SOAR - phantom service failed to start

Available Languages

Updated:October 1, 2026
Document ID:SPLK053735

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk SOAR 6.4.x

Description

Warm standby configuration. Phantom failed start in secondary server with error "Celerybeat Failed to start. Check /opt/soar/var/log/phantom/celery_beat_supervisord.log for more info."  


Investigation

The error shows in <$PHANTOM_HOME>/var/log/phantom/celery_beat_supervisor.log:

[2026-02-04 15:05:47,966: WARNING/MainProcess] (0, 0): (403) ACCESS_REFUSED - Login was refused using authentication mechanism PLAIN.

It was caused by a race condition where celery failed connections to the RabbitMQ during bootup and it prevented phantom from starting successfully. 


Resolution

This is a known issue in SOAR 6.4.x. It is fixed in SOAR 7.0.0 or later version which updates the celery configuration to allow for retrying connections to the broker (RabbitMQ) upon failure during bootup as well as a bumped limit to supervisord process checks in start_phantom.sh. The solution is to upgrade to SOAR 7.x or later version. As a temporary workaround before upgrade, retrying start_phantom.sh script and sometimes it worked.

Revision History

Revision Publish Date Comments
1.0
01-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco