Section 13.2
Troubleshooting Client Connections. Well one of the best places to go
to start troubleshooting these client connections is in
within Operations called Network Manager Statistics.
This is, this plug-in is gonna visualize all the
different connections to the Server. And it tells you a lot of information
about it. You know, it tells you, well, just a whole variety
of things. The, the name of the connected
application. So, this is that stuff that we had previously
been deriving from the Message Logs. So, here's the name,
PipeE. Notice that's the first four characters
plus the letter E. These are some of the different interfaces
that are API-based. You can see them
with the E at the end. And,
then for the SDK-based applications, you'll see, you'll see
these things are, are much -- you know, you're gonna see the full,
the full name. But it shows you that. It shows you
things like the IP Address of the connecting client.
So, if we scroll over you can see the IP Address of,
you know, how this data's coming in.
There we go. And,
the, there's
just the number of bytes received, the number of messages received,
if you've got errors, if you have a lot of errors listed
in here. Let me show you. Yeah, here's that address we were talking
about. If you've got a number of errors, this would be, indicative
of some kind of a network problem.
So, this is a very good troubleshooting tool.
It may be something that, you know, by yourself, it's not
a lot you can do with it but when you're on the phone with tech support, they may
ask you to come take a look at this.
Now, there's an,
there's an apparent contradiction that you'll find sometimes
with trusts and explicit logins.
Let me explain what I mean.
If you look in the "System Manager Guide," you'll see
explicitly we state that a trust login
and an explicit login are independent from each other
and the explicit login will always
override the trust login. In other words,
if you explicitly log in as a
specified user, that will override the trust.
However, in practice, what you'll notice is
the trusts for several of our applications
appear to supersede the explicit
login. And, actually, the reason for this is because
some of the applications like ProcessBook and DataLink
and the other connecting applications, they actually attempt
to verify a trust first,
and then, if that doesn't work, then they'll do an explicit
login. Let me demonstrate. And I'll show you
the workaround. See, if, if this is a --
let's say I've got a trust set up. I'll just create
a new trust here. And, I'll call this the
TooLiberalTrust because this is a trust that's just
gonna let me connect simply based on my
computer name, nickgx280. And let's
say that it's gonna give me the user, Emily.
Okay.
Now, let me exit out of the System Management Tools.
I created that
trust on the PI Server, or that trust exists on the PI
Server, so I'm gonna
connect now with the
client. And,
when I, when I make this connection,
when I start trying to look at things,
what you might notice is that
it's gonna look as though you were
logged in as Emily,
not as the user that you're
explicitly defined as. Let me show you. If I go into File, Connections --
yeah, look at this.
I am explicitly defining that the default
user name for the connection is piadmin. But look who I'm
logged in as. How did that happen? Well, it happened
because the very first thing this
connecting client does is it checks to see if there's a trust. If
there is a trust, it will use the trust and it won't go any further.
Now, you can, you can demonstrate
that the explicit login supersedes the trusts,
but only by doing it manually. See, if I were
to choose Connect as
from here, that is an explicit login. So, I'll
connect as the user piadmin, and
now, if I refresh this, you'll notice I am logged in as
piadmin. So, that's, you know,
that's why sometimes you'll see that it, it
really doesn't pay if you've got some of these,
you know, these explicit trusts
or these trusts set up in,
in which you accidentally kind of get reduced
down to a less powerful user, less
privileged user, because you're matching a trust. That's something
to watch out for. It doesn't happen often, but occasionally that,
that annoys our system managers.
Now, to verify that
an SDK-based client is connecting the way you expected
it to, here's a procedure. You'll see it at the bottom of the
lecture notes here. First of all,
make sure that the PI user,
or identify which user is gonna be
the default user when you try to connect.
So, I would do that by going into the Connection Dialog
Box, and I would look at how,
for this particular server, what the default user is.
Now, verify,
once you've done that, verify that that user requires a password.
Now, in this case, piadmin is the
user. He doesn't require a password. I'm gonna go ahead and change that.
That's, by the way, that's a bad situation
anyway. piadmin should always
require a password. So, I've gone ahead and verified
that this requires a password. Let me see if that --
if I've had privilege to make that change.
There we go.
Changed the password. That's 'cause I was currently logged in as,
as piuser. And now, at this point, go ahead and
start a client like ProcessBook and see how you log in.
Actually, what I'm gonna do is just exit out of this and
start it up again. I'd rather do
this. It's a little quicker than starting up ProcessBook,
and it uses the same SDK-based connection. So now,
start this up and then try something
that requires getting access to the data.
So, for example, current values.
I'm gonna look at the current values of the tag 'sinusoid.'
So, we'll do a tag search
for 'sinusoid.'
We find lots of tags, so I'll go ahead and choose
this one. And,
interestingly enough, I do have values. I've gotten values
and I wasn't prompted for a user and password prompt.
So, at this
point, what we should do is take a look in the Message Log
and see what the Message Log
reported about this. So if I
go into the Message Logs,
and we should see the
connection information. Yeah, here we go.
Right here at 8:52 it
says trusts, TooLiberalTrust -- that's the one I created --
is granted to
that particular connection.
And, in fact, I was connected using --
or I was given the
privileges as the user, Emily. So,
that's kind of surprising. Well, it's not surprising. As I said,
we check to see if the trust exists first. So,
if that's not how you intended this to work, then
either create a trust that is going to have a higher priority
or higher score, or, I just
eliminate this trust that's causing the,
the problem for you. So, for example, if I go in here,
and get rid of this trust, I'm gonna be able to,
or I will be able to explicitly use
the login instead of the trust. Actually,
I don't think I'm gonna be able to do this because I'm currently logged in as
pi -- as Emily. Yeah, see, I don't think I'm gonna
be able to delete this trust.
Yeah, here's our, our old friend, negative
10401. No write access. That's because I'm
currently logged in as Emily, because of that trust.
So let me connect as piadmin
whose password is
now set, and now that
I'm logged in as piadmin,
I'll go ahead and delete this trust. So, the big finish is
once I've deleted it -- there we go, we've deleted the trust.
Now let's do that same thing, let's exit,
let's come back in just as though we were coming into ProcessBook or
some other client, and let's do something
that requires connectivity. We'll go into
Data, we'll look at current values,
and we
should be at this point since that -- yeah, there we go -- since
that trust was, is no longer there,
then the, you know, the
second procedure kicks in for these clients.
Now, since they can't connect using a trust, they're
gonna connect using the explicit login. So, I'll
go ahead and type in my password for piadmin,
and, you know, the big finish to this is
now I, I should be able to see -- and I am specifically
logging in as piadmin --
yeah, so there's my current value, and if we look at
connections, we are explicitly logged in as the
piadmin user. So, that's a, that's a test you
can do just to verify that you're getting,
you're actually -- your users are getting the connections that you
had intended for them, and not accidentally
being shuttled off to a different
user privileges based on an erroneous
trust.
Now, here's a couple of tips
on troubleshooting an SDK-based client. And the
SDK-based clients would be things like ProcessBook and DataLink,
the newer versions. So, if you have an API-based
client that can connect, like an interface or the older versions of ProcessBook,
use pidiag -host.
It's normally located in the
pi\\admin directory. However, on a machine that's
also running the PI Server, you'll find that that directory
doesn't exist. You actually launch that from the piadmin directory.
Yeah, that, that's kind of an exception to the rule. You would
typically not find a user who's
running ProcessBook, DataLink, etc., on a
PI Server. But, again, this computer
I'm using here for testing purposes, it actually does not --
it has a PI Server on it, so, in
fact, that utility is gonna be under
pi\\adm., not PIPC. It's something that's
very rarely gonna effect, I think, most customers.
But, here's the utility, pidiag -host. Great little
utility that returns for us everything we
ever needed to know about that connecting client: its domain,
its machine name, the current Windows user that's
logged in, its IP Address, etc.
So, com...
Compare those connection credentials against what you've configured
in the trust table. Now, a second thing
to look at is if
you do have an, a trust defined
that maps all Windows users to the corresponding PI
users, just make sure that those PI users actually
exist. That's a fairly common mistake. People
don't know that those do have to match one-for-one.
And then, finally, if you do have multiple network
interface cards that --
on a computer, and you are using a
trust that's based on IP Address to connect to the Server, again,
use pidiag -host. That's gonna report to you
what the
connection, or what the actual IP Address is that
we're gonna be passing to the Server. So, pidiag -host.
The IP Address you see there is, in fact, the
IP Address that a PC with multiple network
interface cards is gonna be passing to the Server.