Disconnected from manager

[011248163264]

After installation, while reviewing the freshly-installed Security Onion console, I see a message at the top. It toggles between "Attempting to connect to manager" and "Disconnected from manager" continuously, every few seconds. It's a standalone install.. So-status shows that everything it sees is OK. Where should I look to begin resolving this?

the server have only one static lokal ipadress with no proxy i connect direct to the lokal ip with ssl.
The ssl is a selfsign ssl cert.

when i restart the server is it working a few minuts

version 2.3.90

[tientmse62290]

Same problem in 2.3.120. Web interface show status "Disconnected from manager" and "Attempting to connect to manager" too
All port are opened
I use a nginx reverse proxy nginx with company's certificate and forward to web

[tiger-greenhell]

Attention. It is necessary to think that part of the communication is realized via websocket.

[dougburks]

@tientmse62290 Please see @tiger-greenhell's response and, if you have further questions or problems, please start a new discussion. From #1720:

Start a new discussion instead of replying to somebody else's discussion
Please search to see if you can find similar discussions that may help you. However, in order to avoid confusion, please do NOT reply to somebody else's discussion with your own issue. Instead, please start a new discussion and in that new discussion you can provide a hyperlink to the related discussion.

[dougburks]

@01123581321345589144233 What browser are you using?

Have you checked the logs in /opt/so/log/soc/ for additional clues?

[dougburks]

Is it possible that the machine that your browser is running on has minimal RAM and having too many tabs open is causing problems?

[011248163264]

Hi i have 16GB ram yes and 10-15 tabs open, but they are not sos tabs. i have updatet to 2.3.130 and
the issue is still there. The issue is only when i open more sos tabs, Grafana, Kibana ......

[dougburks]

This is a strange issue. Do you have Wazuh enabled and, if so, have you checked to see if perhaps Wazuh Active Response could be interfering?

[011248163264]

yes wazuh is enabled on all 9 hosts
"Do you have Wazuh enabled and, if so, have you checked to see if perhaps Wazuh Active Response could be interfering?"
i try to figure out

[Njinx]

@01123581321345589144233 Did you ever figure this out?