Splunk SOAR

Not able to start Phantom

ansusabu
Communicator

While starting the Phantom server we are receiving the following error: "psql: ERROR: pgbouncer cannot connect to server". How can I resolve the issue?

Labels (1)
0 Karma
1 Solution

phantom_mhike
SplunkTrust
SplunkTrust

I have seen this issue three times. The first time the psql process had not completely halted and two psql instances were live and causing issues. The second time the port was never released and psql would fail to start because it couldnt attach to the configured port. The last time was because the file system had maxed out and psql was failing to start because there was no space to log.

As far as I can tell, you will only see this error when psql is down or unreachable via the configured port.
The easiest way to resolve it is to do a full bounce of the host that phantom is running on since no processes or port claims will survive, but if that doesnt fix the issue then you will need to take a look at psql logs and figure out why it is failing to start.

Its always possible that there is another reason that you could see this error that i havent encountered so please update here when you find the issue.

View solution in original post

0 Karma

phantom_mhike
SplunkTrust
SplunkTrust

I have seen this issue three times. The first time the psql process had not completely halted and two psql instances were live and causing issues. The second time the port was never released and psql would fail to start because it couldnt attach to the configured port. The last time was because the file system had maxed out and psql was failing to start because there was no space to log.

As far as I can tell, you will only see this error when psql is down or unreachable via the configured port.
The easiest way to resolve it is to do a full bounce of the host that phantom is running on since no processes or port claims will survive, but if that doesnt fix the issue then you will need to take a look at psql logs and figure out why it is failing to start.

Its always possible that there is another reason that you could see this error that i havent encountered so please update here when you find the issue.

0 Karma

phantom_mhike
SplunkTrust
SplunkTrust

Were you able to resolve this? Was my answer helpful or was it an unrelated issue? If unrelated, please post about it here.

0 Karma

ansusabu
Communicator

I resolved the issue by restoring the VM image.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...