Splunk SOAR

Not able to start Phantom

ansusabu
Communicator

While starting the Phantom server we are receiving the following error: "psql: ERROR: pgbouncer cannot connect to server". How can I resolve the issue?

Labels (1)
0 Karma
1 Solution

phantom_mhike
SplunkTrust
SplunkTrust

I have seen this issue three times. The first time the psql process had not completely halted and two psql instances were live and causing issues. The second time the port was never released and psql would fail to start because it couldnt attach to the configured port. The last time was because the file system had maxed out and psql was failing to start because there was no space to log.

As far as I can tell, you will only see this error when psql is down or unreachable via the configured port.
The easiest way to resolve it is to do a full bounce of the host that phantom is running on since no processes or port claims will survive, but if that doesnt fix the issue then you will need to take a look at psql logs and figure out why it is failing to start.

Its always possible that there is another reason that you could see this error that i havent encountered so please update here when you find the issue.

View solution in original post

0 Karma

phantom_mhike
SplunkTrust
SplunkTrust

I have seen this issue three times. The first time the psql process had not completely halted and two psql instances were live and causing issues. The second time the port was never released and psql would fail to start because it couldnt attach to the configured port. The last time was because the file system had maxed out and psql was failing to start because there was no space to log.

As far as I can tell, you will only see this error when psql is down or unreachable via the configured port.
The easiest way to resolve it is to do a full bounce of the host that phantom is running on since no processes or port claims will survive, but if that doesnt fix the issue then you will need to take a look at psql logs and figure out why it is failing to start.

Its always possible that there is another reason that you could see this error that i havent encountered so please update here when you find the issue.

0 Karma

phantom_mhike
SplunkTrust
SplunkTrust

Were you able to resolve this? Was my answer helpful or was it an unrelated issue? If unrelated, please post about it here.

0 Karma

ansusabu
Communicator

I resolved the issue by restoring the VM image.

0 Karma
Get Updates on the Splunk Community!

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...