SOAR - ibackup error DB tarball creation failed

Available Languages

Updated:September 29, 2026
Document ID:SPLK048422

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk SOAR 6.1.1

Description

Using the command to do a full backup:

phenv ibackup --backup --backup-type full --backup-path /<folder_name>

Investigation

The backup log file under <PHANTOM_HOME>/var/log/phantom folder shows the error:

[2025-02-13 03:52:51.919] - DEBUG - tar: /opt/phantom/data/ibackup/staging/db_dump.tar: Wrote only 2048 of 10240 bytes
[2025-02-13 03:52:51.919] - DEBUG - tar: Error is not recoverable: exiting now
[2025-02-13 03:52:51.923] - ERROR - wrapper failed
Traceback (most recent call last):
File "pycommon3/phantom_common/phlock.py/phlock.py", line 45, in wrapper
File "www/phantom_ui/reliability/core/system/file_utils.py/file_utils.py", line 121, in wrapper
File "www/phantom_ui/reliability/backup/backup_manager.py/backup_manager.py", line 556, in backup
File "www/phantom_ui/reliability/backup/backup_manager.py/backup_manager.py", line 317, in create_backup_tar
File "www/phantom_ui/reliability/backup/itar.py/itar.py", line 45, in create_tar
File "www/phantom_ui/reliability/backup/itar.py/itar.py", line 89, in run_tar
File "pycommon3/phantom_common/phproc.py/phproc.py", line 326, in run
File "pycommon3/phantom_common/phproc.py/phproc.py", line 457, in check_returncode
phantom_common.phproc.PhCalledProcessError: DB tarball creation failed.

Running the command "df -h" to check disk space. The tar command doesn't really indicate it. The command output shows that the disk space is not sufficient for full backup.


Resolution

Increase the disk space and re-run the ibackup.

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco