.0/23)']' with the context '{'cwd': '/root', 'shell': False, 'env': {'SHELL': '/bin/bash', 'SUDO_GID': '1000', 'HISTCONTROL': 'ignoredups', 'HISTSIZE': '1000', 'HOSTNAME': 'onion-pcap-core', 'SUDO_COMMAND': '/bin/bash', 'SUDO_USER': 'onionroot', 'PWD': '/root', 'LOGNAME': 'root', 'HOME': '/root', 'LANG': 'en_US.UTF-8', 'LS_COLORS': 'rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=01;37;41:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=01;36:*.au=01;36:*.flac=01;36:*.m4a=01;36:*.mid=01;36:*.midi=01;36:*.mka=01;36:*.mp3=01;36:*.mpc=01;36:*.ogg=01;36:*.ra=01;36:*.wav=01;36:*.oga=01;36:*.opus=01;36:*.spx=01;36:*.xspf=01;36:', 'TERM': 'xterm-color', 'LESSOPEN': '||/usr/bin/lesspipe.sh %s', 'USER': 'root', 'SHLVL': '1', 'S_COLORS': 'auto', 'DEBUGINFOD_IMA_CERT_PATH': '/etc/keys/ima:', 'which_declare': 'declare -f', 'PATH': '/root/.local/bin:/root/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin', 'SUDO_UID': '1000', 'MAIL': '/var/spool/mail/root', 'OLDPWD': '/var/log', 'BASH_FUNC_which%%': '() {  ( alias;\n eval ${which_declare} ) | /usr/bin/which --tty-only --read-alias --read-functions --show-tilde --show-dot $@\n}', 'SSL_CERT_DIR': '/etc/pki/tls/certs', 'SSL_CERT_FILE': '/etc/pki/tls/cert.pem', 'LC_CTYPE': 'C', 'LC_NUMERIC': 'C', 'LC_TIME': 'C', 'LC_COLLATE': 'C', 'LC_MONETARY': 'C', 'LC_MESSAGES': 'C', 'LC_PAPER': 'C', 'LC_NAME': 'C', 'LC_ADDRESS': 'C', 'LC_TELEPHONE': 'C', 'LC_MEASUREMENT': 'C', 'LC_IDENTIFICATION': 'C', 'LANGUAGE': 'C'}, 'stdin': None, 'stdout': -1, 'stderr': -1, 'with_communicate': True, 'timeout': None, 'bg': False, 'close_fds': True}', reason: [Errno 2] No such file or directory: '/usr/sbin/so-bpf-compile'
/var/cache/salt/minion/files/base/bpf/pcap.map.jinja(16):
---
[...]
{{   MACROS.remove_comments(BPFMERGED, 'pcap') }}
{%   set PCAPBPF = BPFMERGED.pcap %}
{% endif %}

{% if PCAPBPF %}
   {% set PCAP_BPF_CALC = salt['cmd.run_all']('/usr/sbin/so-bpf-compile ' ~ GLOBALS.sensor.interface ~ ' ' ~ PCAPBPF|join(" "), cwd='/root') %}    <======================
   {% if PCAP_BPF_CALC['retcode'] == 0 %}
      {% set PCAP_BPF_STATUS = 1 %}
      {% set STENO_BPF_COMPILED =  ",\\\"--filter=" + PCAP_BPF_CALC['stdout'] + "\\\""  %}
   {% endif %}
{% endif %}
---
[CRITICAL] Rendering SLS 'base:pcap.config' failed: Problem running salt function in Jinja template: Unable to run command '['/usr/sbin/so-bpf-compile', 'bond0', '(not', 'port', '443)', 'and', '(not', 'host', '192.168.9.19)', 'and', '(not', 'net', '46.228.135.0/24)', 'and', '(not', 'net', '46.228.136.0/23)']' with the context '{'cwd': '/root', 'shell': False, 'env': {'SHELL': '/bin/bash', 'SUDO_GID': '1000', 'HISTCONTROL': 'ignoredups', 'HISTSIZE': '1000', 'HOSTNAME': 'onion-pcap-core', 'SUDO_COMMAND': '/bin/bash', 'SUDO_USER': 'onionroot', 'PWD': '/root', 'LOGNAME': 'root', 'HOME': '/root', 'LANG': 'en_US.UTF-8', 'LS_COLORS': 'rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=01;37;41:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=01;36:*.au=01;36:*.flac=01;36:*.m4a=01;36:*.mid=01;36:*.midi=01;36:*.mka=01;36:*.mp3=01;36:*.mpc=01;36:*.ogg=01;36:*.ra=01;36:*.wav=01;36:*.oga=01;36:*.opus=01;36:*.spx=01;36:*.xspf=01;36:', 'TERM': 'xterm-color', 'LESSOPEN': '||/usr/bin/lesspipe.sh %s', 'USER': 'root', 'SHLVL': '1', 'S_COLORS': 'auto', 'DEBUGINFOD_IMA_CERT_PATH': '/etc/keys/ima:', 'which_declare': 'declare -f', 'PATH': '/root/.local/bin:/root/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin', 'SUDO_UID': '1000', 'MAIL': '/var/spool/mail/root', 'OLDPWD': '/var/log', 'BASH_FUNC_which%%': '() {  ( alias;\n eval ${which_declare} ) | /usr/bin/which --tty-only --read-alias --read-functions --show-tilde --show-dot $@\n}', 'SSL_CERT_DIR': '/etc/pki/tls/certs', 'SSL_CERT_FILE': '/etc/pki/tls/cert.pem', 'LC_CTYPE': 'C', 'LC_NUMERIC': 'C', 'LC_TIME': 'C', 'LC_COLLATE': 'C', 'LC_MONETARY': 'C', 'LC_MESSAGES': 'C', 'LC_PAPER': 'C', 'LC_NAME': 'C', 'LC_ADDRESS': 'C', 'LC_TELEPHONE': 'C', 'LC_MEASUREMENT': 'C', 'LC_IDENTIFICATION': 'C', 'LANGUAGE': 'C'}, 'stdin': None, 'stdout': -1, 'stderr': -1, 'with_communicate': True, 'timeout': None, 'bg': False, 'close_fds': True}', reason: [Errno 2] No such file or directory: '/usr/sbin/so-bpf-compile'
/var/cache/salt/minion/files/base/bpf/pcap.map.jinja(16):
---
[...]
{{   MACROS.remove_comments(BPFMERGED, 'pcap') }}
{%   set PCAPBPF = BPFMERGED.pcap %}
{% endif %}

{% if PCAPBPF %}
   {% set PCAP_BPF_CALC = salt['cmd.run_all']('/usr/sbin/so-bpf-compile ' ~ GLOBALS.sensor.interface ~ ' ' ~ PCAPBPF|join(" "), cwd='/root') %}    <======================
   {% if PCAP_BPF_CALC['retcode'] == 0 %}
      {% set PCAP_BPF_STATUS = 1 %}
      {% set STENO_BPF_COMPILED =  ",\\\"--filter=" + PCAP_BPF_CALC['stdout'] + "\\\""  %}
   {% endif %}
{% endif %}
---
[INFO    ] Executing command '/usr/sbin/so-bpf-compile' in directory '/root'
[ERROR   ] Rendering exception occurred
Traceback (most recent call last):
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/cmdmod.py", line 781, in _run
    proc = salt.utils.timed_subprocess.TimedProc(cmd, **new_kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/timed_subprocess.py", line 53, in __init__
    self.process = subprocess.Popen(args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/subprocess.py", line 971, in __init__
    self._execute_child(args, executable, preexec_fn, close_fds,
  File "/opt/saltstack/salt/lib/python3.10/subprocess.py", line 1863, in _execute_child
    raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: '/usr/sbin/so-bpf-compile'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
...

Looks like something went wrong with compiling BPF-related things: The error message salt.exceptions.CommandExecutionError: Unable to run command '['/usr/sbin/so-bpf-compile', 'bond0' contains IP-addresses I've got in my BPF filters that are active on all sensor nodes. Same for the error message starting with salt.exceptions.SaltRenderError: Problem running salt function in Jinja template: Unable to run command '['/usr/sbin/so-bpf-compile', 'bond0 - again the IP-addresses are the ones I've got in my BPF-filters ever since.

In the end this seems like this is preventing the sensor node to come up (?)

I've included the full salt-call log here: salt-call-log.txt

Any clue what's going on here?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

#15441

This will be fixed in 2.4.210.

Try this on the sensor:

sudo salt-call saltutil.kill_all_jobs
sudo salt-call state.apply common
sudo so-checkin

[ejgh-oe]

Try this on the sensor:

sudo salt-call saltutil.kill_all_jobs
sudo salt-call state.apply common
sudo so-checkin

Awesome - you nailed it. After running the three commands above it took a couple of minutes the so-status on the (new) sensor node showed

                          Security Onion Status
              Container │ Status  │                              Details
────────────────────────┼─────────┼──────────────────────────────────────
           so-sensoroni │ running │                         Up 2 minutes
               so-steno │ running │                         Up 2 minutes
     so-strelka-backend │ running │                        Up 56 seconds
 so-strelka-coordinator │ running │                    Up About a minute
  so-strelka-filestream │ running │                        Up 53 seconds
    so-strelka-frontend │ running │                    Up About a minute
  so-strelka-gatekeeper │ running │                    Up About a minute
     so-strelka-manager │ running │                        Up 55 seconds
            so-suricata │ running │                         Up 2 minutes
            so-telegraf │ running │                         Up 2 minutes
                so-zeek │ running │ Up About a minute (health: starting)

 ✔ This onion is ready to make your adversaries cry!

[root@onion-pcap-core ~]#

the new node showed up on the grid and started doing its job.

Thanks Chris for your help