Techspert Talks

[Troy_Raney]

This session will cover:

• How to Back-Up and Restore
• Managing Certificates
• Potential Pitfalls
• Automation Options

Chapters:

00:00 – Intro

 00:28 – Agenda

 07:56 - Backup Certificates from QMC

10:23 - Backup Certificates from MMC

14:16 - Backup Qlik Sense Repository

18:17 - Backup Qlik folder

21:05 - Windows Security Policy

 22:10 - Restore Certificates

 26:02 - Drop blank Qlik Sense Repository

 28:10 - Restore Qlik Sense Repository

 30:35 - Start Qlik Sense Services

 31:47 - Bootstrap command

36:16 – Automation

 36:36 - Qlik Sense Admin Playbook

 37:06 - Q & A

Resources:

Help.Qlik.Com Documentation: Backup and Restore Qlik Sense Enterprise on Windows
Qlik Sense Upgrade Guide
Qlik Admin Playbook

For more information:

Migrate Qlik Sense Enterprise Like a Boss - Article

Video Transcript:

hi everyone my name is Mario Petre. I'm a
senior technical support engineer with

Qlik support
I work out of the lund office and been

with the company for the last five plus
years

i hope to share with you some tips and
tricks on migrating your

Qlik Sense site to a new environment today
all right the agenda for

today will be reviewing the backup
and restore procedures as well

as thinking about some planning and
transferring files ahead

how to manage your certificates how to
transfer them correctly from site to

site
depending on which server you are

planning to migrate
we'll discuss any pitfalls during this

process and some tips and tricks
and some steps for automating now mario

my understanding is basically when
everything goes right it's just backup

and restore that's pretty much how
things

should go when everything's smooth where
can we find all those

specific steps though well you're
absolutely right troy

we have a step-by-step detailed guide on
backing up and restoring a site as well

as transferring the content over to a
new site

on our online help page okay so
i see we're here on the help.qlik.com

under Qlik Sense for administrators and
we've got the most recent version

September 2020.
yeah this page contains step-by-step

procedures on how to backup your
certificates

what other considerations in terms of
data transfer you need to pay attention

to such as
moving your app content and all the

procedures necessary to restoring that
site these instructions can be used

either for the purpose of
migration like we'll be doing today or

as
a periodic backup procedure yes backups

are wonderful because things don't
always work as

they're supposed to real quick what is
the scope of what we're talking about

today
we'll be walking you through the process

of migrating the central node of a
fairly simple environment we have a

central node
we have a service cluster and we also

have a rim node
added to the environment we'll be doing

this in virtual machines in this
particular process it's a vm to vm

transfer the same process would apply
if you're moving for example from

virtual to physical or vice versa or
actually

migrating into a cloud provider and why
would somebody

want to migrate in the first place
there's a few things that can drive that

decision
environment scaling i i would say is the

primary one
okay why don't we take a look at the

environment we're going to be migrating
from

what i have here shared with you is the
central node of the current environment

let's go ahead and take a quick look at
the qmc and what version of

qlik senses is this is our latest
version Qlik Sense September 2020.

we are running on windows server 2016 on
all machines

as you can see this machine has gone
through a number of migrations and

different
versions of the monitoring apps but we

also have some sample
applications here there is a data

connection currently to a postgresql
server we also have a rim node available

a few custom security rules to give
access to a stream

and this is how the hub currently looks
like

so we'll be shooting for like for like
transfer of content and metadata

on a new server called send server 2
while the old central node

will be quote unquote decommissioned it
will no longer

be available okay mario so how should
one

get started before you actually
run through the process there's quite a

bit of planning that i like to do before
tackling one of these operations

first of all i want to know exactly
what's in the current environment

and where things are set up and the qmc
can tell you pretty much everything you

need to know
about that windows itself can tell you

everything you need to know about the
accounts and uh

the security for these we'll get started
on the online help that's where i start

as well
especially for the backing up and then

restoring the database
we don't expect you to remember this by

hard i highly recommend that you
familiarize yourself with the steps

involved
and make sure that you have a simple

checklist in place for both the original
server as well as the destination

just to make sure that you run through
these steps in a in an organized fashion

so i have some questions mario we're
going to be migrating and correct me

from around all of our apps
all of our tasks all of our rules that

are set up in the qmc
will the domain be the same between the

two environments
in this particular instance yes in the

case of the same domain
the process ends up being a lot simpler

your users will remain intact
however if the domain changes there are

some considerations
for example if your user ids will remain

intact on the new domain
let's say you have the exact same user

john doe exists with the exact same
john.doe user id in the new domain but

only that the main part changes
there are ways that we can approach this

you can contact
professional services for example they

can help you with the query for your
back-end system to

update all of these records in bulk and
re-sync the accounts to the

to the new domain if they already exist
in active directory

it should be as simple as rerunning your
user directory sync task

once you have modified it with a new
domain controller address

so that it remaps these users in the
background is that sync task

automatic the user directory syntax
should exist

if you are switching domains my
recommendation will be to set up a brand

new user directory
sync task and configure it with the new

domain will the
account running the services change that

will remain the same however if you need
to change it

we need to make sure that the new
service account has full control file

permissions on the service cluster
the account has permission to log in as

a service on the new server
under local policy and user rights

management
and the same account also has to be a

member of the qlik sense service users
group

on the new server optionally you also
need to add it to your local

administrators group but of course
you can run the services without local

admin rights
if you need to upgrade your qlik sense

server software say from version 3.2
to a more modern version like september

2020
as well as upgrading the environment

which should you do first
the software or the hardware i would

tackle the software first
mainly for one reason you you have

probably run
qlik sense on this environment for quite

a while
this environment is well known to

internal i.t staff its configuration is
well known

and hopefully very well documented and
if something should go wrong

with either the upgrade or the migration
it would be easier for

for support to troubleshoot on an
existing system that has known variables

and non-configuration
than troubleshooting on a brand new

system that makes sense
okay so as a first step as reference in

the guide
the first thing we need to take a look

at and make sure that we have a good
backup of articles and certificates

in this particular example we're going
to be also moving the

central node to a new host with a new
name

that requires us to issue a set of
certificates from the qmc as well as

backing up the current central node
certificates

manually an example of this type of data
that is encrypted using your

certificates would be
connection strings one example of a

connection string that would break
without the proper transfer certificates

would be this this database is running
on a separate machine

when the engine tries to access those
those connection details

it will also use certain certificates to
read that data back

and it may not be able to so you said we
need to export

the certificates from here manually yeah
so um as the host name changes for the

central node
we will need to issue certificates from

the qmc as well as back them up manually
um that is because of course the the

hostname itself changes if
if it if the entire machine including

the host name would be migrated to a to
a new

physical platform let's say but the host
name is kept you only need to back

up the certificates manually because the
issuing authority as we will see in a

moment
won't change it will still reference the

the central node the central node always
generates and signs

all certificates in a Qlik site and the
number one consideration here is that

you
have to reference the fully qualified

domain name of the new
machine and our target machine will be

sent server too so let's go ahead and do
that

and these these certificates of course
are not uh the ones used for proxy

communication so the
these are not the certificates that you

present to your users via the browser
but rather the certificates that qlik

sense enterprise uses to communicate
within its own services a certificate

password is recommended
although not mandatory we will go ahead

and leave this blank for now
however pay extreme caution to this

option
during a site migration it's mandatory

to include the secret key
in the trusted root certificate

otherwise
the certificate chain will be broken

and the new system will not be able to
validate its own certificates properly

now there's a couple format options
there do we need to export them in both

formats or just
which one is more important only windows

format is is required and in fact is the
recommended format this pm format is a

linux compatible format
for example if you if you want tls

security between your central node and a
postgres database like i have set up

you can use those to protect that
traffic as well and i see there's a path

there
telling us where we're going to export

them to yep and this path by the way is
local to the central node so let's

assume i'm
browsing to this address from a client

computer of course
this path will not be present on the

client computer we'll have to remote in
just like we are now into the server and

grab it from there
i've copied the the path we've exported

certificates
let's go take a look at what was

generated you can see this uh
there is a new folder here matching what

we've introduced in the machine name
for the certificate export and it

contains three certificates the server
the root and the client all three

must be transferred over to the new
machine so what i typically like to do

is copy them to a different location
i have a shared folder here set up for

this exercise
so we'll paste them in here and leave

them as that
now the next step would be to back to

bump manually
and here's a way that you can run

microsoft management console as
a different user in this particular case

domain
backslash qv service so you can navigate

to
see windows system32 find your mmc

executable
shift right click to run as a different

user

so we'll add two different snap-ins one
for the current user account

and since we logged in with account that
runs the Qlik Sense services that will

give us access to the right
certificate store the other one is the

computer account and this is where your
trusted certificate will be present so

let's start with a local account first
and these are your machines trusted root

certificates your list
may be uh much longer depending on what

other trusted
certification authorities your company

trusts but the certificate that is
auto generated by Qlik Sense will

typically have the
fully qualified domain name of the

machine it was generated on
and dash ca format we'll go ahead and

export we absolutely must
export the private key as well otherwise

this certificate will not be
useful to us on the new machine we also

should export all extended properties to
make sure that all current properties

in the certificate are transferred over
to the new machine

we'll go ahead and set up passwords so
that it lets us export

is this going to export in the same
format as the manual

export yes uh by default when you're
exporting things from

windows own certificate store they will
always be in

uh pfx format or windows format as
detailed in the qmc

and mario what's like the real purpose
for

exporting manually and through the mmc
um the original certificates

that we are backing up right now are
essentially

a worst case scenario recovery tool the
new certificates that we've issued

through the qmc will be used on the new
server

again always export the private key
always export extended properties

and your Qlik client certificate as
well

same procedure always exporting the
private key

always exporting extended properties and
is this a password that you're kind of

making up now or is it a pre-existing
password

it's not an existing password it's just
a password that windows uses to

sort of encrypt the certificate and it
is required when you re-import it okay

okay so now with our certificates backed
up

it is time to take a note of the service
cluster

location this one we can close already
so let's go back to our qmc

your service cluster is defined here
so if this path changes at all

before starting up the services on the
new machine we'll have to make sure that

we've
verified these settings and have updated

the paths
using a small configuration tool that

i'll i'll show you a little later
but for the purposes of this migration

the new machine has access to that share
yes and that is of course part of your

planning as well you should
always test access to all shared

resources
between these machines so we've got our

service cluster we've got our
certificates backed up

now which step actually makes the back
of everything in the qmc here

all right so for that we'll need to
actually back up the repository database

that is running in the background that
is based on postgres and

the details on how to do that are
available on the help site

here we can see the step-by-step
instructions

and we start by stopping the qlik sense
services

except the klisense repository database
as we will access this to

take that backup

you will need to open a command prompt
with administrative privileges

so copy and paste your command line
from the help site however pay close

attention to
the destination path for your backup

hours will be slightly different
and we can talk a little bit about what

we are typing here so pg dump is
a built-in command from your postgres

utilities
that is available uh with any

installation of qlik sense enterprise
we're defining the local

host as the target host if
you happen to be running on a dedicated

postgres
host this would have to change your port

your main user that will be using to
connect with this is the user that we

defined the super user password for
during setup and that will be the

password that is required and some
options for taking the backup we're

using a binary file
we are specifying that the file should

be a tarball
as we can see the dot tar extension

and the last bit of information here is
the database that we wish to

backup so this is not optional we need
to specify qsr as th this is how the

database
is defined internal

and before we do all that we'll need to
make sure that our services are stopped

so again we'll be relying on everything
but

the repository database to be stopped a
quick way to do that is to stop the

repository service which will
in turn stop every other service that is

dependent upon it
with the exception of the service

dispatcher which we'll have to stop
manually your logging database

is unaffected by this process of great
so everything's stopped

so now we run the command and that
creates the backup of our repository

right
that's right troy a small tip i have for

you
when running the backup command it's

always a good idea to use the
dash v for verbose flag this will have a

more complete output on your screen
about what's going on

and if something should go wrong we'll
be able to catch that before we actually

start the services and correct the
problem

that's a great tip it should be the
first argument

it's asking for our password this is
again the super user password that

you've defined during installation

and that's it our backup should be ready
and here we can see

the backup file is present and ready to
go

so we have our certificates we have
along with all the apps and app objects

users user attributes your data
connections

your tasks however please keep in mind
that there are special considerations

for changing domains changing the host
name

and moving your service cluster to a new
path but basically

this will put everything back the way it
was same apps

same list of users same active directory
same tasks

it will just rebuild it in a new
environment with the same database

that's correct mario what happens if we
missed one of those steps like with a

certificate
forgot to include the private key or

something like that
so let's say the private key is missing

most likely
the repository service will not be able

to start fully and if it is able to
start it won't be able to decrypt all

the data in the database
i mean it's just a checkbox so it feels

like a human error is pretty
possible there would it actually tell

you that you forgot to include the
private key

yes there is a log file in the following
location so we'll have to

go to your log folder under program data
we'll search for the repository

trace and the security repository log
file will contain information

about your secrets and your cryptokey
access okay

let's say your Qlik client certificate
was not exported with its private key

the ultimate effect is that all your
data connection passwords

won't be decryptable anymore so let's
say you have 15

data connections that use passworded
connection string

you will have 30 error messages in the
in this particular log

is there anything left back up or do we
move on to the importing process of the

new
system there is one more item that i

recommend backing up always and that
does require stopping

all services including the repository
database and that is the contents of a

program data folder
and contains a raw copy of your database

and it also includes your local logs
and a couple of other items like your

host config it's
good to have in case something goes

wrong and the original system is no
longer available and must be rebuilt

this is one of the items that you'll use
to uh to rebuild the system

and that's just a straight up copy of
the entire Qlikfolder yeah

one more item please consider your
custom connector packages

either from Qlik or a third-party
provider

if you use odbc you will need to
recreate these connections on the new

server
preferably with the same names so that

you do not have to then
go in and edit any of your clip scripts

um or modify your existing data
connections in the new environment

but aside from that we now have a full
site backup

and we're ready to bring this content
over to the new machine

where qlik sense september 2020 release
is already installed we have decided to

create a new cluster with its own
database so there is a

postgres instance on that machine as
well so that we can import the data

after
so as you can see here we have all

services installed and running under the
same

service account as uh send server one
so what we're looking at right now is

just out of a box
install everything's default pretty much

fresh and ready to go
this is the first time i'm logging in

it's ready to be licensed there is
nothing going on here

first things first we will start on the
destination machine by importing

those certificates i recommend that we
start this process by stopping all

services do we leave the database
running

yes we'll we'll take everything down
just to make sure that no ports in use

nothing that can uh prevent us from
from doing what we need to do here so

here i'm accessing the uh
the shared location where we've backed

up all of our content
let's go ahead and import these

certificates first
find your mmc executable

now of course when you set up a new
environment

or a new server to receive data from an
old server you will have

certificates we'll need to get rid of
those

as we are importing certificates from an
existing environment and we don't want

there to be any clashes
inside a certificate store or any

duplicate values that may confuse the
services when starting up

that makes sense you want one set of
certificates nothing that might conflict

when you're importing certificates are
there any windows security rules that

might cause problems when you're
importing

absolutely good great point i'm glad you
you brought that up

new security policies have kicked into
place that may prevent services from

starting up completely i'll show exactly
what i'm talking about

there is a local security policy under
security options

the policy that we need to look for is
under the

system cryptography setting
and it's this one system cryptography

for strong key protection for user
user keys stored on the computer if this

policy is
set up to any of these two last options

here on the menu
you will be first prompted to assign a

new password that has nothing to do with
the password that you've used to encrypt

the certificates when backing up
windows will require you to enter every

time you access
this should be set to that first option

or not set at all they were saying
not set at all just to make sure that

you can at least import the certificate
and mind you

that option has to be disabled only
during the short period of time it takes

you to import the certificates
you can enable it on the server again

after the certificates were imported
because that policy governs only new

certificates it is not retroactive
that's another great tip okay back to

importing
so uh let's start by importing the

trusted
certificate under the local computer

account uh
and as i mentioned before since this

setup
was started albeit in a blank state

the certificates have been generated for
the current

empty install so we'll need to get rid
of these to make sure that there are no

duplicates
no backup necessary i'm just going to go

ahead and delete these
now this new certificate that we didn't

see on the origin machine Qlik
service cluster certificate this is only

useful to multi-cloud
deployment sites where you are

distributing applications to
Qlik cloud services it is not the case

here so i'm i'm ignoring that
certificate as well

the other certificate that we need to
get rid of is Qlik client

that's all gone we'll go ahead and
import them in the right order

right click here all tasks and import
the correct store will already be

pre-selected and cannot be changed
and we'll go ahead and navigate to

our backup location as this is a
complete swap of a central node to a new

hostname we'll import the certificates
that were manually exported

from the original machine this is the
correct certificate store

we'll go ahead and finish
then we'll go ahead and import the

server certificate into the personal
store

mark the key as exportable so that you
can then

take another backup that includes all
properties

and since we did not define a password
during the export from the qmc

we won't have to specify one here

and the last one is going to be our
Qlik client certificate

if you don't see the certificate that
you're looking for

just drop down and select all files and
select your client search

but here is another option that users
must pay

extreme caution to this first option
directly relates to that local security

policy that we saw about uh strongly
protecting

local client keys please do not check
this as this will then

prompt for a password every time the
certificate is being accessed

and of course we want to make sure that
the private key is exportable and we

include all the extended properties
and we'll leave it in the personal store

and that's it okay so all the
certificates are

imported what's next yep certificates
are in place

what's next database operations first
drop the current

empty database you can drop it via pg
admin if you have this installed or

available
via a different service or you can do it

via the command line the
steps for the command line are detailed

in the help
uh however the steps for pg admin are

not but of course it's a
it's a more visually appealing tool and

easier to use so let's
go ahead and take a look at that let's

set up a new connection
our current server is 100 15.

the standard port where the postgres
repository is running

is port 4432 the username
and the password will be the one defined

during setup

there we go there we go as you can see
you have several databases in this

database engine
so this is a an easy step as you can see

we'll we'll have our schema and our
tables

this is where qlik sense stores all of
your data or you can use pg admin to

manage
your database to take backups and

restore we'll have to drop the table
of course you can do that by delete drop

alternatively we can use the
instructions from the help site

we'll go ahead and copy this content as
we've copied it from the help site

and drop it in here again we are
connecting

uh locally to this current database host
with the port and this username and we

are trying to drop the qsr
database no other tasks running in

parallel for example a backup task
running on an automated script when you

are trying to do this
just right click and disconnect the

database
so let's go ahead and do that now

prevented the
super user password and there we go

so now going back to pg admin i'll just
go ahead and refresh

and you can see qsr is gone we'll use
the createdb command

again connecting locally to the same
port with the same username

we'll use the template 0 to give us a
basic schema

backend however there will be no tables
recreated based on this or anything else

all of that is taken care of by the
repository service during the initial

startup so it seeds the database if it's
empty

simple as copy and paste right click to
paste here

is there a way to add the -v to
add some verboseness to that to actually

see what happens as well
yes i do recommend just as we used

-v
for verbose flag during the backup we

will use the same
during the restore so that we get an

actual feed of
all the tasks that are that are being

run in the background
so let's go ahead and create this

database
apparently i cannot type my password

right now

and there we go so just to illustrate
we'll go ahead and refresh this again

and here we have a qsr database
with a public schema with no tables

so how do we get this data back of
course you can still use

pg admin to restore your existing file
you would use the restore function and

navigate to your tarball
and click restore watch for the progress

we'll go ahead and use the manual method
which is defined in our online help you

can see here i've added a variable path
to backup file

i'll copy everything up to that point
and then we'll go ahead and copy the

path
of the tarball manually so we'll paste

that in here
we have our qsr backup again this is

currently sitting on a shared drive
we'll go ahead and bring this locally

i've created a folder here beforehand
called qsr backup

and a quick way to grabbing paths from
from existing files is again to shift

right click
and there is this wonderful option here

copy as path that already includes
double quotes

so that if this sits in a folder
structure with spaces in it

it would work just by copying it and
pasting it here as we can see

it is recommended that you add dash v
for verbose output

to this command as well this is where we
will spot any any problems during the

import procedure
before that let's go ahead and make sure

that we're disconnected from the
database so that we can use it

and we are ready to hit enter yeah i
love that verbose tip

it's so satisfying seeing streams of
text scroll across

command prompt indeed you you very
seldom do something in the in the

command prompt that doesn't offer an
immediate output yeah

there we go

creating indexes constraints uh adding
foreign key constraints adding the data

um if there were any problems here at
the very end of this uh

message we would see that the project
process something like process finished

successfully with so and so many
warnings

we've restored so now we can verify that
the uh the data is actually there

let's refresh go into our qsr database
and look at the tables

whereas previously just after recreating
the database from template

there were no tables now we have all all
the content

so now we have our certificates imported
we have all the repository metadata

present on the new system and our rim
node is still active and talking

so we'll try to stand up the services
on the new central node will make sure

first that the old central node is
it fully stopped that's back on send

server one
yep that back on send server one will

make sure that everything is stopped
and it is repository database first

service dispatcher second
and the repository service a closed

third and we'll be monitoring
the activity on the server on on that

server specifically
just to make sure that everything is uh

coming up
as expected so we'll navigate to our

log folder into repository and trace
and you can see here there's a bunch of

new log files these are
automatically rolled over upon service

restart and
after reaching a certain point during

the startup phase they will be
automatically moved over to your

archived logs folder location
if everything goes fine you will

eventually see these
files magically disappear i am

comfortable to start
bringing up other services such as the

engine proxy your printing your
scheduler

if you see this in your logs there is
typically one

root cause the repository service at
this point

since we have aha on purpose missed the
step

won't get past this point the internal
host name for the central node inside

the qlik sense repository does not match
your machine name nor the machine name

for which the certificates were reissued
samaya i'm a little confused which step

did we miss
uh we missed the all important bootstrap

step this is a command that you need to
run

on the new central node that will
automatically update

the hostname values for the new central
node in

inside the database and also recreate
any certificates

that are that are necessary based on the
trusted root certificate available on

the machine
so let's go ahead and run through this

process now we'll have to put it in
bootstrap mode run it in standalone so

that it runs
through this special mode and then

restore hostname is the special command
that we need to use to make sure that

the internal values are updated

of course need to make sure that the
repository service is stopped and every

other service is stopped on the machine
other than the repository database

the service dispatcher does not cross in
my fingers

so this will recreate any certificates
that are missing

and also bind them to the appropriate
services

and once it enters main startup phase it
will exit out again

and at that point we should be
comfortable that

the database has been one fully restored
into

uh properly configured to operate on
this new

machine so once again and this time for
good

let's uh start things up
and we'll once more monitor the

startup procedure to make sure that
everything is running smoothly

and real quick again what is the order
for starting up the services

service dispatcher first repository
database

repository service let that run for a
few seconds make sure that things are

starting up
correctly by looking at the file and

then
everything else of course the logging uh

the login service database
i have to start that before anything

else as well
and as this one is independent from all

other services
but the my preferred order afterwards

after repository service is fully
running

is to go engine proxy scheduler printing

here we go nice and clean folder here
means all of our previously generated

log files were successfully archived
that means our service cluster is fully

accessible by the new system
we have the right permissions set up for

the
service user so are we at that glorious

point where we get to check the hub

yes sir yes we are let's log into the
qmc first

and we have a platform let's check the
node status

again these are still talking to each
other

still five by five on the rim node
it looks just like it did so the final

test
dealing with existing data connections

that have credentials associated with
them

one quick test uh is to just run one of
those reload tasks and

see if we can get the app again so for
that let's just go to the hub

are authenticated we can see our
applications

let's go look at our postgres sql data
test

now this is an app just to sort of test
that data connection you've set up

that's correct that's correct it's
currently set up to reload once a day

but we can trigger this manually real
quick just to make sure that the

timestamp is updated let's go ahead and
reload that task

and make sure it's still running

it already finished

latest data reload 1235.
so everything seems to be working so far

there are
a number of other considerations that we

didn't touch on today
the bulk of the time taken here is prep

work and then
actually backing up your content

we recommend a maintenance window for
any such procedure

are there any resources available to
make this process easier

here's some documentation on how to set
up qlik sense from scratch

using the silent install method that's
for setting up

in terms of automating the backing up
and restoring of the environment

a simple powershell script that triggers
the pg

backup and the p2 restore command on the
target server

would be enough here's a great place to
start

for what happens next this will set you
up with great activities to run on a

daily weekly monthly quarterly and
yearly basis

but i highly encourage you all sense
admins to start here and familiarize

yourself with this content
and with that that was it for me thank

you all very much for joining us today
troy

now it's time for q a go ahead and place
your questions anything

questions you might have in the q a
panel on the left side of your own 24

console
mario which question would you like to

address first well troy there's a
a very interesting question here about

update sequence um somebody is asking
when upgrading a multi-node Qlik sense

environment can you go straight to the
latest update or is it best practice to

install updates sequentially
i'm not sure if everyone is aware about

this but
all of our updates are cumulative so

if you jump between two major feature
releases let's say between

april and september you will also get
all the content that was delivered

in the june release which was skipped so
there is no need to do

sequential updates um however be careful
uh with how big a jump you're making

between between versions
um for the very very old versions there

are some special considerations however
when

moving between modern versions post
feature releases in in 2018

you can just jump over to the to the
latest

i would suggest that the bigger jump you
make

the more testing and validation you
should do to make sure that everything

in the system works fine including
applications under objects as we

um we have made quite a few changes in
recent releases

and added new content uh but other than
that

yep you can you can jump straight to the
uh to the latest

the same applies for patches by the way
so uh you can go from patch one to patch

five
knowing that everything on two three and

four is also included
okay next one all right uh

let's see what uh special considerations
are there if we're migrating from a

physical server to an aws environment um
well pretty much all the networking

considerations they have in a windows
environment

uh physical on-prem except you will have
to deal with aws's

networking services network load
balancer etc and make sure that

the access route that users are going to
take to reach your system

is fully open and configured to accept
connections for qlik sense

um if uh if there are any doubts about
how to how to achieve this or something

isn't working as expected feel free to
contact Qlik support we'd love to take

a look and
help you out all right let's see

a bunch of really interesting questions
here um yeah someone

is mentioning that there's a new
certificate that showed up during the

presentation um that we haven't seen
before

this is called Qlik Sense Qlik service
cluster sorry

and it's a brand new certificate
introduced in the september 2020 release

and this is used
for um multi-cloud environments

that have a windows on-prem installation
and want to distribute apps

to a kubernetes install
or to our own Qlik cloud services um

and just as uh the rest of these
certificates this one also has to be

backed up
during a migration process or during

your normal backup procedures
um and will have to be restored as well

in the case of a migration
the help Qlik help site has been

updated to reflect this step as well
so if you follow those procedures you'll

be fully covered on certificate backup
and restore

and another short question what about
using block storage

um if you're referring to the service
cluster

using block storage there is not advised
as we'll

will need ntfs file policies
to be to be enforced which means the

file share hosting your service cluster
should be hosted by a windows box

just acting as a file server so that you
can always keep

permissions under control and it's
easier to troubleshoot

we also support certain type of nas
configurations

provided that the permission layer of
ntfs or

smb protocol is the very latest one used
and there are no restrictions to file

access
the reason why this is a new change is

that
in the old days uh smaller capacity

nas boxes for example would have
restrictions such as file listing

um so this is something to keep in mind
but for block storage specifically

um we don't currently support this as
far as i'm aware

because it does not support the ntfs
permission layer and

our product relies on it to to control
access to files

however i do recommend that in
cloud providers in your virtual cloud

provider
you try to deploy um instances with

flash storage
wherever um file hosting is

uh is going to be placed and and that is
especially important for the server that

hosts your service cluster
flashback storage is going to be faster

than
than hard drives and it will help

performance as well as
access times to smaller apps

um and someone is asking if uh the
process that we've walked through today

is the same
as for migrating QlikView server

and the
short answer is no um these two

procedures are of course very very
different

because the products are very very
different if you want to know more about

how to migrate QlikView server
correctly from machine to machine please

refer to our online help
and knowledge base articles that are

present on clean community
and again for any issues that may occur

during that process
contact Qlik support uh yeah there's

there's a couple here that have to do
with uh changes to apps after such

migration
uh there's one asking about apps needing

to be imported individually
of course not um in the presentation we

saw
a migration process that did not involve

moving the service cluster over to a new
location however the service cluster

hosts
all of your apps and and other app

metadata
that is not present in the database so

by directing your new environment to an
existing file share that hosts the

service cluster or by moving those files
across

you are essentially moving all of your
apps over so you won't have to import

them into the qmc one by one
and the other question is for the

operations monitor
and other monitoring apps available in

the system can they be configured to
read

from the previous environment logs as
well as the new ones and the answer

is yes of course all you have to do is
go into your um

into your system enable a security rule
so that one of your root admins or one

of your administrators can see
all of the uh back end rest connections

um
and the uh the folder connections and

just create one for the uh
for the new location however the old

logs um the old logs will also be
present in your qvds

as they get reloaded on the old system
qvds would have been generated so if you

move those
across to a location where the current

monitoring apps can can access them that
data will still be present so

you're not going to have a clean split
between

between data in these monitoring apps
unless you get rid of the old qvds or

never import them
let's say and just reload on the new

environment from scratch
that would then only show you the the

new environment data
okay mario we have time for one last

question
all right so um somebody's asking here

about upgrading from a
old version of Qlik Sense say 3.2 to the

latest which would be
september 2020 as well as upgrading

their hardware at the same time
this this type of migration

uh i would raise quite a lot of caution
here this is a huge jump and many

back-end modifications have happened in
the product since uh qlik sense 3.2 or

the numbered versions
um there are very detailed articles on

on Qlik support and Qlik community on
how to do this correctly it involves

jumping to a intermediary version
somewhere slightly more modern than

Qlik sense 3.2
but not quite as recent as one of the

2020 releases
and then from that point onward you can

jump over to any of the
the latest releases however as advised

during the presentation
i would first tackle the product upgrade

validate that everything is still
working as expected correct any issues

that you see there and then
once happy with the performance of the

existing system
at least on the new version considering

any hardware limitations
i would then start planning the

migration to new hardware
all right so that was that was it for

today thank you all very much for
joining us

and submitting your questions uh this
has been a blast and looking forward to

the next one
okay great thank you everyone we hope

you enjoyed this session
and thank you to Mario for presenting we

appreciate getting experts like Mario to
share with us

here's our legal disclaimer and thank
you once again

have a great rest of your day