PI Coresight Installation and Administration Guide

Transcription

1 PI Coresight 2014 Installation and Administration Guide

2 OSIsoft, LLC 777 Davis St., Suite 250 San Leandro, CA USA Tel: (01) Fax: (01) Web: PI Coresight 2014 Installation and Administration Guide by OSIsoft, LLC. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, mechanical, photocopying, recording, or otherwise, without the prior written permission of OSIsoft, LLC. OSIsoft, the OSIsoft logo and logotype, PI Analytics, PI ProcessBook, PI DataLink, ProcessPoint, PI Asset Framework (PI AF), IT Monitor, MCN Health Monitor, PI System, PI ActiveView, PI ACE, PI AlarmView, PI BatchView, PI Coresight, PI Data Services, PI Event Frames, PI Manual Logger, PI ProfileView, PI Web API, PI WebParts, ProTRAQ, RLINK, RtAnalytics, RtBaseline, RtPortal, RtPM, RtReports and RtWebParts are all trademarks of OSIsoft, LLC. All other trademarks or trade names used herein are the property of their respective owners. U.S. GOVERNMENT RIGHTS Use, duplication or disclosure by the U.S. Government is subject to restrictions set forth in the OSIsoft, LLC license agreement and as provided in DFARS , DFARS , FAR , FAR , as applicable. OSIsoft, LLC. Version: Published: September 2014

3 Contents PI Coresight architecture and system requirements... 1 PI Coresight architecture... 1 About the PI Coresight web server...2 PI Coresight application pools and service accounts... 2 PI Coresight access groups...3 Software and hardware requirements... 4 Hardware requirements for PI Coresight application server... 4 PI Coresight application server software requirements... 5 Microsoft SQL Server requirements...5 PI System requirements for PI Coresight... 6 PI ProcessBook display version... 6 Client requirements...6 PI Coresight upgrades... 9 Upgrade a PI Coresight installation... 9 Automatic PI Coresight upgrade backups Preparation for a new PI Coresight installation Create a domain user account for PI Coresight...13 Required PI Coresight service account access permissions Prepare the PI Coresight application server computer Server Manager roles and features...15 PI Coresight installation Pre-install checklist for PI Coresight Install PI Coresight...21 Silent installation...23 Multilingual UI available to install Configure PI Coresight after installation...25 Configure PI Coresight service accounts PI Coresight database creation Configure the Microsoft SQL Server connection Create the PI Coresight database Manually create the PI Coresight database Disable SSL Version 2 and earlier...30 Configure Secure Sockets Layer (SSL) access Enable HTTP compression on the PI Coresight application server...30 Configure PI Coresight access to PI Server data Configure PI server access permissions Create the PI identity Grant the PI identity the required access permissions Configure PI server authentication Configure WIS authentication PI Server authentication on mobile devices Configure PI Coresight access to PI AF databases PI Coresight 2014 Installation and Administration Guide iii

4 Contents Configure PI AF authentication and permissions...39 Configure access to a PI AF server...39 Configure access to a PI AF database...40 Configure read access for PI AF objects PI Coresight administration tasks Configure user access to the PI Coresight application Configure Firefox and Chrome browsers for PI Coresight clients...42 Add the PI Coresight application server as a Google Chrome trusted site...42 Add the PI Coresight application server as a Firefox trusted site...43 The PI Coresight Administration website and Administrator users...43 Check PI Coresight status Access to PI and AF data...44 Configure folders for import Update the SQL Server instance and PI Coresight database Update display ownership and reset user settings Generate reports Backup strategy for the PI Coresight database Change the account of the PI Coresight database...50 Reassign a display from the Homepage Time zone and regionalization settings...51 Change time-zone settings Change regionalization settings...54 Uninstall PI Coresight URL parameters for controlling the presentation of displays...55 Creating a new temporary display with particular data items...55 Opening an existing saved display Applying kiosk mode to a display...56 Reuse displays for assets built from the same AF template Specify the element for PI ProcessBook element relative displays Set the time zone for a display...58 Hide the toolbar or timebar Prevent automatic redirection to PI Coresight mobile website High availability options for PI Coresight Appendix A View and configure PI Coresight message logs...65 View the message logs Collect analytic and debug events using Windows Performance Monitor Suppress duplicate messages (message throttling) Technical support and other resources iv PI Coresight 2014 Installation and Administration Guide

5 PI Coresight architecture and system requirements PI Coresight architecture The main components of a PI Coresight installation are: One or more PI servers One or more PI AF databases A PI Coresight application server Microsoft SQL Server, to hold the PI Coresight database Clients Clients where you plan to create or update displays must run Microsoft Silverlight compatible web browsers. PI Coresight 2014 is supported by most modern browsers on a wide variety of computers, including tablets and phones running ios or Android operating systems. OSIsoft recommends that PI Coresight use the same SQL Server that PI AF uses. Otherwise, you can either install a SQL Server on the same computer as the PI Coresight application server or you can use a dedicated SQL Server installation. OSIsoft strongly recommends that the PI Servers and PI AF servers be in the same domain as the PI Coresight application server and Microsoft SQL Server hosting the PI Coresight database. The following diagram illustrates a typical configuration. Here, the PI Coresight database resides on the same MS SQL Server that PI AF uses. In this diagram, the MS SQL Server and the PI AF Server are installed on the same computer, although that is not a requirement. PI Coresight 2014 Installation and Administration Guide 1

6 PI Coresight architecture and system requirements About the PI Coresight web server PI Coresight uses two websites: The administration website: The main application website: Where webserver is the name of the PI Coresight web server. PI Coresight uses the Microsoft Internet Information Services (IIS) web server. PI Coresight application pools and service accounts The PI Coresight installation creates two application pools and two Windows services. The application pools run under Windows service accounts that have appropriate access permissions across the PI System: CoresightAdminAppPool runs the Administration website, located at: webserver/coresight/admin CoresightServiceAppPool runs the main PI Coresight application website, located at The Windows services that the installation program creates are: 2 PI Coresight 2014 Installation and Administration Guide

7 PI Coresight architecture and system requirements PI Web API: a RESTful API to the PI System PI Indexed Search Crawler: crawls PI System data sources to provide metadata to indexed search The PI Indexed Search Crawler requires read access to PIUsers, PIDBSEC, PIMappings and PIPOINT. Note that by default, the PIWorld identity has read access to PIUsers and PIDBSEC, therefore explicit access for these two groups is not required, unless you have disabled PIWorld. The PI Coresight application pools and service accounts run under the PI Coresight service account. This is the account that PI Coresight uses to connect to the PI and PI AF servers. For client users to see PI data, the PI Coresight service account needs appropriate access to these servers. When you install PI Coresight, the installation kit by default sets the service accounts to the machine account of the application server itself and sets the accounts for each service as follows: Service CoresightAdminAppPool CoresightServiceAppPool PI Web API PI Indexed Search Crawler Account NT Authority\Network Service NT Authority\Network Service NT Service\piwebapi Local System The PI Coresight service account in this configuration is the server machine Active Directory account. Typically, this account is named domain\server-name$. For example, MyEnterprise\CoresightServer$. For security reasons, OSIsoft recommends that you instead create a domain account for the PI Coresight services: 1. Change the PI Coresight service account to a dedicated domain account. See Create a domain user account for PI Coresight. 2. Configure the application pools and services to run under this account. See Configure PI Coresight service accounts. Caution: OSIsoft strongly recommends that you create a domain account for the PI Coresight services. If you use the machine account, all the applications running on the application server computer have access permissions on the SQL server, PI server, and PI AF server machines. This is a security risk. At a minimum, consider removing some or all of the other applications running on this computer. PI Coresight access groups Access to the PI Coresight administration website and the PI Coresight website are controlled through separate Microsoft Windows groups. The PI Coresight setup program creates these local user groups on the PI Coresight application server: PI Coresight 2014 Installation and Administration Guide 3

8 PI Coresight architecture and system requirements PI Coresight Admins PI Coresight Users PI Web API Admins For more information, see Configure user access to the PI Coresight application and The PI Coresight Administration website and Administrator users. Software and hardware requirements Hardware requirements for PI Coresight application server Microsoft SQL Server database requirements The following requirements are based on the Microsoft SQL Server residing on the PI Coresight application server. The Microsoft SQL Server database requires approximately 200MB of storage plus 5MB per user (assuming 200 average-sized displays per user). If you plan to import PI ProcessBook displays, allow a minimum of 500KB per display (assuming averagesized displays) on the SQL Server. By default, the database will automatically grow by 200MB each time the current size limit is reached. Index files requirements The index files can be large, especially if you have many PI Servers or complex databases. They are located in your ProgramData folder. As an approximate guideline to estimate the size of the index files: For 1000 PI points, allow about 4MB For 1000 AF elements (assuming 10 attributes each) allow about 14MB Summary of hardware requirements # of Users 1 to to to 500 CPU (Cores) CPU Speed (GHz) Memory (GB) You can estimate the total disk space required in MB using the expression: DiskSpace = *Users *PIPoints *AFElements Where the parameters are: DiskSpace: required disk space (MB) Users: the number of users creating displays PIPoints: the total number of PI points on all allowed servers AFElements: the total number of elements on all allowed AF databases (assumes an average of 10 attributes per element) 4 PI Coresight 2014 Installation and Administration Guide

9 PI Coresight architecture and system requirements If your elements, attributes, and points have many unique descriptions, the index file size can be significantly larger. PI Coresight application server software requirements The requirements for the software on the machine hosting the PI Coresight application server are as listed: Microsoft Windows Server 2008 R2 SP1 64-bit, or later Microsoft Internet Information Services (IIS) 7.5, or later Microsoft.NET Framework 4 Server Manager roles and features. See Preparation for a new PI Coresight installation for details on which roles and features are required for PI Coresight. Microsoft SQL Server requirements PI Coresight requires Microsoft SQL Server 2008 R2 or above. Standard, Enterprise, and Express versions are all supported. OSIsoft recommends that you host your PI Coresight database on the same SQL Server that PI AF uses. Ensure the SQL Server configuration setting Allow Triggers to Fire Others is set to True. To verify this setting: 1. In SQL Server Management Studio, right-click your instance and choose Properties. 2. Select the Advanced page. 3. Allow Triggers to Fire Others is the first setting in the Miscellaneous section. For heavier loads (over 500 users) a full version of SQL Server running on a dedicated server is required. PI Coresight 2014 Installation and Administration Guide 5

10 PI Coresight architecture and system requirements PI System requirements for PI Coresight PI Coresight is supported with the following versions of PI Server and PI AF: PI Server version , and later. PI Asset Framework 2010, and later. PI AF 2010 R2, or later, is recommended. PI ProcessBook display version Starting with PI Coresight 2014, you can configure your application server so that users can view PI ProcessBook displays. PDI and SVG files produced by PI ProcessBook, version 2.35 or later, are automatically imported from the folders you configure. For best results, use PI ProcessBook displays saved using Version or later. This is particularly important for graphics and regional number format support. For more information about importing PI ProcessBook displays, see Configure folders for import. Client requirements PI Coresight 2014 clients need to use web browsers that are compatible with this software. To create or update displays, client machines must have the required version of Microsoft Silverlight installed ( , or later). Silverlight components are supported only in configurations where Silverlight is supported. Note that on Mac OS, Safari and Firefox are the only two browsers supported by Silverlight. To install Microsoft Silverlight, go to the Microsoft installation page at: Supported browsers for PI Coresight PI Coresight 2014 is known to be compatible with the following browsers: On Windows with Microsoft Internet Explorer versions 10 and 11, Mozilla Firefox version 30.0, Google Chrome version 35.0 On Apple Macintosh with Safari version 5.1 On the ipad and iphone with ios version 7 On Android devices with Android version 4.1, 4.2.2, and To use PI Coresight with Google Chrome and Firefox, you must specify the PI Coresight application server as a trusted site. See Configure Firefox and Chrome browsers for PI Coresight clients. 6 PI Coresight 2014 Installation and Administration Guide

11 PI Coresight architecture and system requirements For online Help to open successfully when you click the Help button (?), you might need to disable popup blocking in your browser. Ensure Silverlight is at the required version PI Coresight 2014 requires Microsoft Silverlight Version , or later, based on the Security Update for Microsoft Silverlight ( You will be prompted to upgrade, if you have not already done so. ios devices as clients Support of ios-based devices started with PI Coresight 2012 R2 for the ipad, and with PI Coresight 2013 for the iphone. For PI Coresight 2014, it is recommended that instead of using the native ios apps from the App Store, users navigate to the mobile web site. When a user of a smaller device or browser goes to the application website: they are by default redirected to the PI Coresight mobile web site: (You can override this behavior for specific displays, such as in a dashboard, if required. For more information, see Prevent automatic redirection to PI Coresight mobile website.) PI Coresight 2014 Installation and Administration Guide 7

12 PI Coresight architecture and system requirements 8 PI Coresight 2014 Installation and Administration Guide

13 PI Coresight upgrades When you upgrade to a new version of PI Coresight, your existing settings are carried over to the upgraded PI Coresight installation. This includes settings for allowed PI servers, PI AF databases, and the PI Coresight database. Upgrade a PI Coresight installation Follow the steps in this procedure to upgrade an existing installation of PI Coresight. During installation, you will see setup screens for the following software: 1. PI Web API 2. PI Indexed Search Crawler. The machine hosting the PI Indexed Search Crawler must be a member of a domain. 3. PI Coresight If the computer where you installed PI Coresight is later added to a domain, you must uninstall and reinstall PI Web API and the PI Indexed Search Crawler. If you used a selfsigned certificate, you will need to generate a new certificate when you reinstall. Before you start Caution: New for PI Coresight 2014: You must have a digital certificate to complete installation (the installation program allows you to create and use a self-signed certificate, if required). You must specify your AF server during installation. Minimum AF server and PI Server versions have changed, see PI System requirements for PI Coresight. You need to know the PI Coresight service account name in current use for PI Coresight. For more information on how to retrieve this account, see PI Coresight application pools and service accounts. If you plan to import PI ProcessBook displays, allow extra disk space (approximately 500KB per display). PI mappings are required for all client users to search PI servers and AF servers (a PI trust is not sufficient for search, but can still be used for viewing data). A PI mapping associates a user or group with a PI identity. PI Coresight administrators must be members of the PI Web API Admins group, in order to allow PI Servers and AF databases. See Pre-install checklist for PI Coresight 2014 for more information about install requirements. PI Coresight 2014 Installation and Administration Guide 9

14 PI Coresight upgrades To upgrade the PI Coresight database, the user performing the upgrade (by using the installation program, the administration web site, or the go.bat script) must have the following minimum database role memberships, or be a member of the db_owner database role. db_datareader db_datawriter db_ddladmin 1. Log on to the application server as a System Administrator, using a domain user account that belongs to the local Administrators group. 2. Verify that URL Authorization and Basic Authentication role services are enabled for the web server role, by following these steps: a. Open the Microsoft Server Manager application. b. Expand the Roles section and then expand the Web Server (IIS) section. c. Click Add Role Services. d. Under Security, make sure that the Basic Authentication and URL Authorization check boxes are checked. If they are not checked, check them now. 3. Download the new PI Coresight installation kit from the OSIsoft Technical Support website. 4. Right-click the PI Coresight setup executable and select Run as Administrator to launch the installation wizard. 5. For the PI Web API installation, choose the Custom setup type. 6. When prompted during the PI Web API installation for an account, choose the Active Directory account currently in use by the previous version of the PI Coresight web site application pools. One exception is, if PI Coresight was previously using the Network Service account, choose the option to run PI Web API as NT Service\piwebapi. 7. When prompted during the PI Web API installation for a trusted certificate, either select an existing SSL certificate or choose the option to create a self-signed certificate and then select it. For more information see Configure Secure Sockets Layer (SSL) access. 8. After the upgrade completes, reboot your machine, and then follow the directions in Configure PI Coresight service accounts to ensure all services are running under the correct accounts. 9. If you have Basic authentication enabled, it might be disabled when you upgrade PI Coresight. If you are using mobile devices over SSL, you need to re-enable Basic authentication. For more information, see PI Server authentication on mobile devices. Upgrading the PI Coresight database If Microsoft SQL Server is on the PI Coresight application server computer, the PI Coresight database is upgraded automatically. If SQL Server is on a remote server, you need to manually upgrade the PI Coresight database. 10 PI Coresight 2014 Installation and Administration Guide

15 PI Coresight upgrades There may be cases where you are notified on the PI Coresight administration website that the PI Coresight database needs to be upgraded. If you have the required permissions (described at the beginning of this procedure) you can perform the upgrade at that time. The administration site is located at Admin where webserver is the name of your PI Coresight web server. Automatic PI Coresight upgrade backups When you upgrade PI Coresight, the installation program creates a copy of the PI Coresight database. This backup file is called CoresightDatabase.backup and is located in the default Microsoft SQL Server backup directory. For example: Program Files\Microsoft SQL Server\MSSQL10_50.SQLEXPRESS\MSSQL\Backup If a backup database already exists at this location from a previous PI Coresight upgrade, the installation kit overwrites the older backup file. The installation program also creates copies of upgraded web.config files, which are located in: Program Data\OSIsoft\Coresight\PIDSTemp PI Coresight 2014 Installation and Administration Guide 11

16 PI Coresight upgrades 12 PI Coresight 2014 Installation and Administration Guide

17 Preparation for a new PI Coresight installation To prepare for a new PI Coresight installation, complete the following tasks: Topics in this section Create a domain user account for PI Coresight Prepare the PI Coresight application server computer Create a domain user account for PI Coresight By default, the PI Coresight application services run under the machine account of the application server itself. Instead, OSIsoft recommends that you create a dedicated Windows Active Directory account for the PI Coresight application service. The indexed search crawler service requires accessread access to the PIMAPPING database on the PI Server. 1. On the domain controller, create the account. OSIsoft recommends that you name this account CoresightService. 2. Make a note of the account name and password. After installation, you will configure the PI Coresight application pools and services to run under this new account. For more information, see Configure PI Coresight service accounts. 3. Grant the Coresight Service account all permissions listed in Required PI Coresight service account access permissions. OSIsoft strongly recommends that you create a custom account for the PI Coresight service. If you choose to ignore this recommendation, then you should review the other applications running on the application server computer. All applications running on this computer will have the Coresight access permissions on the SQL, PI, and PI AF servers. For security reasons, consider removing some or all of the other applications running on this computer. Required PI Coresight service account access permissions The service account requires the following access permissions: Login access to the Microsoft SQL Server used by PI Coresight and limited access to the PI Coresight database (access to other databases on this SQL Server is not needed). PI Coresight automatically configures the Microsoft SQL Server login, database, and security settings when you install the PI Coresight database, if you have the appropriate authorization to the Microsoft SQL Server. For the PI Indexed Search Crawler service: Read access to PIUsers, PIDBSEC, PIMappings and PIPOINT. PI Coresight 2014 Installation and Administration Guide 13

18 Preparation for a new PI Coresight installation By default, the PIWorld identity has read access to PIUsers and PIDBSEC, therefore explicit access for these two groups is not required unless you have disabled PIWorld. Read and write privileges to the ProgramData folder, in which the search index files are located. The index files can be large, especially if you have many PI Servers or complex databases. The crawler can access the PI Server with a trust or a mapping, however mappings must exist for each PI Coresight user, so that the index can successfully associate Windows users with the PI Identities that have access to points. PI servers: On each allowed PI server, the PI Coresight service account needs read access to all PI Points that can be accessed by PI Coresight. See Configure PI Coresight access to PI Server data. PI AF servers: The PI Coresight service account needs read access to the PI AF servers and to all allowed PI AF databases on each PI AF server. In addition, the PI Coresight service account needs read access to all PI AF elements and tables that can be accessed by PI Coresight. See Configure PI AF authentication and permissions. Folders configured for import of PI ProcessBook displays: The application pool identity must have permission to access any folder from which you import PDI or SVG files. See Configure folders for import. Prepare the PI Coresight application server computer 1. Open the required ports for the configured PI Coresight website. All required ports must be open for PI Coresight to function properly. Typical required ports Port Used by 80 or 443 PI Coresight web server 5450 PI Server 5457 PI AF Server 2. If you are installing on a web server that hosts multiple sites on the same port, you need to temporarily change the port number before installation: a. In Internet Information Server (IIS) Manager, select the website where you want to install PI Coresight, right-click and select Edit Bindings. b. In Site Bindings, select the first row and click Edit. c. Change the port number to a unique number and click OK. d. After installation, you can change the port number back to the original number. 3. If you are installing on an existing PI WebParts or PI Web Services application server, then you must create a separate website with a unique port number. You cannot install PI 14 PI Coresight 2014 Installation and Administration Guide

19 Coresight under an existing web application. Make a note of this website. During installation, enter it when prompted for the website. 4. Download the required software: OSIsoft Prerequisites kit and the PI Coresight installation kit. You can download these kits from the OSIsoft Tech Support website ( Microsoft SQL Server installation kit (you can skip this step if you plan to use an existing SQL Server installation). The setup kit for SQL Server Express is available for download on the OSIsoft Technical Support website. See Microsoft SQL Server requirements for a list of supported versions. 5. From the Microsoft Server Manager application: Install the Web Server (IIS) role (required) and install the Application Server role (required for Windows Server 2012, optional for Windows Server 2008). Install at least the minimum role services. See Role services for web server and Role services for application server for lists of required and recommended role services. Install the Required server features. 6. Run the OSIsoft Prerequisites installation kit. Preparation for a new PI Coresight installation 7. Install Microsoft SQL Server (if you plan to use an existing SQL Server installation, then skip this step). Server Manager roles and features PI Coresight has the following requirements: Web server (IIS) role with at least the minimum role services listed in Role services for web server. The server features listed in Required server features. OSIsoft recommends, but does not require, that you perform the following configuration steps: For Windows Server 2008 R2, install the Application server role. No non-default role services are required for this role, but consider adding the additional recommended roles listed in Role services for application server. Enable HTTP compression on the PI Coresight application server. See Enable HTTP compression on the PI Coresight application server Role services for web server Windows Server 2008 R2 Windows Server 2012 Common HTTP Features Required: Static Content Default Document HTTP Errors Recommended: All except WebDAV Publishing Required: Static Content Default Document HTTP Errors Recommended: All except WebDAV Publishing PI Coresight 2014 Installation and Administration Guide 15

20 Preparation for a new PI Coresight installation Windows Server 2008 R2 Windows Server 2012 Application Development Health and Diagnostics Security Performance Management Tools Required:.NET Extensibility Recommended: ASP.NET ISAPI Extensions ISAPI Filters Required: None Recommended: HTTP Logging Logging Tools Request monitor Tracing Required: Windows Authentication Request Filtering URL Authorization Basic Authentication Recommended: All Required: All Required: IIS Management Console Recommended: IIS Management Scripts and Tools Management Service Required:.NET Extensibility 3.5.NET Extensibility 4.5 Recommended: ASP.NET 3.5 ASP.NET 4.5 ISAPI Extensions ISAPI Filters Required: None Recommended: HTTP Logging Logging Tools Request monitor Tracing Required: Windows Authentication Request Filtering URL Authorization Basic Authentication Recommended: All Required: All Required: IIS Management Console Recommended: IIS Management Scripts and Tools Management Service Role services for application server The following role services are required or recommended for Application Server. 16 PI Coresight 2014 Installation and Administration Guide

21 Preparation for a new PI Coresight installation Windows Server 2008 R2 Windows Server 2012 Recommended:.NET Framework Windows Process Activation Service Support - HTTP Activation Web Server (IIS) Support Required:.NET Framework 4.5 Windows Process Activation Service Support - HTTP Activation Recommended: Web Server (IIS) Support Required server features Windows Server 2008 R2 Windows Server 2012 Windows Process Activation Service Process Model.NET Environment Configuration APIs Process Model.NET Environment 3.5 Configuration APIs.NET Framework 3.5 Features.NET Framework WCF Activation HTTP Activation.NET Framework 3.5 (including.net 2.0 and 3.0) HTTP Activation Non-HTTP Activation PI Coresight 2014 Installation and Administration Guide 17

22 Preparation for a new PI Coresight installation 18 PI Coresight 2014 Installation and Administration Guide

23 PI Coresight installation OSIsoft recommends the following configuration: For the PI Coresight database, use the same Microsoft SQL Server that PI AF uses The PI Servers and PI AF servers are in the domain where: The PI Coresight application server resides. Microsoft SQL Server hosts the PI Coresight database Caution: New for PI Coresight 2014: You must have a digital certificate to complete installation (the installation program allows you to create and use a self-signed certificate, if required). You must specify your AF server during installation. Minimum AF server and PI Server versions have changed, see PI System requirements for PI Coresight. You need to know the PI Coresight service account name in current use for PI Coresight. For more information on how to retrieve this account, see PI Coresight application pools and service accounts. If you plan to import PI ProcessBook displays, allow extra disk space (approximately 500KB per display). PI mappings are required for all client users to search PI servers and AF servers (a PI trust is not sufficient for search, but can still be used for viewing data). A PI mapping associates a user or group with a PI identity. PI Coresight administrators must be members of the PI Web API Admins group, in order to allow PI Servers and AF databases. Before you start the installation, check the prerequisites shown in Pre-install checklist for PI Coresight Pre-install checklist for PI Coresight 2014 Storage space Recommendation or Requirement Approximately 250MB + 5 MB per user For each imported PI ProcessBook display, allow an extra 500KB For more information Hardware requirements for PI Coresight application server PI Coresight 2014 Installation and Administration Guide 19

24 PI Coresight installation Recommendation or Requirement For more information Domain user account for PI Coresight service To keep your data secure, OSIsoft recommends you create a domain account for the PI Coresight service. After install, you must configure the application pools to use this identity. Create a domain user account for PI Coresight Configure PI Coresight service accounts PI Coresight service account access permissions Software on PI Coresight application server Microsoft SQL Server Login access to the SQL Server used by PI Coresight and limited access to the PI Coresight database Read access to PIUsers, PIDBSEC, PIMappings and PIPOINT. Read and write privileges to the ProgramData folder, in which the search index files are located. The PI Coresight service account can access the PI Server with a trust or a mapping. Important: Mappings must exist for each PI Coresight user to the PI Server. Read access to all PI Points on each allowed PI server Read access to the PI AF servers, allowed PI AF databases, and elements and tables. Read access to any folder configured to import PDI or SVG files. Windows Server 2008 R2 SP1 64- bit, or later IIS 7.5, or later Microsoft.NET Framework, version R2, or later Standard, Enterprise, and Express are all supported. Ensure Allow Triggers to Fire Others is set to True. OSIsoft recommends that you host your PI Coresight database on the same SQL Server that PI AF uses. Required PI Coresight service account access permissions PI Coresight application pools and service accounts Configure folders for import PI Coresight application server software requirements Microsoft SQL Server requirements 20 PI Coresight 2014 Installation and Administration Guide

25 Recommendation or Requirement For more information PI System PI Server version , and later Server Manager roles and features PI Asset Framework 2010, and later The web server (IIS) role must have at least the minimum role services shown in Role services for web server The server features shown in Required server features are also required. PI System requirements for PI Coresight Server Manager roles and features Microsoft Silverlight Version , or later Ensure Silverlight is at the required version Ports on the PI Coresight application server computer 80 or 443: PI Coresight web server 5450: PI Server 5457: PI AF Server Installing user privileges db_creator server role ALTER ANY LOGIN permission Write access to the Configuration database on the default AF server Log on to the application server as a System Administrator, using a domain user account that belongs to the local Administrators group. Prepare the PI Coresight application server computer Install PI Coresight PI Coresight installation SSL digital certificate AF server name During installation, you need to specify a certificate that you have purchased from a certificate authority, or you can create and use a self-signed certificate. During installation, you need to specify the name of the default PI AF server. Install PI Coresight Follow the steps in this procedure to install PI Coresight for the first time. Before you start When you install PI Coresight for the first time, the PI Coresight database is created. Therefore, the user performing the installation (through the installation program, administration web site or by using the go.bat script) must have the following privileges: The db_creator server role. ALTER ANY LOGIN permission. Users can be granted this permission by use of the statement GRANT ALTER ANY LOGIN TO "domain\account". If a user is a member of the securityadmin server role, they already have ALTER ANY LOGIN permission. PI Coresight 2014 Installation and Administration Guide 21

26 PI Coresight installation The installing user also requires write access to the Configuration database on the default AF server. You access the Configuration database by using PI System Explorer. The Configuration database is constructed from information contained within the AF SQL Server database (PIFD). Make sure you have met the prerequisites listed in Pre-install checklist for PI Coresight During installation, you will see setup screens for the following software: 1. PI Web API 2. PI Indexed Search Crawler The machine hosting the PI Indexed Search Crawler must be a member of a domain. 3. PI Coresight If the computer where you installed PI Coresight is later added to a domain, you must uninstall and reinstall PI Web API and the PI Indexed Search Crawler. If you used a selfsigned certificate, you will need to generate a new certificate when you reinstall. 1. Log on to the application server as a System Administrator, using a domain user account that belongs to the local Administrators group. 2. Right-click the PI Coresight setup executable and select Run as Administrator to launch the installation wizard. The installer displays a list of software components that are required by PI Coresight. Some components might already be present on your computer. 3. Review the list of software components and click OK to proceed with the installation. The installation kit installs the required components including PI AF client, PI Web API, and PI SDK. 4. The install kit will prompt you to specify: The name of a PI AF Server. An SSL digital certificate (either a certificate you have purchased from a certificate authority or the installation program allows you to create and use a self-signed certificate). This certificate is used for internal communication between PI Coresight server components, and is not necessarily used for securing client access to the website. For more information about securing the website with SSL, see Configure Secure Sockets Layer (SSL) access. A directory location for PI Coresight. OSIsoft highly recommends that all OSIsoft components are installed in the same root folder. For example, Program Files\PIPC. A website name where PI Coresight will be installed. If you are installing on an existing PI WebParts or PI Web Services application server, enter the website you created when you prepared the application server--see Prepare the PI Coresight application server computer. 5. The install kit prompts you to begin the installation. The installation process creates the following items: The pre-populated Windows groups on the application server: PI Coresight Admins, PI Coresight Users, and PI Web API Admins The PI Coresight Administration website 22 PI Coresight 2014 Installation and Administration Guide

27 PI Coresight installation The PI Coresight website, plus the application pools: CoresightServiceAppPool and CoresightAdminAppPool Two Windows services: PI Web API and PI Index Search Crawler 6. For the PI Web API installation, choose the Custom setup type. 7. When prompted during the PI Web API installation for an account, choose the CoresightService account that was created. 8. When prompted during the PI Web API installation for a trusted certificate, either select an existing SSL certificate or choose the option to create a self-signed certificate and then select it. For more information, see Configure Secure Sockets Layer (SSL) access. 9. Follow the directions in Configure PI Coresight service accounts to ensure all services are running under the correct accounts. 10. After the installation completes, reboot your machine, and then follow the instructions in Configure PI Coresight after installation to finish the configuration. Silent installation To invoke a silent installation, enter the following command: setup.exe -f silent.ini You can customize the silent.ini file to provide a default PI Server configuration, as follows: [COMMANDLINE] 4 = /qn REBOOT=Suppress ALLUSERS=1 PI_SERVER= localhost PI_ALIAS=localhost PI_TYPE=3 PI_PORT=5450 PI_USER=piadmin INSTALLDIR="C:\Program Files\PIPC" Multilingual UI available to install The PI Coresight Multilingual User Interface (MUI) is available for download from the OSIsoft Technical Support website ( After the MUI is installed on the web server, users can change the language seen in PI Coresight by modifying the language settings in their browser. PI Coresight Multilingual User Interface (MUI) support allows users to view the application in eight different languages: French German Spanish Portuguese Simplified Chinese Japanese Korean Russian PI Coresight 2014 Installation and Administration Guide 23

28 PI Coresight installation 24 PI Coresight 2014 Installation and Administration Guide

29 Configure PI Coresight after installation After installation completes, configure PI Coresight by following these steps: 1. Configure PI Coresight application pools to use the PI Coresight service account. See Configure PI Coresight service accounts for more information. If you opted to use the machine account rather than a dedicated domain account, then you can skip this step. 2. Create the PI Coresight database. PI Coresight uses Microsoft SQL Server to store user settings and displays. The database for PI Coresight storage is not created as part of the installation. See PI Coresight database creation. 3. Disable Secure Sockets Layer (SSL), version 2.0 and earlier, on the PI Coresight application server. See Disable SSL Version 2 and earlier. 4. Optionally, configure SSL access. See Configure Secure Sockets Layer (SSL) access. You must use SSL and Basic authentication for most mobile client apps and browsers. If you have configured your SSL site to use Basic authentication and then you upgrade PI Coresight, Basic authentication is disabled and needs to be re-enabled. For more information, see PI Server authentication on mobile devices. 5. Configure access to PI server data. See Configure PI Coresight access to PI Server data. 6. Configure access to PI AF databases. See Configure PI Coresight access to PI AF databases. Configure PI Coresight service accounts If you are using a domain account for the Coresight service account, then you must configure the application pools to use this identity, as described below. If you plan to use the machine account for the PI Coresight service, then you do not need to configure the application pools accounts. Caution: OSIsoft strongly recommends that you create a domain account for the PI Coresight service. If you use the machine account (the default), then all the applications running on the application server computer will have all the access permissions on the SQL, PI, and PI AF servers that the PI Coresight service has. This is a security risk. At a minimum, consider removing some or all of the other applications running on this computer. As described in these steps, you must ensure that the Enable 32-bit Applications setting is set to False. PI Coresight is a 64-bit application and will not work properly in a 32-bit application pool. 1. Run Internet Information Services (IIS) Manager. 2. Under Connections, click Application Pools to display the list of application pools. The list includes the two Coresight application pools: PI Coresight 2014 Installation and Administration Guide 25

30 Configure PI Coresight after installation CoresightAdminAppPool runs the PI Coresight Administration website, located at CoresightServiceAppPool runs the main PI Coresight application services located at 3. Right-click the CoresightAdminAppPool and choose Advanced Settings. The Advanced Settings dialog box opens. 4. Under General, the Enable 32-bit Applications setting should be False. PI Coresight is a 64- bit application and will not work properly in a 32-bit application pool. 5. Under Process Model, click in the Identity field and then click the Browse button. The Application Pool Identity dialog box opens. 6. Click the Custom account radio button and then click Set. The Set Credentials dialog box opens. 7. Enter the user name and password for the Coresight service account. Click OK on this and subsequent dialog boxes. 8. In the application pools list, repeat these steps for the CoresightServiceAppPool application pool. 9. Open the control panel for the service and select PI Indexed Search Crawler. Right-click and select Properties. 10. Select the Log On tab and choose the option This account. Select the Active Directory account that is used as the PI Coresight service account. If a domain account is not being used you can skip this step. PI Coresight database creation To create the PI Coresight database, follow these steps: 1. Configure the Microsoft SQL Server connection. See Configure the Microsoft SQL Server connection. 2. Use one of the following methods to create the PI Coresight database: Use the PI Coresight Administration website, as described in Create the PI Coresight database. This is the easiest way to create the database. Manually create the PI Coresight database on the Microsoft SQL Server as described in Manually create the PI Coresight database. This method is required if the PI Coresight application server is not configured for Kerberos delegation, however if you are working on the PI Coresight server machine itself, Kerberos is not required. Configure the Microsoft SQL Server connection The user logged into the PI Coresight administration site must have access to the Microsoft SQL Server in order to complete this procedure. 26 PI Coresight 2014 Installation and Administration Guide

31 Configure PI Coresight after installation Ensure the SQL Server configuration setting Allow Triggers to Fire Others is set to True. For more information, see Microsoft SQL Server requirements. Follow these steps to configure your connection to a local or remote Microsoft SQL Server. 1. In your web browser, navigate to the PI Coresight Administration website. By default this site is located at: where webserver is the name of the PI Coresight web server. If you access the PI Coresight Administration website from a browser that is running locally on the PI Coresight application server, then you must run the browser as an administrator. To do this, right-click the browser s shortcut icon and select Run as Administrator. 2. Click Configuration in the navigation at left and choose the PI Coresight Database tab. 3. To specify the Microsoft SQL Server instance to host the PI Coresight database, click the dropdown button next to the SQL Server field and select the server you want, or type its name directly in the box, for example,.\sqlexpress. 4. Click Save. Create the PI Coresight database The method shown here is applicable in only the following situations: Kerberos delegation is configured between the PI Coresight application server and the SQL Server computer. The PI Coresight database is located on the same computer as the PI Coresight application server. You are running your browser locally on the same computer as the PI Coresight application server. If your configuration does not meet these conditions, follow the instructions in Manually create the PI Coresight database. Before you start To create the Coresight database, you must have: The db_creator server role ALTER ANY LOGIN permission (meaning you have been granted this permission by use of the statement GRANT ALTER ANY LOGIN TO "domain\account" or you are a member of the securityadmin server role). 1. In your web browser, navigate to the PI Coresight Administration website. By default this site is located at: where webserver is the name of the PI Coresight web server. PI Coresight 2014 Installation and Administration Guide 27

32 Configure PI Coresight after installation If you access the PI Coresight Administration website from a browser that is running locally on the PI Coresight application server, then you must run the browser as an administrator. To do this, right-click the browser s shortcut icon and select Run as Administrator. 2. Click Configuration in the navigation at left and choose the PI Coresight Database tab. 3. Click Save. A green check mark appears next to the Microsoft SQL Server and database names to verify successful configuration. Manually create the PI Coresight database To create the PI Coresight database, you must have the following privileges: Membership of the db_creator server role ALTER ANY LOGIN permission You can be granted this permission by use of the statement GRANT ALTER ANY LOGIN TO "domain\account". If you are a member of the securityadmin server role you already have ALTER ANY LOGIN permission. To upgrade the PI Coresight database, you must have the following minimum database role memberships, or be a member of the db_owner database role. db_datareader db_datawriter db_ddladmin You can use the following steps to create, upgrade and configure a PI Coresight database on a Microsoft SQL Server. 1. On the application server find the SQL directory and copy it. This directory is typically located here: Program Files/PIPC/Coresight/Admin/SQL 2. On the machine running SQL Server, paste the folder and all its contents to a local directory. 3. On the machine running SQL Server, open a command prompt as Administrator, navigate to the local directory used in Step 2, and run the Go.bat script: Go.bat DBServer DBName CoresightService DBServer is the name of the SQL server If DBServer contains any spaces, enclose the string in double quotes. DBName is the name of the PI Coresight database CoresightService is the name of the PI Coresight service account 28 PI Coresight 2014 Installation and Administration Guide