SOAR - restore failed with environment variables check

Applicability

Description

When running a restore from an ibackup, it failed with the error in the log:

Restore point environment variable's value: PERL5LIB=/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl: is different than local value: /opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:
Restore point environment variable's value: LIBRARY_PATH=/opt/phantom/usr/python39/lib64:/opt/phantom/usr/python39/lib64: is different than local value: /opt/phantom/usr/python39/lib64:/opt/phantom/usr/python39/lib64:/opt/phantom/usr/python39/lib64:/opt/phantom/usr/python39/lib64:
Current environment has changed since restore point:
Restore point environment variable's value: PERL5LIB=/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl: is different than local value: /opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:/opt/phantom/usr/perl/lib64/perl5:/opt/phantom/usr/perl/lib64/perl5/vendor_perl:/opt/phantom/usr/perl/share/perl5:/opt/phantom/usr/perl/share/perl5/vendor_perl:
Restore point environment variable's value: LIBRARY_PATH=/opt/phantom/usr/python39/lib64:/opt/phantom/usr/python39/lib64: is different than local value: /opt/phantom/usr/python39/lib64:/opt/phantom/usr/python39/lib64:/opt/phantom/usr/python39/lib64:/opt/phantom/usr/python39/lib64:
The environment settings contained in the Splunk SOAR backup do not match the environment settings for the destination.
An unexpected error occurred

Investigation

The env variables check in restore can fail if the source system has been upgraded multiple times and the target system is a fresh system, due to multiple duplicate values being present in various environment variables.

Resolution

There are two workaround options:

Option #1: The workaround is to use the --ignore-env-check option when doing a restore after verifying that the environment check fails due to duplicates and not because of some value being actually different, for example source system having PHANTOM_FIPS_MODE=0 and target system having PHANTOM_FIPS_MODE=1.

Option #2: Commenting out the offending paths in the <$PHANTOM_HOME>/etc/enable file. You also need to temporarily disable the offending environment variables in the SSH session. Run the command:

unset LIBRARY_PATH
unset PERL5LIB

After it, running restore will show the messages:

Local environment missing environment variable: PERL5LIB. This variable will be reset after restore 
Local environment missing environment variable: LIBRARY_PATH. This variable will be reset after restore