Latest Contributions by JonathanQuinn

There are no current plans to support more than 1 standby portal. ... View more

Those instructions are for any version of Portal, and will be the instructions on any future versions as well. We'll update that doc. ... View more

Just for clarification, portal HA is active-active; each machine in a highly available portal configuration can respond to requests. Internally, there is a primary database which runs on one of the machines. If any request comes in to standby that requires data from the database, it will get that data from the primary database. Portal does not support a "siloed" architecture, like Server does, where you can have two distinct sites that are behind a load balancer. Portal HA can't function if the machines are split between two data centers for geographic redundancy. If you wanted to support geographic redundancy, you need to set up the two environments separately and use the WebGIS DR tool to replicate content from one site to the other. Portal can support a SplitDNS approach if you/your IT staff knows what they're doing. External users access an externally accessible endpoint, while internal users reach a different endpoint secured with Windows Authentication. In both cases, the URL has to be the same. Another approach to achieve that is use SAML, and all end users access the deployment through the same endpoint. ... View more

I'm surprised that you are able to sign into Portaladmin if the logs are indicating the index service and database are not available. Those errors would indicate that tokens couldn't be generated, which are necessary for accessing Portaladmin. I'd continue working with Support, given the multiple issues being presented in the logs. ... View more

Are you using a wildcard certificate from your own domain certifying authority? If the certificate is self signed and the FQDN of the URL using the certificate matches the CN, there's no problem. If the certificate is a wildcard certificate signed by a certificate authority that is not trusted by Portal or Server, then the request will fail. If the certificate CN does not match the FQDN of the URL and it's not a wildcard, the requests will fail. Try to import the root certificate into Server and see if that helps. Configure ArcGIS Server with a new CA-signed certificate—ArcGIS Server Administration (Windows) | Documentation for ArcG…  You can also import it into Server using the importRootOrIntermediate API. Import Root Certificate  ... View more

Can you post the full command line arguments for the process? Is it the javaw.exe process? Does it immediately or gradually climb to 20 GB? ... View more

Can you redirect the console output to a file within whatever script you're using to run the backup? I'm wondering if the backup for the Data Store is not completing, but the error isn't logged in the logs. If any component fails, then the backup won't be completed. You can also enable more logging from the DR tool in the logback.xml file, so you can see what the HTTP requests look like. That'll show you the job status response from the Data Store so you can validate whether it's created correctly. ... View more

Seems like a networking problem. Can you reach 'https://gis.xxxx.com/arcserver/admin/data/trustedServers' from the GeoAnalytics machine? Connection timed out would imply a firewall or similar problem that prevents the GeoAnalytics machine from reaching that URL. If you can reach that URL from the GeoAnalytics machine, then I agree, Support is the next step. ... View more

As long as you're using the same corresponding functions between Python 2.x and Python 3.x, you shouldn't see an issue. The version shouldn't impact whether a token is valid or not, unless the logic is different (if you're using different scripts), and you're not passing in the right referers or something similar. What is the error you're seeing? ... View more

That error means the account running the Data Store service can't reach that location. What account is used to run the Data Store service, a local or domain account? When you checked that each machine can reach the location, what account did you use, your own or the one that is running the Data Store service? ... View more

Once the Data Store is registered to Server, Server does not use the owning system URL to retrieve data. It uses a regular TCP connection, like a connection to any other enterprise geodatabase or database would use. Are you finding that stopping one of the machines causes a problem? What problem are you seeing? Theoretically, if the Data Store was dependent on the URL, then the only time you'd see an issue was if OSI5666 was stopped, because that's the FQDN listed in the URL. If you stop OSI5667, you also see a problem? ... View more

Even though the Data Store will list an "owning system URL", which may point to a single machine, or even when you register the Data Store, you enter a specific machine URL, the Data Store knows to communicate with all server machines in the site. Server also knows how to talk to all participating Data Store machines, so for the most part, you can disregard URLs in regards to Server to Data Store or Data Store to Server communication. ... View more

While the error message should be better, the example text below the parameter box indicates the structure of the URL you should enter. Remove /arcgis/services and see if that works. ... View more

I can repro this behavior; I suggest you reach out to Support to get this tested and logged. Server should only need to depend on the X-Forwarded-Host header, as documented in the help. ... View more

There are a variety of different deployment scenarios for an HA portal. The WebContextURL will always be set to 443, but the privatePortalURL can be set to either 443 or 7443, or any other port, in reality. All that matters is that it can send traffic to the backend portal machines, and check the health of those machines. Our cloudformation templates set the WebContextURL and the privatePortalURL to the same URLs. On the other hand, if you configure your environment with Windows Authentication, that would be set at the web adaptor tier. In this case, the privatePortalURL can't be set to a URL that hits the web adaptors, because it can't authentication against the 401 challenge. Deployment scenarios for a highly available ArcGIS Enterprise—Portal for ArcGIS (10.8) | Documentation for ArcGIS Ente… Ultimately, your decision to use  the same URL or different URL can come down to: 1) Security - do you need to bypass the 401 challenge at the web tier 2) Network traffic - do you mind if internal traffic between Server and Portal goes through the same endpoint as client side traffic? There is no right answer. Your requirements will dictate what your topology looks like. ... View more