Have you ever seen any of these errors before
and wondered what do they mean, what should I do?
Well these are all common PI security errors.
And in this video
I'm going to show you how to test if you can connect
to your PI Data Archive successfully to check
how you actually connect and
to recognize if you are running into a security
permissions issue. So often if you don't have
sufficient permissions to connect to
or do a specific task on the PI Data Archive
you'll receive one of these errors.
And as you can see there are different errors that might show up.
So let's look at some of the similarities
so we'll be able to recognize a security error
when we see them. You'll notice that many of
the errors start off with the
104 number. And if we look
at the wording in the error messages,
we'll see similarities indicating
maybe no access or missing
a Trust or Identity Mapping
or talking about authentication
permissions,
rights. Another thing that you might
see is that if you are trying to look at
data and you see no data, this could be an indication
that you don't have enough permissions to see the data.
Keep in mind
that no data may also be reported in a PI client if
there is no data for that time period.
So now that we have an idea about some of the common
security errors, how will we actually
see them when we are using our software?
Well if we are trying to
look at data with PI client tools like PI DataLink
or PI ProcessBook or PI Coresight
we might see a message that indicates that
we don't have read access or
we might see messages saying
no data. And if we
checked with someone and we know that the data does exist
during this time period and we see no data, that's
telling us that we don't have permissions to see the data.
Additionally if we are involved
with setting up PI Interfaces
to collect data and send it to our PI Data Archive
there are a couple of important security
things to keep in mind. If we are working on configuring
our PI Interface using the PI
Interface Configuration Utility, PI ICU,
we have to make sure
that our user has permission to write to
the module database. And if we
don't then we'll hit an error message
like this. Now keep in mind
that connecting with the PI Interface Configuration Utility
is separate than the connection
that the PI Interface itself makes
to the PI Data Archive. And for that
connection to see if it's successful
or look for any errors, we need to look at the message logs.
And if we look at the message logs
on the PI Interface machine and the interface
is unable to access the PI Point table
when looking for PI Points, we would
see an error message like this indicating
there is a permissions issue. Or
if it has issues writing to specific
PI Points or Tags due to a lack of permissions
we would see messages similar to this.
If we are involved with
configuring PI Points, we might be
using tools like PI Builder. And if we try to edit
something and we don't have permissions to actually
make those edits,
we might receive a pop up message similar to this.
And in addition to PI Builder
many configuration
items on the PI Data Archive are done with
PI System Management Tools.
In PI System Management Tools if we try to edit
something and we don't have permissions to edit it
again we'll see an
error message like this pop up. Keep in
mind that these error messages popping up
when we are trying to do specific tasks are because
we are trying to edit and save something
that we don't have permissions too. Now what would happen on the
other hand if we are just trying to see
maybe some settings and we don't have
permissions even to see the settings, in that case
it's not necessarily the case that an error would
pop up. We might just receive basically
a blank screen. We would not be
able to see the things that we don't have permissions to.
However keep in mind if you are working with
PI System Management Tools down at the bottom
in the session record, there will still
be an error reported.
Now any unsuccessful
connections on the PI Data Archive,
these messages will get logged
in the PI message logs. So in this
case we might see PI message logs
that indicate issues.
And lastly the PI SDK Utility
is a handy
application that we can use to test
connections to the PI Data Archive and
if we are unable to connect with
a Mapping or a Trust
we will receive a message like this one
letting us know that we are unable to successfully connect
to the PI Data Archive. So now
we have an idea of what security errors look
like, what should we do to troubleshoot
one if one comes up? Well
there are a couple of things that we can do.
As a user we can see
one, can we connect at all to the PI Data Archive?
And if we can,
how did we connect? How did we authenticate?
Which basically it comes down to
what identities do we receive? And we can actually
look at these things using the PI SDK
Utility or the Connection Manager
in our clients. And we'll see specifically
how we can do that. Once we have
those items figured out, then
we'll have everything we need to go to our PI System Administrator
and let them know what the problem is.
We'll be able to say I was trying to do this task, this
is the error that I received. And
it looks like a security issue. Now I
can connect to the Data Archive or I can't, and if I
can connect this is exactly how I connected.
From there your PI Administrator
will be able to help determine
what permissions do your identities
have on that Data Archive. And
what permissions are needed to actually
do the task that you were trying to do.
And basically what's missing, what additional permissions
do you need? They can grant them to
you and they will also be able to help you determine
if the correct connection protocol
is being used on your machine.
So let's see how we can complete
these two items on our client machine
right away.
So I switched over to this machine and
this is a machine that Lucy one of our engineers is using.
And if Lucy wants to be able to see
if she can successfully connect to the PI
Data Archive, as I mentioned one handy
way that she can check right away is to
use the PI SDK Utility if she has it installed on her machine.
So let's search for that by typing
SDK and we'll see
About PI SDK show up.
And if we select this, we can open the PI SDK
Utility. And to
check to see if she can connect to this PI Data
Archive, she just needs to check the box next to it.
OK, so we can see that
down here she was able to successfully connect
and we also
can see what are the identities, users or
groups that she receives?
So this is letting us know that Lucy
was able to successfully connect. And we
can even see that Lucy
has her account here which is
EllenGenere. Now what would it look like
if a user was unable to successfully connect?
Let's switch.
So in this case we have another
user and when this user connects
they receive this message. So
basically the error letting them know that
there is not a Mapping or a Trust
that is allowing them to authenticate on this PI Data Archive, that
they are unable to connect.
They hit OK. It will say down
here at the bottom that the connection
fails. So that's what it will look like if you
can't make a connection from the PI SDK Utility.
So let's jump back to
Lucy
and ask if we can connect with the
PI SDK Utility, what does that mean for our other client tools?
Since Lucy is authenticating with
a Mapping which is the preferred authentication
here. We will see the same behavior
in PI ProcessBook, PI DataLink,
PI System Explorer and PI System Management Tools.
Let me show you that here.
So if we go to PI ProcessBook, we can also
directly in this client tool check the
connection if we go to
connections. And you'll see the same
type of dialogue box. And I'm already
connected and I can also test the connection again here.
If I expand
this again we see the same
information that Lucy was able to connect
successfully and is receiving the
all company and process engineers.
Similarly we
can do the same process in other client tools.
For example in PI DataLink we can go
settings and also open the Connection Manager.
Now in this case you can see that I'm already
connected because it has this green
dot. And if I hover over it, it will report
how we are connecting as.
And we'll also see that same user reported
here.
If we were not
already connected or to disconnect
and try connecting again, we can right click
and hit disconnect.
And similarly connect again.
This same dialogue window
is also available when we are looking at PI
System Explorer.
Same thing here.
And in PI System Management
Tools, once we have selected a
plug-in, we'll see the connection
information down here at the bottom. And because
multiple PI Identities may be received
if we don't see all the information
because it's too long, we can always
double click and open this. So again
we see the information here
that Lucy is receiving these identities.
We know that it's using this Windows
account and we can also get some information that she's
actually connecting with a Mapping. And
we know that she's connecting with
a Mapping as well in the other tools
because they are reporting her user account here.
So now we've been able
to test our connection to the PI Data Archive
with the PI SDK Utility as well as
our other client tools. And we know how to
check if we are receiving a Mapping and what
PI Identities that we receive from that Mapping.
Now there is one other PI client tool
that we haven't talked about yet and that's PI Coresight.
So remember PI Coresight is web based,
so what that means is that we
are connecting to the PI Coresight Server
through a web browser. This also
means that we are not going to be able to see the information
on the connection on the
browser because that information is actually getting
logged on the Coresight Server itself.
So when we are working with PI Coresight
we'll need to have our PI Administrator check to
see how specifically we are connecting. And that's something
that they'll be able to do using PI System Management
Tools Network Manager Statistics.
So with that
just remember when checking for a security
issue make sure to determine if you can
connect to your PI Data Archive and
if you can how did you connect.
And from there you can give your PI System Administrator
the information that they need to determine
what access permissions you might be missing.
And if you are a PI System Administrator,
stay tuned for our next video where we'll show
how we can leverage Network Manager Statistics
to troubleshoot connections from all of our different
users and applications.