nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

ArcGIS Enterprise 11.3 / 11.4 vs 11.1 Portal Web Adaptor Install Order

DavidColey

Hello - In prepping for the Enterprise 11.3 Portal upgrade this weekend, I just now noticed that the step for the Web Adaptor Uninstall - Re-Install has been moved from Step 3 in the upgrade documentation for 11.1:

https://enterprise.arcgis.com/en/portal/11.1/install/windows/upgrade-portal-for-arcgis.htm

3. Sign in to the machine hosting the ArcGIS Web Adaptor you're using with your portal, and uninstall ArcGIS Web Adaptor. For full instructions, see the uninstallation topic for IIS or Java (Windows). Be sure to note the name of the Web Adaptor before you uninstall it.

to Step 9 in the latest upgrade documentation for 11.3:

https://enterprise.arcgis.com/en/portal/latest/install/windows/upgrade-portal-for-arcgis.htm

9. Sign in to the machine hosting the ArcGIS Web Adaptor you're using with your portal, and uninstall ArcGIS Web Adaptor. For full instructions, see the uninstallation topic for IIS or Java (Windows). Be sure to note the name of the Web Adaptor before you uninstall it.

So in other words, we are now supposed to leave the 11.2 web adaptor version in place on my web server until AFTER we run the Portal upgrade and post-upgrade steps?

I've done this so many times since 10.6 and we have always removed the web adaptor BEFORE running the Portal Setup.exe. Can anyone comment?

Thanks -

David

Sarasota County GIS

Vind meer berichten getagd met

Accepted answers

All comments

MMBR

Yes, I noticed that change in the documentation myself.

It is fine to

1. update Portal, run the Portal post-upgrade

2. then after that remove the Portal old webadaptor and install the Portal new webadaptor

3. update Server, run the Server post-upgrade

4. then after that remove the Server old webadaptor and install the Server new webadaptor

I have done the upgrade in this order for many releases.

I hope this helps.

DavidColey

Hmm, ok Marcelo, thanks for the reply. Up to and including 11.2 I have always uninstalled web adaptor for portal and server prior to running the portal and server setup exe's, per the help docs.

I did just now notice that at 11.2 the web adaptor un-install / install steps are documented as to be completed after the post-upgrade for portal.

Some of us had problems with content and language being un-available to the portal after the 11.2 install, and now I am wondering if the web adaptor for version 11.1 should have been left in place while the 11.2 was upgrading and post-upgrading.

So for this 11.2 to 11.3 upgrade, I will leave the portal WA at 11.2 in place per this new documentation.

For Server, I don't think it matters for the un-install install order. But - I have always un-installed the WA prior to Server setup exe upgrades, and will continue to do so since the Server help doc does not specifically say not to.

Scott_Tansley

Hey. I did a dev upgrade this week and did it using the original step 3 upgrade. No issues. I

DavidColey

Great, thanks Scott. I always thought it didn't really matter, especially with fully distributed deployments.

After all, whether portal or server, we can always unregister / register a web adaptor after installs / upgrades.

Now I'm back in the step 3 camp, since that's what I know. . .

Scott_Tansley

My typical approach is portal. Then from 7443 I'll run the initial content upgrade. It then tells you to do the WA. I replace the WA, and then do the final organisation upgrade via the web adaptor. The written instructions may differ, but the process that you're guided through by the upgrade process is no different. I am going to re-read those instructions now though... 😉

DavidColey

Well, I would say that, for new installs of Enterprise and Portal, that installing the WA after you run through the post-upgrade is exactly right

But for upgrades, the WA should be uninstalled, or at least unregistered, from Portal first.

Same for Server.

Scott_Tansley

I do about 50 upgrades a year on average, I've always followed the guidelines here:

https://enterprise.arcgis.com/en/portal/latest/install/windows/upgrade-portal-for-arcgis.htm#:~:text=your%20portal%27s%20content.-,ArcGIS%20Enterprise%20upgrade%20order,-The%20recommended%20order

The recommended order to upgrade the components in your ArcGIS Enterprise deployment is as follows:

Upgrade Portal for ArcGIS.
Upgrade ArcGIS Web Adaptor (for Portal for ArcGIS) for IIS or Java (Windows).
Upgrade the ArcGIS Server site serving as the portal's hosting server.
Upgrade ArcGIS Web Adaptor (for ArcGIS Server) for IIS or Java (Windows).
Upgrade ArcGIS Data Store.
If your ArcGIS Enterprise deployment includes them, upgrade federated servers.

By leaving the old WA in place, I can still use SAML2 and test each software component as it upgrades. I've just taken one client from 10.8.1 to 11.1 and another from 10.9.1 to 11.3 using that approach and was able to do smoke testing with the old web adaptor in place, before, replacing the web adaptor.

I mean, each to their own, but my whole business largely centres around upgrading clients for whom I originally built their environments. I have no reason to change the approach. 🙂

DavidColey

Yes, i do not do it differently, which is why I was surprised to see the change in the Portal upgrade steps.

I do not have SAML as an auth mechanism, so for me there is no smoke testing. I appreciate the help

ryanuthoff

This isn't the first time there have been inconsistencies with the ArcGIS Enterprise installation/upgrade documentation. I called it out here for the 11.1 documentation. https://community.esri.com/t5/arcgis-enterprise-questions/inconsistent-arcgis-enterprise-upgrade-order-in/m-p/1302531

In reality, maybe the order doesn't matter and that's fine. But it doesn't give me a warm and fuzzy feeling when we have inconsistent documentation and that even Esri staff is deviating away from the "official" documentation in their own upgrades. I mean someone made the decision to change the upgrade order in the documentation and there must be a reason behind it. What is that reason?

DavidColey

Yes I totally agree @RyanUthoff . My understanding since 10.6 is that we uninstall the WAs before running the setup upgrade exes so that calls to Portal (and then Server) through the web adaptor urls can't get to the machines during their upgrades.

So yes I don't understand the change, and there is no documentation on the reason. It's just 'changed'.

I recall seeing your post at my upgrade from 11.0 to 11.1 but because I had completed the upgrade by uninstalling WA first, (11.1 Step 3) I had no comment to make.

Yes, I do see now that this doc for 11.0:

https://support.esri.com/en-us/knowledge-base/upgrade-arcgis-enterprise-000029452

from the knowledge base reads to uninstall the WA after the portal post-upgrade has completed so no one knows what is 'correct'.

BUT, now since both the 11.2 and 11.3 steps and the knowledge base doc say to do the WA uninstall - install after post upgrade(s), this is what I am going to do.

@dhochhal

DavidColey

Ok so I completed 11.3 upgrade this Saturday. We have a completely distributed deployment, with all of the components - Web Adaptors, Portal, Hosting Site, Relational Datastore, Tile Cache Datastore and a Federated Server Site that supports our Image Server and SDE feature access services on separate servers.

For the first time, I was able to convince our EIT security to allow the capability to suspend active virus scanning during the upgrades. So for Portal, Server and Datastore what used to take 3 -4 hours per server, with various hanging points during both upgrade and post-upgrade, now took 15 - 30 minutes.

So for our entire enterprise, the update would take up to 18 hours. I had the entire deploy upgraded, cleaned and tested, in 5 hours.

I can't express how thrilled I was. Simply by suspending active virus scanning during the upgrade and post-upgrades.

I did run into one hiccup that relates to this thread. While adopting the updated uninstall - reinstall order for web adaptor, the reinstalls went just fine for both Portals' WA and the Hosting Site WA.

But for the Federated Site WA, the reinstall failed with a window installer message:

'Can't complete install because a folder with the same name already exists in the ....\innetpub\wwwroot... directory. Remove the folder or rename the install'. Having never seen this before, I wasn't quite sure what to do.

So I made sure that the 11.2 web adaptor was no longer registered with the 11.3 Federated Site and then I went into the wwwroot folder and physically delete the windows directory. Then I ran the install again and it did complete. It then took a few minutes for the IIS to recognize? I guess? my 'agsfed' WA name and it spun up via localhost and I was then able to configure.

Everything is up and clean so far, but am now thinking, that for my Federated Site, I may go back to removing the WA prior to running the Server upgrade exe . . . but otherwise not real sure if there was a better way to handle this.

@MarceloMarques

@Scott_Tansley

Scott_Tansley

Hey, very very occasionally I get that WA issue on install. It appears random, and I put it down to bad luck. As you suggested, I just clean it out of the Server/Portal Admin API, then hard delete it from IIS and the disk. I've never had an issue with installing after those actions. If it's working now, I see no reason to change it.

Also agreed that AV makes a massive difference. Well done on your upgrade. 🙂

DavidColey

Great thanks for the reply Scott, I just didn't know if there was a more elegant way to handle.

If occurs again in the future, I'll remove in order of Porta/Server>unregister (if still present )>remove from IIS>remove any remaining files from windows directory>install new.

Yes suspending AV was truly remarkable. I've been asking my EIT security group to allow this for 10 - 12 years now, they finally relented . . .

JoëlHempenius3

#TLDR; deinstalling the WA first prevents other systems from messing around with the ArcGIS Server.

I would still use the old way of upgrading. I'm currently working for a large utility upgrading a four tier DTAP from 11.1 to 11.3 and ArcGIS Server was giving me headache.

I'm using ArcGIS Powershell DSC for installation and upgrade and it will upgrade the portal or server first before doing anything on the webadaptors.

Right now I did upgrade DTA and everytime Powershell DSC would fail on the ArcGIS Server post-upgrade. After the error ArcGIS Server service was stopped and no error message pointing to what happened. I could go to https://server:6443/arcgis/admin/upgrade and start the upgrade again, if I remember correctly it would reporrt after I clicked POST that it completed four steps, but it would never complete the next step.

When this happened I reverted the snapshot and did a manual install, and after configuring the license execute the post-upgrade from MS Edge. The first time this worked and the server upgrade was completed. The second time I reverted the snapshot, did a manual install and I executed the command line post upgrade. This would result after some time in a connection reset error and at this stage the ArcGIS Server wouldn't work anymore, much like the state I would get from Powershell DSC. At this point I reverted the snapshot again, and reinstalled manually using MS Edge for the post-upgrade.

For both servers, the WA was still installed and working.

The third server, I upgraded manually, configured the license, but then I had to do some other things first and so it took some time before I returned to finish the post-upgrade in the browser. When I returned, I couldn't navigate to the localhost:6443 url and the webpage wouldn't open. ArcGIS Server was stopped as a Windows Service and after starting it and navigating to localhost:6443/arcgis/admin/upgrade and starting the upgrade I immediately saw that it completed the first four steps! But how? Not sure how, but the webadapter was still there, fully functioning and ArcGIS Server at this stage would send 302 redirects to the upgrade endpoint. And if some system would follow the 302, do a POST there it could start the upgrade from there. Now this is just my theory, I've no evidence to prove it. But it's a fact that other clients can communicate with the server using the webadaptor at a stage where the upgrade has not completed yet.

So, revert snapshot, uninstall webadaptor, upgrade arcgis server, configure license, run browser post upgrade and everything completes without error message

If* I'm moving forward with production, I'm definitely going to deinstall the webadaptors first before any Powershell DSC or manual install is going to happen.

*My services in a shared SOC are crashing every minute and I don't know why, most of them where published using the 2.9 runtime and I'm currently republishing them using the 3.3 runtime. It's about 500 services and everything has been automated using GIT and devops pipelines, so I just have to wait it out before I can see whether it makes the shared soc processes stable or not.

*For unknown reasons, my NEW homepage setup on portal gets reset to a default homepage. I have to rebuild the whole thing, but it's just a matter of copying all configuration back from production. Still makes me doubt whether there are some other unseen isues as well

DavidColey

Yes I agree. I think for my 11.3 to 11.4 upgrade this weekend that it is safer (for on-premises, multi-machine deployments on Windows Server 2022 VMs) to go ahead and uninstall the web adaptor prior to upgrade and make sure through the admin pages that the web adaptors are unregistered.

Because I am now deactivating AV scanning during upgrade and post upgrade, I just don't want to have the WAs in place at all, so that (as @JoëlHempenius3 says) any calls to ..../myalias.myorg.net/portal/... should go unresolved or otherwise not found.

The post upgrade steps don't use the web adaptor anyway, and I still can't find any help documentation on why this change was made in the first place.

@Scott_Tansley

AndyMinor2

Thanks to you all for posting all this. I am working on upgrading from 11.1 to 11.3 and am having issues. I can't get Portal out of Read Only mode. I get the following error.

Error
com.esri.arcgis.portal.admin.core.PortalException: Failed to update Portal mode. The server at 'https://gis.rialtoca.gov/server/admin/mode' returned an error. Could not decrypt token. Token may not be valid.

Code: 500

Scott_Tansley

Ouch. Did you put the portal into read-only before the upgrade? It's something you do after declaring an outage, but just before you upgrade you should put it into normal mode, because it needs to 'write' during the upgrade?

Or has it gone into read-only after starting the upgrade, that was in the normal mode???

AndyMinor2

I put it in read only mode before since we have 3rd party apps that write to GIS layers and I didn't want to have any issues with data being written during the upgrade.

Scott_Tansley

Please refer to this link:

https://enterprise.arcgis.com/en/portal/latest/install/windows/upgrade-portal-for-arcgis.htm#:~:text=If%20your%20portal%20is%20currently%20in%20read%2Donly%20mode%2C%20turn%20the%20mode%20off%20before%20running%20the%20upgrade.

The way I would approach it is to turn read-only on, while I do my checks and due-diligence. To stop third-party integrations, I'd 'stop' the web server in front of portal. Disable read-only mode, and then upgrade. As far as I'm aware you cannot recover from being in read-only at the point that you start the install.

You could reach out to Esri for support. But if it was me, then I'd be rolling back the VM snapshots to get back to a safe point and then take the approach I've outlined above.

AndyMinor2

I put it in read only mode so we didn't have any data being edited during the update. We have 3rd party apps that write to GIS layers.

Scott_Tansley

I hear you.

One article that talks about read-only tells you to do it, but then another (upgrade steps) article tells you to turn it off. The devil is in the detail. 😞

I've been caught by it in the past, and I rolled back the VM's and brough my client back to a safe place. We planned an alternate upgrade window and went again.

It's actually not a minor upgrade, even though the number suggest that. It's a big deal to do it and there can be quite a few gotcha's.

I'm sorry you've been burnt.

AndyMinor2

Thanks. Do you think I can get away with just rolling back the Portal VM and rerunning the Portal upgrade or will I need to roll all the VMs back to start over?

Scott_Tansley

Sorry. Time difference doesn’t help. Given it’s in read only mode then yes, you should be okay.

Doe mee aan het gesprek

Aangemelde leden kunnen berichten plaatsen, updates volgen en meer. Nieuw hier? Registreer een gratis account.

Snelle Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.