Splunk SOAR

Restoring From Backup w Warm Standby Question

catherinelam
Explorer

My environment contains two EC2s: one primary and one warm standby. Due to a series of unfortunate events, our database on the warm standby got corrupted and phantom would not start on it. Luckily, we had a volume backup in AWS of the SOAR directory, so it was saved. 

However, after some research afterwards, we found a different method of backing up: https://docs.splunk.com/Documentation/SOARonprem/6.2.2/Admin/BackupOrRestoreAndWarmStandby

I think I'm being dense and overthinking it, but the article mentions a "primary warm standby", a "primary" + a "secondary" + a "warm standby" later on in the article. How many servers are in this configuration? I am not understanding how it is being set up and what the secondary is referencing. Also, what is a "primary warm standby"?

Would this article be helpful in the situation I described above with my failed warm standby? 

Labels (1)
Tags (2)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@catherinelam 

A warm standby is only ever 2 servers, 1 Parent & 1 Child. The Parent syncronises to the Child via postgres sync and rsync for shared files. The failover is still manual but can be scripted if you have the right probe setup on the LB to check and alert when the primary becomes unavailable. 

Personally I think using AWS functionality to restore will give you a quicker time to recovery.

View solution in original post

phanTom
SplunkTrust
SplunkTrust

@catherinelam 

A warm standby is only ever 2 servers, 1 Parent & 1 Child. The Parent syncronises to the Child via postgres sync and rsync for shared files. The failover is still manual but can be scripted if you have the right probe setup on the LB to check and alert when the primary becomes unavailable. 

Personally I think using AWS functionality to restore will give you a quicker time to recovery.

catherinelam
Explorer

Could you clarify what the documentation meant when it said "secondary" and "warm standby primary", if a warm standby only has two servers? I am curious. 

Just wanted to consider my options for backups and present them. 🙂 

0 Karma

phanTom
SplunkTrust
SplunkTrust

@catherinelam "warm standby" is the architecture and Primary / Secondary is the server role. One is only active at any one time. 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...