global.sts suricata, zeek and steno sections removed

[polivia]

Some automated process ran this morning and removed all my bpf filters in /opt/so/saltstack/local/pillar/global.sts . Suricata, zeek and steno all seem to still have the bpf setttings, but the global.sts has a new time stamp and the suricate, zeek and steno sections are gone. I cannot seem to find what caused this in the logs. Any ideas why this would happen?

[polivia]

soversion: 2.3.1

[TOoSmOotH]

There is no automated process that touches global.sls. The only time this would be modified would be when running soup and only specific values get updated such as soversion. Do the wazuh logs give any clues?

[polivia]

It's getting touched regularly by something. It happens every 15 mins:

#ls -ltr
...
-rw-r--r--. 1 socore socore 2465 Oct 26 14:28 global.sls

date

Mon Oct 26 14:41:59 UTC 2020

pwd

/opt/so/saltstack/local/pillar

#ls -ltr
...

-rw-r--r--. 1 socore socore 2465 Oct 26 14:43 global.sls

Here is the /var/ossec/logs/ossec.log from today:

2020/10/26 09:10:18 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2020/10/26 09:12:35 ossec-syscheckd: INFO: (6008): File integrity monitoring scan started.
2020/10/26 09:12:39 ossec-syscheckd: INFO: (6009): File integrity monitoring scan ended.
2020/10/26 09:37:57 rootcheck: INFO: Starting rootcheck scan.
2020/10/26 09:43:17 rootcheck: INFO: Ending rootcheck scan.
2020/10/26 10:10:09 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2020/10/26 10:10:18 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2020/10/26 11:10:09 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2020/10/26 11:10:18 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2020/10/26 12:10:10 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2020/10/26 12:10:19 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2020/10/26 13:10:10 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2020/10/26 13:10:19 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2020/10/26 14:10:10 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2020/10/26 14:10:19 wazuh-modulesd:syscollector: INFO: Evaluation finished.

/nsm/wazuh/logs/ossec.log:

2020/10/26 00:00:10 ossec-monitord: INFO: Starting new log after rotation.
2020/10/26 09:12:16 ossec-syscheckd: INFO: (6008): File integrity monitoring scan started.
2020/10/26 09:12:18 ossec-syscheckd: INFO: (6009): File integrity monitoring scan ended.
2020/10/26 09:13:49 rootcheck: INFO: Starting rootcheck scan.
2020/10/26 09:14:11 rootcheck: INFO: Ending rootcheck scan.