Latest Contributions by JonathanQuinn

Why not just add both portal machines to the target group? Even though portal has a primary and standby concept, both machines can accept and respond to requests. There's no need for administrators to know which is primary and only send traffic to the primary. ... View more

I'd expect the error to explicitly state that something was attempted against a read-only database: org.postgresql.util.PSQLException: ERROR: cannot execute INSERT in a read-only transaction You can: Check nodes.properties for which is the primary/standby nodes and validate that against the Machines API. Check for the presence of the postgres.auto.conf file under "C:\arcgisportal\db\postgresql.auto.conf", for example, and check the contents to make sure that it knows the primary is the primary Check the config-store-connection.json file under framework\etc to make sure it lists both machine names and not localhost in the JDBC URL property Check the arcgis#sharing.xml file under "C:\Program Files\ArcGIS\Portal\framework\runtime\tomcat\conf\Catalina\localhost" and make sure it also lists both machines and not localhost in the JDBC URL property ... View more

It is possible to set up an HA deployment without a load balancer. The Web Adaptor acts as a load balancer; actively checking the health of the machines in the site its registered to, using simple a round-robin method to send requests to backend machines, and only sending requests to healthy machines. However, its a single point of failure which is generally why we suggest a load balancer in front of two web adaptors. The Web Adaptor is really only necessary if you're using Integrated Windows Authentication, so if that's the case, you'd want to minimize single points of failure by setting up two. Whether they're behind a load balancer, or in a failover cluster where one Web Adaptor instance is active and the other standby in the event the active one goes down, is up to the organization and the resources available to it. We can look into updating the documentation related to Windows Failover Cluster and similar approaches in place of a load balancer. ... View more

Bit of clarification; the Web Adaptor is aware of the machines in the site as it polls for them every minute. Once it knows which machines are part of the site, it uses round-robin requests to send traffic to each node; it doesn't prioritize sending traffic to the primary. In terms of the documentation, a single web adaptor, on a single IIS instance, is a single point of failure, which is why that pattern is not described in the high availability documentation. Load balancers are typically fault tolerant, and if you want IWA, you'd put two web adaptors behind the load balancer. ... View more

So the user running the DR tool is not the same as the service account running ArcGIS Server? The DR tool creates a parent directory, and then asks the components to create their backups under the parent directory. Then, the DR tool packages the backup into the webgissite file. I'd set up ProcMon to monitor file traffic, filtering for the E:\TempBackups directory, and you'll probably find an Access Denied error somewhere in the requests, indicating something either can't write, or can't read, from a directory. ... View more

Connection refused would indicate that the the index service is not running. Have you verified whether you see a java.exe process running on the machine? If not, the logs under <install directory>\framework\runtime\ds\usr\logs may help identify why it can't start. You can post some logs here, but these types of problems are a bit challenging to troubleshoot so it may be best to contact Support. ... View more

Yes, if you're confident you won't need your 10.8.1 data anymore, you can delete it.  ... View more

Permissions to layers and items is based on the sharing model, which can be shared with everyone, (public access), the organization, specific group(s), or not shared at all: https://enterprise.arcgis.com/en/portal/latest/use/share-items.htm As the administrator of a group, you decide who is part of the group: https://enterprise.arcgis.com/en/portal/latest/administer/windows/manage-groups.htm So sharing an item with only certain members would mean creating a group, adding those users to the group, and then sharing the item with the group. ... View more

Yes, that should work. You can either: Run the Configure Web Adaptor Utility to re-register the web adaptor without admin access, then run the backup, then again with admin access. If the web adaptor is not on the same machine as where you're running the DR tool, then you'll need to run it remotely via Powershell and the Invoke-Command function (https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.2) Use an API which allows you to update the setting from anywhere that the API is accessible from (https://server.domain.com:6443/arcgis/admin/system/webadaptors/<web adaptor id>/update) https://developers.arcgis.com/rest/enterprise-administration/server/updatewebadaptor.htm I'll keep a lookout for the bug. ... View more

Well, I say that this is a bug and needs to be addressed - because it has only shown up at this very latest release. Absolutely. Have the support analyst log a bug. They can contact me directly if they have any questions. As always, I poured through the issues addressed  https://downloads.esri.com/support/downloads/other_/110-IssuesAddressedList_07192022.pdf and all of the 'what's new' and saw nothing about this, even in the 'Disaster Recovery' section of the document. The original issue was found internally and an official bug wasn't created, which is why it wasn't added to the Issues Addressed list. ... View more

While I don't work on those apps, I'm not aware of any client requirement for administrative access to be enabled on the Web Adaptor. Can you point me to the doc that says that? Do you have a staging environment that uses similar constructs for URLs? Is your question has any ever disabled admin access on the web adaptor, or has anyone disabled admin access on a live production environment? If it's the former, then yes, it's a common practice especially in more secure environments to restrict who can reach the administrative APIs and endpoints for Server. Our security team has put together recommendations for load balancers, reverse proxies, and WAFs to disable access to administrative APIs as well. If it's the latter, then also yes; if there are workflows or operations that rely on accessing the Admin APIs or Manager through the services URL, those workflows may be impacted. ... View more

@DavidColey if https://ags3.our_org.net/agsfed is your services URL and has administrative access enabled and https://my_dns_name:6443/arcgis is your admin URL, try to disable administrative access on the web adaptor. ... View more

To sort out what to do next, it seems like your services URL is https://ags3.our_org.net/agsfed, and your admin URL is https://my_dns_name:6443/arcgis. It also seems like you have administrative access enabled on the Web Adaptor for https://ags3.our_org.net/agsfed. If this is the case, then the DR tool will use that URL for a few requests and result in the parsing error I mentioned above. If administrative access is not enabled for the Web Adaptor on https://ags3.our_org.net/agsfed , then it will solely use https://my_dns_name:6443/arcgis. The last character in https://my_dns_name:6443/arcgis is not in the list of "a","d","m","i","n", so it will not truncate the URL incorrectly. ... View more