Skip to main content
ONTAP Mediator

Upgrade ONTAP Mediator

Contributors netapp-aoife netapp-camdenc
PDFs

To upgrade ONTAP Mediator to a newer version without upgrading the host OS, download the installation package for the new version and run the installer on the host where ONTAP Mediator is already installed.

Note If you need to upgrade the host OS to a new release and reinstall or upgrade ONTAP Mediator as part of that process, see Upgrade the host OS and ONTAP Mediator instead.
Before you begin
About this task

Review the following information before upgrading ONTAP Mediator.

  • You should upgrade ONTAP Mediator to the latest version. Older versions still work with all ONTAP releases, but newer versions include security patches for third-party components.

  • When you upgrade to a new ONTAP Mediator version that includes the SCST package, the installer automatically upgrades to the recommended SCST version unless a higher version is available. For instructions on manually installing a higher SCST version, see Maintain the host OS for ONTAP Mediator. For supported versions, see the SCST support matrix.

Note

  • If the upgrade fails, you might need to try a newer version of ONTAP Mediator.

  • From June 15, 2025, you can't install or upgrade ONTAP Mediator 1.9 and 1.8 because their code signing certificates have expired. If the upgrade fails, use the ONTAP Mediator 1.9.1 patch version instead.

  • Beginning with ONTAP 9.19.1 and ONTAP Mediator 1.12, you have the option to install ONTAP Mediator with iSCSI and HTTPS support, or support for HTTPS only. If you choose to install ONTAP Mediator with support for HTTPS only, the SCST package is not installed.

  • If you upgrade from ONTAP Mediator 1.11 or earlier with SCST installed, and you choose the HTTPS only option during the upgrade, the SCST package is uninstalled and the new ONTAP Mediator version does not contain the SCST package.

  • If you plan to use ONTAP Mediator to monitor multiple MetroCluster IP configurations, the support depends on your Mediator type, ONTAP version, and OS. Refer to Use ONTAP Mediator to monitor multiple MetroCluster IP configurations for more information.

  • Installing ONTAP Mediator with support for HTTPS only is supported for the following use cases:

    • You plan to only use ONTAP Mediator to monitor your SnapMirror active sync clusters.

    • You plan to configure ONTAP Mediator with HTTPS to monitor one or more MetroCluster IP configurations.

  • ONTAP Mediator must be installed with support for iSCSI and HTTPS in the following scenario:

    • You plan to configure ONTAP Mediator with iSCSI to monitor one or more MetroCluster IP configurations.

  • When you run the installer against an existing ONTAP Mediator installation, it detects the current version and prompts you to confirm the upgrade:

    ONTAP Mediator will be upgraded from version <current-version> to <new-version>.

    Do you wish to continue? Y(es)/n(o):

  • As part of the upgrade, the installer captures a support bundle of your pre-upgrade configuration and migrates the database before upgrading the ONTAP Mediator software.

  • For automation use cases, you can use the ./ontap-mediator-1.12.1/ontap-mediator-1.12.1 -y command to skip the installer prompts.

Steps

  1. Run the installer for the new version and respond to the prompts as required:

    ./ontap-mediator-1.12.1/ontap-mediator-1.12.1
    Note

    To skip the signature check during the upgrade, use the ./ontap-mediator-1.12.1/ontap-mediator-1.12.1 --skip-code-signature-check command

    The installer detects the existing installation and prompts you to upgrade, then installs the required packages and migrates your configuration.

    Example ONTAP Mediator upgrade with HTTPS and iSCSI support (console output) 
    [root@mediator_host ~]# ontap-mediator-1.11.0/ontap-mediator-1.11.0

ONTAP Mediator: Self Extracting Installer

+ Extracting the ONTAP Mediator installation/upgrade archive
+ Performing the ONTAP Mediator run-time code signature check
   Using openssl from the path: /usr/bin/openssl configured for CApath:/etc/pki/tls
+ Unpacking the ONTAP Mediator installer
ONTAP Mediator requires two user accounts. One for the service (netapp), and one for use by ONTAP to the mediator API (mediatoradmin).
Using default account names: netapp + mediatoradmin



Enter ONTAP Mediator user account (mediatoradmin) password:

Re-Enter ONTAP Mediator user account (mediatoradmin) password:

+ Checking if SELinux is in enforcing mode


+ Checking for default Linux firewall




+ Installing required packages.


Last metadata expiration check: 0:03:56 ago on Mon 20 Apr 2026 02:49:08 PM EDT.
Package openssl-1:3.5.1-7.el9_7.x86_64 is already installed.
Package openssl-devel-1:3.5.1-7.el9_7.x86_64 is already installed.
Package kernel-devel-5.14.0-611.45.1.el9_7.x86_64 is already installed.
Package kernel-modules-core-5.14.0-611.45.1.el9_7.x86_64 is already installed.
Package gcc-11.5.0-11.el9.x86_64 is already installed.
Package make-1:4.3-8.el9.x86_64 is already installed.
Package which-2.21-30.el9_6.x86_64 is already installed.
Package libselinux-utils-3.6-3.el9.x86_64 is already installed.
Package patch-2.7.6-16.el9.x86_64 is already installed.
Package perl-Data-Dumper-2.174-462.el9.x86_64 is already installed.
Package perl-ExtUtils-MakeMaker-2:7.60-3.el9.noarch is already installed.
Package bzip2-1.0.8-10.el9_5.x86_64 is already installed.
Package efibootmgr-16-12.el9.x86_64 is already installed.
Package mokutil-2:0.7.2-1.el9.x86_64 is already installed.
Package python3-pip-21.3.1-1.el9.noarch is already installed.
Package elfutils-libelf-devel-0.193-1.el9.x86_64 is already installed.
Package policycoreutils-python-utils-3.6-3.el9.noarch is already installed.
Package python3.12-3.12.12-4.el9_7.2.x86_64 is already installed.
Package python3.12-devel-3.12.12-4.el9_7.2.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
OS package installations finished
+ Installing ONTAP Mediator. (Log: /root/ontap_mediator.uigddi/ontap-mediator-1.11.0/ontap-mediator-1.11.0/install_20260420145003.log)
    This step will take several minutes. Use the log file to view progress.
    Sudoer config verified
    ONTAP Mediator rsyslog and logging rotation enabled
+ Install successful. (Moving log to /opt/netapp/lib/ontap_mediator/log/install_20260420145003.log)

+ Note: ONTAP Mediator generated a self-signed server certificate for temporary use on
    this host. If the DNS name or IP address for the host is changed, the certificate
    will no longer be valid. The default certificates should be replaced with secure
    trusted certificates signed by a known certificate authority prior to use for production.
    For more information, see /opt/netapp/lib/ontap_mediator/README

+ Note: ONTAP Mediator uses a kernel module compiled specifically for the current
        OS. Using 'yum update' to upgrade the kernel might cause service interruption.
    For more information, see /opt/netapp/lib/ontap_mediator/README
[root@mediator_host ~]# ontap-mediator-1.12.1/ontap-mediator-1.12.1

ONTAP Mediator: Self Extracting Installer

+ Extracting the ONTAP Mediator installation/upgrade archive
+ Performing the ONTAP Mediator run-time code signature check
   Using openssl from the path: /usr/bin/openssl configured for CApath:/etc/pki/tls
+ Unpacking the ONTAP Mediator installer
+ ONTAP_MEDIATOR_INSTALL_HTTPS_ONLY is set to '0', args are: ''
+ Starting ONTAP Mediator install/update process: previous installation_mode is ''


ONTAP Mediator can be installed with iSCSI and HTTPS support, or support for HTTPS only.
Do you wish to install ONTAP Mediator with iSCSI and HTTPS support? Y(es)/n(o): yes
ONTAP Mediator will be installed with mode: ISCSI_HTTPS
+ Selected install package mode: ISCSI_HTTPS
ONTAP Mediator will be upgraded from version 1.11.0 to 1.12.1.


Do you wish to continue? Y(es)/n(o): yes
Capturing support_bundle to save pre-upgrade configuration. API Credentials are required.
    Mediator API User Name: mediatoradmin
                 Password: Running plugins, please wait...


Creating tar archive...
Support bundle has been generated at /opt/netapp/data/support_bundles/scs001097036-1_1776711598_BASIC.tgz
Testing the DB can be upgraded
Cloning database...
Cloning successful.
Verifying database is up-to-date...
Database out-of-date.Migrations are necessary:
Current revision: 0d5dcf349b27, Head revision: 758e4873c40d
Performing database migrations against clone...
Migrations successful.
Database upgrade operation complete.
+ Adding python312 specific packages
+ Upgrading ONTAP Mediator. (Log: /root/ontap_mediator.gwaGmU/ontap-mediator-1.12.1/ontap-mediator-1.12.1/upgrade_20260420145942.log)

+ Note: ONTAP Mediator generated a self-signed server certificate for temporary use on
    this host. If the DNS name or IP address for the host is changed, the certificate
    will no longer be valid. The default certificates should be replaced with secure
    trusted certificates signed by a known certificate authority prior to use for production.
    For more information, see /opt/netapp/lib/ontap_mediator/README

+ Note: ONTAP Mediator uses a kernel module compiled specifically for the current
        OS. Using 'yum update' to upgrade the kernel might cause service interruption.
    For more information, see /opt/netapp/lib/ontap_mediator/README
[root@mediator_host ~]#
    Example of ONTAP Mediator upgrade with support for HTTPS only (console output) 
    [root@mediator_host~]# ontap-mediator-1.11.0/ontap-mediator-1.11.0

ONTAP Mediator: Self Extracting Installer

+ Extracting the ONTAP Mediator installation/upgrade archive
+ Performing the ONTAP Mediator run-time code signature check
   Using openssl from the path: /usr/bin/openssl configured for CApath:/etc/pki/tls
+ Unpacking the ONTAP Mediator installer
ONTAP Mediator requires two user accounts. One for the service (netapp), and one for use by ONTAP to the mediator API (mediatoradmin).
Using default account names: netapp + mediatoradmin



Enter ONTAP Mediator user account (mediatoradmin) password:

Re-Enter ONTAP Mediator user account (mediatoradmin) password:

+ Checking if SELinux is in enforcing mode


+ Checking for default Linux firewall




+ Installing required packages.


Last metadata expiration check: 0:33:41 ago on Tue 21 Apr 2026 10:48:35 AM EDT.
Package openssl-1:3.5.1-7.el9_7.x86_64 is already installed.
Package openssl-devel-1:3.5.1-7.el9_7.x86_64 is already installed.
Package kernel-devel-5.14.0-611.45.1.el9_7.x86_64 is already installed.
Package kernel-modules-core-5.14.0-611.45.1.el9_7.x86_64 is already installed.
Package gcc-11.5.0-11.el9.x86_64 is already installed.
Package make-1:4.3-8.el9.x86_64 is already installed.
Package which-2.21-30.el9_6.x86_64 is already installed.
Package libselinux-utils-3.6-3.el9.x86_64 is already installed.
Package patch-2.7.6-16.el9.x86_64 is already installed.
Package perl-Data-Dumper-2.174-462.el9.x86_64 is already installed.
Package perl-ExtUtils-MakeMaker-2:7.60-3.el9.noarch is already installed.
Package bzip2-1.0.8-10.el9_5.x86_64 is already installed.
Package efibootmgr-16-12.el9.x86_64 is already installed.
Package mokutil-2:0.7.2-1.el9.x86_64 is already installed.
Package python3-pip-21.3.1-1.el9.noarch is already installed.
Package elfutils-libelf-devel-0.193-1.el9.x86_64 is already installed.
Package policycoreutils-python-utils-3.6-3.el9.noarch is already installed.
Package python3.12-3.12.12-4.el9_7.2.x86_64 is already installed.
Package python3.12-devel-3.12.12-4.el9_7.2.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
OS package installations finished
+ Installing ONTAP Mediator. (Log: /root/ontap_mediator.JclgnS/ontap-mediator-1.11.0/ontap-mediator-1.11.0/install_20260421112205.log)
    This step will take several minutes. Use the log file to view progress.
    Sudoer config verified
    ONTAP Mediator rsyslog and logging rotation enabled
+ Install successful. (Moving log to /opt/netapp/lib/ontap_mediator/log/install_20260421112205.log)

+ Note: ONTAP Mediator generated a self-signed server certificate for temporary use on
    this host. If the DNS name or IP address for the host is changed, the certificate
    will no longer be valid. The default certificates should be replaced with secure
    trusted certificates signed by a known certificate authority prior to use for production.
    For more information, see /opt/netapp/lib/ontap_mediator/README

+ Note: ONTAP Mediator uses a kernel module compiled specifically for the current
        OS. Using 'yum update' to upgrade the kernel might cause service interruption.
    For more information, see /opt/netapp/lib/ontap_mediator/README
[root@mediator_host~]#
[root@mediator_host~]# tar -zxvf ontap-mediator-1.12.1.tgz
ontap-mediator-1.12.1/
ontap-mediator-1.12.1/csc-prod-chain-ONTAP-Mediator.pem
ontap-mediator-1.12.1/tsa-prod-ONTAP-Mediator.pem
ontap-mediator-1.12.1/csc-prod-ONTAP-Mediator.pem
ontap-mediator-1.12.1/tsa-prod-chain-ONTAP-Mediator.pem
ontap-mediator-1.12.1/ONTAP-Mediator-production.pub
ontap-mediator-1.12.1/ontap-mediator-1.12.1
ontap-mediator-1.12.1/ontap-mediator-1.12.1.sig
ontap-mediator-1.12.1/ontap-mediator-1.12.1.tsr
ontap-mediator-1.12.1/ontap-mediator-1.12.1.sig.tsr
[root@mediator_host~]#
[root@mediator_host~]# ontap-mediator-1.12.1/ontap-mediator-1.12.1 --https-only

ONTAP Mediator: Self Extracting Installer

+ Extracting the ONTAP Mediator installation/upgrade archive
+ Performing the ONTAP Mediator run-time code signature check
   Using openssl from the path: /usr/bin/openssl configured for CApath:/etc/pki/tls
+ Unpacking the ONTAP Mediator installer
+ ONTAP_MEDIATOR_INSTALL_HTTPS_ONLY is set to '1', args are: ''
+ Starting ONTAP Mediator install/update process: previous installation_mode is ''
+ Selected install package mode: HTTPS_ONLY
ONTAP Mediator will be upgraded from version 1.11.0 to 1.12.1.


Do you wish to continue? Y(es)/n(o): yes
Capturing support_bundle to save pre-upgrade configuration. API Credentials are required.
    Mediator API User Name: mediatoradmin
                 Password: Running plugins, please wait...


Creating tar archive...
Support bundle has been generated at /opt/netapp/data/support_bundles/scs001097036-1_1776785423_BASIC.tgz
Testing the DB can be upgraded
Cloning database...
Cloning successful.
Verifying database is up-to-date...
Database out-of-date.Migrations are necessary:
Current revision: 0d5dcf349b27, Head revision: 758e4873c40d
Performing database migrations against clone...
Migrations successful.
Database upgrade operation complete.
+ Adding python312 specific packages
+ Upgrading ONTAP Mediator. (Log: /root/ontap_mediator.cRy0mN/ontap-mediator-1.12.1/ontap-mediator-1.12.1/upgrade_20260421113003.log)
fapolicyd not installed or no rules.d directory found, skipping fapolicyd configuration
    ONTAP Mediator rsyslog and logging rotation enabled
+ Upgrade successful. (Moving log to /opt/netapp/lib/ontap_mediator/log/upgrade_20260421113003.log)\n

+ Note: ONTAP Mediator generated a self-signed server certificate for temporary use on
    this host. If the DNS name or IP address for the host is changed, the certificate
    will no longer be valid. The default certificates should be replaced with secure
    trusted certificates signed by a known certificate authority prior to use for production.
    For more information, see /opt/netapp/lib/ontap_mediator/README

+ Note: ONTAP Mediator uses a kernel module compiled specifically for the current
        OS. Using 'yum update' to upgrade the kernel might cause service interruption.
    For more information, see /opt/netapp/lib/ontap_mediator/README

[root@mediator_host ~]#