SOAR - upgrade to 6.2.1 failed in RunPgUpgrade step

Applicability

Description

Upgrade SOAR from 6.1.1 to the version 6.2.1 with the following steps:

1. Prerequisites for upgrading Splunk SOAR (On-premises)

2. Check database required disk size 

3. Upgrade SOAR version 6.2.1 RH7 until step 10 in Upgrade a Splunk SOAR (On-premises) instance

There is no issue when performing the same upgrade in the testing system.

Investigation

The error in <PHANTOM_HOME>/var/log/phantom_install_log:

{"component": "installation_log", "time": "2024-07-16T21:10:47.462070", "logger": "install.console", "pid": 3541, "level": "DEBUG", "file": "/opt/phantom/splunk-soar/install/console.py", "line": 256, "message": "Subprocess completed.", "install_run_uuid": "c412d254-2fea-4021-9543-66e746a6302f", "start_time": "2024-07-16T20:08:40.409143", "install_mode": "upgrade", "installed_version": "6.1.1.211", "proposed_version": "6.2.1.305", "deployment_type": "unpriv", "continue_from": null, "phase": "deploy", "operation_start_time": "2024-07-16T21:10:47.447930", "operation_name": "RunPgUpgrade", "operation_status": "started", "operation_type": "task", "operation_cluster_phase": "ClusterPhase.NONE", "log_type": "subprocess", "command": "/opt/phantom/usr/postgresql/15/bin/pg_upgrade --old-bindir=/opt/phantom/usr/postgresql/11/bin --new-bindir=/opt/phantom/usr/postgresql/15/bin --old-datadir=/opt/phantom/data/db.old --new-datadir=/opt/phantom/data/db --jobs=14 --username=phantom", "environment_variables": {"HOME": "/home/phantom", "PATH": "/opt/phantom/usr/bin:/opt/phantom/lib3/pip/soar-packages/bin:/opt/phantom/bin:/opt/phantom/usr/postgresql/bin:/opt/phantom/usr/python39/bin:/opt/phantom/usr/perl/bin:/opt/phantom/usr/pgbackrest/bin:/opt/phantom/usr/erlang/bin:/opt/phantom/usr/rabbitmq/sbin:/sbin:/bin:/usr/sbin:/usr/bin"}, "status": "failed", "exit_code": 1, "stdout": ["", "You must have read and write access in the current directory.", "Failure, exiting"], "stderr": [], "time_elapsed_since_start": 3727.053066, "time_elapsed_since_operation_start": 0.014287}

The error message indicates that the username "phantom" has no permission of read and write in the current directory. If you're running the upgrade from /opt/phantom/splunk-soar directory, that is the current directory being mentioned in the message.

Resolution

Use the command to change the <PHANTOM_HOME>/splunk-soar and all files and folders under it to the ownership of phantom user.

chmod -R phantom:phantom <PHANTOM_HOME>/splunk-soar