We are planning to upgrade our current version, 6.3.1 to 7.1.0. I have the following guide for the upgrade, and I was wondering if any other backup methods would be good to include that I'm missing here, or any other validation commands, also, is there anything to look out for? ================================================================================
SPLUNK SOAR UPGRADE: RHEL 8 UNPRIVILEGED (VERSION 6.3.1 TO 7.1.0)
================================================================================
Environment: RHEL 8.10 (Ootpa)
Install Type: Unprivileged (User: phantom)
SOAR Directory: /opt/phantom
================================================================================
--- PART 1: PRE-UPGRADE BACKUP ---
# 1. Navigate to the SOAR bin directory
cd /opt/phantom/bin
# 2. Run a full backup
# This captures your database, configuration, and custom apps.
./ib_backup.py --backup-type full --output /tmp/soar_pre_upgrade_backup.tar.gz
# 3. Verify the backup file exists and has size
ls -lh /tmp/soar_pre_upgrade_backup.tar.gz
--- PART 2: UPGRADE EXECUTION ---
# 1. Navigate to /tmp (Avoid /home as it is 96% full)
cd /tmp
# 2. Extract the RHEL 8 installer you downloaded
# The filename will look like: splunk_soar-unpriv-7.1.0-<timestamp>-rhel8.tgz
tar -xvf splunk_soar-unpriv-7.1.0-*-rhel8.tgz
# 3. Enter the extracted installer directory
cd soar-install
# 4. Run the preparation script
# This script verifies OS dependencies and available space.
./soar-prepare-upgrade --splunk-soar-home /opt/phantom
# 5. Execute the upgrade
# This stops SOAR services, migrates the database, and restarts services.
./soar-upgrade --splunk-soar-home /opt/phantom
--- PART 3: VALIDATION & VULNERABILITY CHECK ---
# 1. Check Service Status
# All services, including Watchdog (9002), should be 'running' or 'UP'.
/opt/phantom/bin/soar_services status
# 2. Verify the PostgreSQL Version (The Security Fix)
# This confirms you are no longer on a version vulnerable to the CVEs.
# Expected: 15.16 or higher.
/opt/phantom/usr/bin/psql --version
# 3. Confirm Port 9002 is Listening
# This is the internal watchdog port.
netstat -tulpn | grep 9002
# 4. Verify UI Version
# Log into the Web UI -> Administration -> Product Settings.
# Confirm the version reflects 7.1.0.
... View more