Splunk SOAR

Not able to start Phantom

ansusabu
Communicator

While starting the Phantom server we are receiving the following error: "psql: ERROR: pgbouncer cannot connect to server". How can I resolve the issue?

Labels (1)
0 Karma
1 Solution

phantom_mhike
SplunkTrust
SplunkTrust

I have seen this issue three times. The first time the psql process had not completely halted and two psql instances were live and causing issues. The second time the port was never released and psql would fail to start because it couldnt attach to the configured port. The last time was because the file system had maxed out and psql was failing to start because there was no space to log.

As far as I can tell, you will only see this error when psql is down or unreachable via the configured port.
The easiest way to resolve it is to do a full bounce of the host that phantom is running on since no processes or port claims will survive, but if that doesnt fix the issue then you will need to take a look at psql logs and figure out why it is failing to start.

Its always possible that there is another reason that you could see this error that i havent encountered so please update here when you find the issue.

View solution in original post

0 Karma

phantom_mhike
SplunkTrust
SplunkTrust

I have seen this issue three times. The first time the psql process had not completely halted and two psql instances were live and causing issues. The second time the port was never released and psql would fail to start because it couldnt attach to the configured port. The last time was because the file system had maxed out and psql was failing to start because there was no space to log.

As far as I can tell, you will only see this error when psql is down or unreachable via the configured port.
The easiest way to resolve it is to do a full bounce of the host that phantom is running on since no processes or port claims will survive, but if that doesnt fix the issue then you will need to take a look at psql logs and figure out why it is failing to start.

Its always possible that there is another reason that you could see this error that i havent encountered so please update here when you find the issue.

0 Karma

phantom_mhike
SplunkTrust
SplunkTrust

Were you able to resolve this? Was my answer helpful or was it an unrelated issue? If unrelated, please post about it here.

0 Karma

ansusabu
Communicator

I resolved the issue by restoring the VM image.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...