Post-Installation Commands Has Errors

[Github-NUD]

After installing LME, which completed without errors, when I go to the Post-Installation section https://cisagov.github.io/lme-docs/docs/markdown/reference/troubleshooting/#post-installation-troubleshooting and run ls -al and those three location, I have two that cannot be found:

Commands ran:
ls -al /opt/lme/FLEET_SETUP_FINISHED
ls -al /opt/lme/dashboards/elastic/INSTALLED
ls -al /opt/lme/dashboards/wazuh/INSTALLED

Results:
root@NUDSIEM:# ls -al /opt/lme/FLEET_SETUP_FINISHED
-rw-r--r-- 1 root root 0 Feb 25 15:12 /opt/lme/FLEET_SETUP_FINISHED
root@NUDSIEM:# ls -al /opt/lme/dashboards/elastic/INSTALLED
ls: cannot access '/opt/lme/dashboards/elastic/INSTALLED': No such file or directory
root@NUDSIEM:~# ls -al /opt/lme/dashboards/wazuh/INSTALLED
ls: cannot access '/opt/lme/dashboards/wazuh/INSTALLED': No such file or directory

The reason I went to the 'Post-Installation' troubleshooting section is because I am unable to reach our Ubuntu system running the LME services over port 8220.

PS: Test-NetConnection 10.10.16.8 -port 8220
WARNING: TCP connect to (10.10.16.8 : 8220) failed

ComputerName : 10.10.16.8
RemoteAddress : 10.10.16.8
RemotePort : 8220
InterfaceAlias : Ethernet 7
SourceAddress : 10.10.77.20
PingSucceeded : True
PingReplyDetails (RTT) : 0 ms
TcpTestSucceeded : False

Ports are open, no firewall/routing issues. Set ufw to allow each port/tcp and to prove that I can access the Ubuntu system, 3389 from my windows machine works without errors.

I am stuck with the TCP connection over 8220 and 9200 only 3389 works:
root@NUD# sudo ufw status
Status: active

To Action From

---

3389/tcp ALLOW Anywhere
9200/tcp ALLOW Anywhere
8220/tcp ALLOW Anywhere
1251/tcp ALLOW Anywhere
1253/tcp ALLOW Anywhere
22/tcp ALLOW Anywhere
3389/tcp (v6) ALLOW Anywhere (v6)
9200/tcp (v6) ALLOW Anywhere (v6)
8220/tcp (v6) ALLOW Anywhere (v6)
1251/tcp (v6) ALLOW Anywhere (v6)
1253/tcp (v6) ALLOW Anywhere (v6)
22/tcp (v6) ALLOW Anywhere (v6)

hosts has the hostname with the static IP address, LME enviroment file has IPVAR with the static IP as well.

Can anyone guide me in what troubleshooting steps I can do to move past this?

[pratikrath126]

Hey! A couple quick checks that usually explain this in LME installs:

1. Is Fleet Server actually running and bound on 8220?

   • sudo ss -lntp | grep 8220
   • docker ps --format 'table {{.Names}}\t{{.Ports}}' | grep 8220
   • If you're on the docker install, the Fleet Server container should expose 8220:8220.

2. If it’s running, try the local health endpoint from the LME host:

   • curl -k https://localhost:8220/api/status
   • If that fails locally, it’s a service/container issue rather than firewall/routing.

3. If local works but remote doesn’t, it’s usually bind/addressing:

   • Check HOST_IP / FLEET_PORT in your env file.
   • If you’re using docker-compose, verify the ports block includes "8220:8220".

About the missing INSTALLED markers: I’ve seen those not created if the dashboards step didn’t run/complete. You can re-run just the dashboards install or check the install logs for the dashboard tasks.

If you can share the output of ss -lntp | grep 8220 and docker ps (or podman ps), I can help narrow it down.

[Github-NUD]

Thank you Pratikrath, here's the output:

root@NUDSIEM:# ss -lntp | grep 8220
LISTEN 0 4096 0.0.0.0:8220 0.0.0.0:* users:(("conmon",pid=8256,fd=5))
root@NUDSIEM:# podman ps --format 'table {{.Names}}\t{{.Ports}}' | grep 8220
lme-fleet-server 0.0.0.0:8220->8220/tcp
root@NUDSIEM:# curl -k https://localhost:8220/api/status
{"name":"fleet-server","status":"HEALTHY"}root@NUDSIEM:#

I believe you are correct that our issue is with the binding/addressing, but I am unsure how to remediate that.

[Github-NUD]

I reinstalled everything without enabling gnome-remote-desktop. Doing installation work directly on the system. I ran the commands again and have the following from podman:

systemadmin@NUDSIEM:/LME/LME-2.2.0/scripts$ sudo ss -lntp | grep 8220
LISTEN 0 4096 0.0.0.0:8220 0.0.0.0:* users:(("conmon",pid=8270,fd=5))
systemadmin@NUDSIEM:/LME/LME-2.2.0/scripts$ podman ps --format 'table {{.Names}}\t{{.Ports}}' | grep 8220
WARN[0000] Attempting to use /usr/share/containers/storage.conf, faccessat /etc/containers/storage.conf: permission denied
Failed to obtain podman configuration: finding config on system: open /etc/containers/containers.conf.d: permission denied
systemadmin@NUDSIEM:/LME/LME-2.2.0/scripts$ ^C
systemadmin@NUDSIEM:/LME/LME-2.2.0/scripts$ curl -k https://localhost:8220/api/status
{"name":"fleet-server","status":"HEALTHY"}systemadmin@NUDSIEM:~/LME/LME-2.2.0/scripts$

If I run the podman ps command as root I get the following:

systemadmin@NUDSIEM:/etc$ sudo -i
root@NUDSIEM:~# podman ps --format 'table {{.Names}}\t{{.Ports}}' | grep 8220
lme-fleet-server 0.0.0.0:8220->8220/tcp

[Github-NUD]

This is resolved by disabling the Ubuntu firewall.