PI Coresight Installation and Administration Guide

Transcription

1 PI Coresight 2014 Installation and Administration Guide

2 OSIsoft, LLC 777 Davis St., Suite 250 San Leandro, CA USA Tel: (01) Fax: (01) Web: PI Coresight 2014 Installation and Administration Guide by OSIsoft, LLC. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, mechanical, photocopying, recording, or otherwise, without the prior written permission of OSIsoft, LLC. OSIsoft, the OSIsoft logo and logotype, PI Analytics, PI ProcessBook, PI DataLink, ProcessPoint, PI Asset Framework (PI AF), IT Monitor, MCN Health Monitor, PI System, PI ActiveView, PI ACE, PI AlarmView, PI BatchView, PI Coresight, PI Data Services, PI Event Frames, PI Manual Logger, PI ProfileView, PI Web API, PI WebParts, ProTRAQ, RLINK, RtAnalytics, RtBaseline, RtPortal, RtPM, RtReports and RtWebParts are all trademarks of OSIsoft, LLC. All other trademarks or trade names used herein are the property of their respective owners. U.S. GOVERNMENT RIGHTS Use, duplication or disclosure by the U.S. Government is subject to restrictions set forth in the OSIsoft, LLC license agreement and as provided in DFARS , DFARS , FAR , FAR , as applicable. OSIsoft, LLC. Version: Published: September 2014

3 Contents PI Coresight architecture and system requirements... 1 PI Coresight architecture... 1 About the PI Coresight web server...2 PI Coresight application pools and service accounts... 2 PI Coresight access groups...3 Software and hardware requirements... 4 Hardware requirements for PI Coresight application server... 4 PI Coresight application server software requirements... 5 Microsoft SQL Server requirements...5 PI System requirements for PI Coresight... 6 PI ProcessBook display version... 6 Client requirements...6 PI Coresight upgrades... 9 Upgrade a PI Coresight installation... 9 Automatic PI Coresight upgrade backups Preparation for a new PI Coresight installation Create a domain user account for PI Coresight...13 Required PI Coresight service account access permissions Prepare the PI Coresight application server computer Server Manager roles and features...15 PI Coresight installation Pre-install checklist for PI Coresight Install PI Coresight...21 Silent installation...23 Multilingual UI available to install Configure PI Coresight after installation...25 Configure PI Coresight service accounts PI Coresight database creation Configure the Microsoft SQL Server connection Create the PI Coresight database Manually create the PI Coresight database Disable SSL Version 2 and earlier...30 Configure Secure Sockets Layer (SSL) access Enable HTTP compression on the PI Coresight application server...30 Configure PI Coresight access to PI Server data Configure PI server access permissions Create the PI identity Grant the PI identity the required access permissions Configure PI server authentication Configure WIS authentication PI Server authentication on mobile devices Configure PI Coresight access to PI AF databases PI Coresight 2014 Installation and Administration Guide iii

4 Contents Configure PI AF authentication and permissions...39 Configure access to a PI AF server...39 Configure access to a PI AF database...40 Configure read access for PI AF objects PI Coresight administration tasks Configure user access to the PI Coresight application Configure Firefox and Chrome browsers for PI Coresight clients...42 Add the PI Coresight application server as a Google Chrome trusted site...42 Add the PI Coresight application server as a Firefox trusted site...43 The PI Coresight Administration website and Administrator users...43 Check PI Coresight status Access to PI and AF data...44 Configure folders for import Update the SQL Server instance and PI Coresight database Update display ownership and reset user settings Generate reports Backup strategy for the PI Coresight database Change the account of the PI Coresight database...50 Reassign a display from the Homepage Time zone and regionalization settings...51 Change time-zone settings Change regionalization settings...54 Uninstall PI Coresight URL parameters for controlling the presentation of displays...55 Creating a new temporary display with particular data items...55 Opening an existing saved display Applying kiosk mode to a display...56 Reuse displays for assets built from the same AF template Specify the element for PI ProcessBook element relative displays Set the time zone for a display...58 Hide the toolbar or timebar Prevent automatic redirection to PI Coresight mobile website High availability options for PI Coresight Appendix A View and configure PI Coresight message logs...65 View the message logs Collect analytic and debug events using Windows Performance Monitor Suppress duplicate messages (message throttling) Technical support and other resources iv PI Coresight 2014 Installation and Administration Guide

5 PI Coresight architecture and system requirements PI Coresight architecture The main components of a PI Coresight installation are: One or more PI servers One or more PI AF databases A PI Coresight application server Microsoft SQL Server, to hold the PI Coresight database Clients Clients where you plan to create or update displays must run Microsoft Silverlight compatible web browsers. PI Coresight 2014 is supported by most modern browsers on a wide variety of computers, including tablets and phones running ios or Android operating systems. OSIsoft recommends that PI Coresight use the same SQL Server that PI AF uses. Otherwise, you can either install a SQL Server on the same computer as the PI Coresight application server or you can use a dedicated SQL Server installation. OSIsoft strongly recommends that the PI Servers and PI AF servers be in the same domain as the PI Coresight application server and Microsoft SQL Server hosting the PI Coresight database. The following diagram illustrates a typical configuration. Here, the PI Coresight database resides on the same MS SQL Server that PI AF uses. In this diagram, the MS SQL Server and the PI AF Server are installed on the same computer, although that is not a requirement. PI Coresight 2014 Installation and Administration Guide 1

6 PI Coresight architecture and system requirements About the PI Coresight web server PI Coresight uses two websites: The administration website: The main application website: Where webserver is the name of the PI Coresight web server. PI Coresight uses the Microsoft Internet Information Services (IIS) web server. PI Coresight application pools and service accounts The PI Coresight installation creates two application pools and two Windows services. The application pools run under Windows service accounts that have appropriate access permissions across the PI System: CoresightAdminAppPool runs the Administration website, located at: webserver/coresight/admin CoresightServiceAppPool runs the main PI Coresight application website, located at The Windows services that the installation program creates are: 2 PI Coresight 2014 Installation and Administration Guide

7 PI Coresight architecture and system requirements PI Web API: a RESTful API to the PI System PI Indexed Search Crawler: crawls PI System data sources to provide metadata to indexed search The PI Indexed Search Crawler requires read access to PIUsers, PIDBSEC, PIMappings and PIPOINT. Note that by default, the PIWorld identity has read access to PIUsers and PIDBSEC, therefore explicit access for these two groups is not required, unless you have disabled PIWorld. The PI Coresight application pools and service accounts run under the PI Coresight service account. This is the account that PI Coresight uses to connect to the PI and PI AF servers. For client users to see PI data, the PI Coresight service account needs appropriate access to these servers. When you install PI Coresight, the installation kit by default sets the service accounts to the machine account of the application server itself and sets the accounts for each service as follows: Service CoresightAdminAppPool CoresightServiceAppPool PI Web API PI Indexed Search Crawler Account NT Authority\Network Service NT Authority\Network Service NT Service\piwebapi Local System The PI Coresight service account in this configuration is the server machine Active Directory account. Typically, this account is named domain\server-name$. For example, MyEnterprise\CoresightServer$. For security reasons, OSIsoft recommends that you instead create a domain account for the PI Coresight services: 1. Change the PI Coresight service account to a dedicated domain account. See Create a domain user account for PI Coresight. 2. Configure the application pools and services to run under this account. See Configure PI Coresight service accounts. Caution: OSIsoft strongly recommends that you create a domain account for the PI Coresight services. If you use the machine account, all the applications running on the application server computer have access permissions on the SQL server, PI server, and PI AF server machines. This is a security risk. At a minimum, consider removing some or all of the other applications running on this computer. PI Coresight access groups Access to the PI Coresight administration website and the PI Coresight website are controlled through separate Microsoft Windows groups. The PI Coresight setup program creates these local user groups on the PI Coresight application server: PI Coresight 2014 Installation and Administration Guide 3

8 PI Coresight architecture and system requirements PI Coresight Admins PI Coresight Users PI Web API Admins For more information, see Configure user access to the PI Coresight application and The PI Coresight Administration website and Administrator users. Software and hardware requirements Hardware requirements for PI Coresight application server Microsoft SQL Server database requirements The following requirements are based on the Microsoft SQL Server residing on the PI Coresight application server. The Microsoft SQL Server database requires approximately 200MB of storage plus 5MB per user (assuming 200 average-sized displays per user). If you plan to import PI ProcessBook displays, allow a minimum of 500KB per display (assuming averagesized displays) on the SQL Server. By default, the database will automatically grow by 200MB each time the current size limit is reached. Index files requirements The index files can be large, especially if you have many PI Servers or complex databases. They are located in your ProgramData folder. As an approximate guideline to estimate the size of the index files: For 1000 PI points, allow about 4MB For 1000 AF elements (assuming 10 attributes each) allow about 14MB Summary of hardware requirements # of Users 1 to to to 500 CPU (Cores) CPU Speed (GHz) Memory (GB) You can estimate the total disk space required in MB using the expression: DiskSpace = *Users *PIPoints *AFElements Where the parameters are: DiskSpace: required disk space (MB) Users: the number of users creating displays PIPoints: the total number of PI points on all allowed servers AFElements: the total number of elements on all allowed AF databases (assumes an average of 10 attributes per element) 4 PI Coresight 2014 Installation and Administration Guide

9 PI Coresight architecture and system requirements If your elements, attributes, and points have many unique descriptions, the index file size can be significantly larger. PI Coresight application server software requirements The requirements for the software on the machine hosting the PI Coresight application server are as listed: Microsoft Windows Server 2008 R2 SP1 64-bit, or later Microsoft Internet Information Services (IIS) 7.5, or later Microsoft.NET Framework 4 Server Manager roles and features. See Preparation for a new PI Coresight installation for details on which roles and features are required for PI Coresight. Microsoft SQL Server requirements PI Coresight requires Microsoft SQL Server 2008 R2 or above. Standard, Enterprise, and Express versions are all supported. OSIsoft recommends that you host your PI Coresight database on the same SQL Server that PI AF uses. Ensure the SQL Server configuration setting Allow Triggers to Fire Others is set to True. To verify this setting: 1. In SQL Server Management Studio, right-click your instance and choose Properties. 2. Select the Advanced page. 3. Allow Triggers to Fire Others is the first setting in the Miscellaneous section. For heavier loads (over 500 users) a full version of SQL Server running on a dedicated server is required. PI Coresight 2014 Installation and Administration Guide 5

10 PI Coresight architecture and system requirements PI System requirements for PI Coresight PI Coresight is supported with the following versions of PI Server and PI AF: PI Server version , and later. PI Asset Framework 2010, and later. PI AF 2010 R2, or later, is recommended. PI ProcessBook display version Starting with PI Coresight 2014, you can configure your application server so that users can view PI ProcessBook displays. PDI and SVG files produced by PI ProcessBook, version 2.35 or later, are automatically imported from the folders you configure. For best results, use PI ProcessBook displays saved using Version or later. This is particularly important for graphics and regional number format support. For more information about importing PI ProcessBook displays, see Configure folders for import. Client requirements PI Coresight 2014 clients need to use web browsers that are compatible with this software. To create or update displays, client machines must have the required version of Microsoft Silverlight installed ( , or later). Silverlight components are supported only in configurations where Silverlight is supported. Note that on Mac OS, Safari and Firefox are the only two browsers supported by Silverlight. To install Microsoft Silverlight, go to the Microsoft installation page at: Supported browsers for PI Coresight PI Coresight 2014 is known to be compatible with the following browsers: On Windows with Microsoft Internet Explorer versions 10 and 11, Mozilla Firefox version 30.0, Google Chrome version 35.0 On Apple Macintosh with Safari version 5.1 On the ipad and iphone with ios version 7 On Android devices with Android version 4.1, 4.2.2, and To use PI Coresight with Google Chrome and Firefox, you must specify the PI Coresight application server as a trusted site. See Configure Firefox and Chrome browsers for PI Coresight clients. 6 PI Coresight 2014 Installation and Administration Guide

11 PI Coresight architecture and system requirements For online Help to open successfully when you click the Help button (?), you might need to disable popup blocking in your browser. Ensure Silverlight is at the required version PI Coresight 2014 requires Microsoft Silverlight Version , or later, based on the Security Update for Microsoft Silverlight ( You will be prompted to upgrade, if you have not already done so. ios devices as clients Support of ios-based devices started with PI Coresight 2012 R2 for the ipad, and with PI Coresight 2013 for the iphone. For PI Coresight 2014, it is recommended that instead of using the native ios apps from the App Store, users navigate to the mobile web site. When a user of a smaller device or browser goes to the application website: they are by default redirected to the PI Coresight mobile web site: (You can override this behavior for specific displays, such as in a dashboard, if required. For more information, see Prevent automatic redirection to PI Coresight mobile website.) PI Coresight 2014 Installation and Administration Guide 7

12 PI Coresight architecture and system requirements 8 PI Coresight 2014 Installation and Administration Guide

13 PI Coresight upgrades When you upgrade to a new version of PI Coresight, your existing settings are carried over to the upgraded PI Coresight installation. This includes settings for allowed PI servers, PI AF databases, and the PI Coresight database. Upgrade a PI Coresight installation Follow the steps in this procedure to upgrade an existing installation of PI Coresight. During installation, you will see setup screens for the following software: 1. PI Web API 2. PI Indexed Search Crawler. The machine hosting the PI Indexed Search Crawler must be a member of a domain. 3. PI Coresight If the computer where you installed PI Coresight is later added to a domain, you must uninstall and reinstall PI Web API and the PI Indexed Search Crawler. If you used a selfsigned certificate, you will need to generate a new certificate when you reinstall. Before you start Caution: New for PI Coresight 2014: You must have a digital certificate to complete installation (the installation program allows you to create and use a self-signed certificate, if required). You must specify your AF server during installation. Minimum AF server and PI Server versions have changed, see PI System requirements for PI Coresight. You need to know the PI Coresight service account name in current use for PI Coresight. For more information on how to retrieve this account, see PI Coresight application pools and service accounts. If you plan to import PI ProcessBook displays, allow extra disk space (approximately 500KB per display). PI mappings are required for all client users to search PI servers and AF servers (a PI trust is not sufficient for search, but can still be used for viewing data). A PI mapping associates a user or group with a PI identity. PI Coresight administrators must be members of the PI Web API Admins group, in order to allow PI Servers and AF databases. See Pre-install checklist for PI Coresight 2014 for more information about install requirements. PI Coresight 2014 Installation and Administration Guide 9

14 PI Coresight upgrades To upgrade the PI Coresight database, the user performing the upgrade (by using the installation program, the administration web site, or the go.bat script) must have the following minimum database role memberships, or be a member of the db_owner database role. db_datareader db_datawriter db_ddladmin 1. Log on to the application server as a System Administrator, using a domain user account that belongs to the local Administrators group. 2. Verify that URL Authorization and Basic Authentication role services are enabled for the web server role, by following these steps: a. Open the Microsoft Server Manager application. b. Expand the Roles section and then expand the Web Server (IIS) section. c. Click Add Role Services. d. Under Security, make sure that the Basic Authentication and URL Authorization check boxes are checked. If they are not checked, check them now. 3. Download the new PI Coresight installation kit from the OSIsoft Technical Support website. 4. Right-click the PI Coresight setup executable and select Run as Administrator to launch the installation wizard. 5. For the PI Web API installation, choose the Custom setup type. 6. When prompted during the PI Web API installation for an account, choose the Active Directory account currently in use by the previous version of the PI Coresight web site application pools. One exception is, if PI Coresight was previously using the Network Service account, choose the option to run PI Web API as NT Service\piwebapi. 7. When prompted during the PI Web API installation for a trusted certificate, either select an existing SSL certificate or choose the option to create a self-signed certificate and then select it. For more information see Configure Secure Sockets Layer (SSL) access. 8. After the upgrade completes, reboot your machine, and then follow the directions in Configure PI Coresight service accounts to ensure all services are running under the correct accounts. 9. If you have Basic authentication enabled, it might be disabled when you upgrade PI Coresight. If you are using mobile devices over SSL, you need to re-enable Basic authentication. For more information, see PI Server authentication on mobile devices. Upgrading the PI Coresight database If Microsoft SQL Server is on the PI Coresight application server computer, the PI Coresight database is upgraded automatically. If SQL Server is on a remote server, you need to manually upgrade the PI Coresight database. 10 PI Coresight 2014 Installation and Administration Guide

15 PI Coresight upgrades There may be cases where you are notified on the PI Coresight administration website that the PI Coresight database needs to be upgraded. If you have the required permissions (described at the beginning of this procedure) you can perform the upgrade at that time. The administration site is located at Admin where webserver is the name of your PI Coresight web server. Automatic PI Coresight upgrade backups When you upgrade PI Coresight, the installation program creates a copy of the PI Coresight database. This backup file is called CoresightDatabase.backup and is located in the default Microsoft SQL Server backup directory. For example: Program Files\Microsoft SQL Server\MSSQL10_50.SQLEXPRESS\MSSQL\Backup If a backup database already exists at this location from a previous PI Coresight upgrade, the installation kit overwrites the older backup file. The installation program also creates copies of upgraded web.config files, which are located in: Program Data\OSIsoft\Coresight\PIDSTemp PI Coresight 2014 Installation and Administration Guide 11

16 PI Coresight upgrades 12 PI Coresight 2014 Installation and Administration Guide

17 Preparation for a new PI Coresight installation To prepare for a new PI Coresight installation, complete the following tasks: Topics in this section Create a domain user account for PI Coresight Prepare the PI Coresight application server computer Create a domain user account for PI Coresight By default, the PI Coresight application services run under the machine account of the application server itself. Instead, OSIsoft recommends that you create a dedicated Windows Active Directory account for the PI Coresight application service. The indexed search crawler service requires accessread access to the PIMAPPING database on the PI Server. 1. On the domain controller, create the account. OSIsoft recommends that you name this account CoresightService. 2. Make a note of the account name and password. After installation, you will configure the PI Coresight application pools and services to run under this new account. For more information, see Configure PI Coresight service accounts. 3. Grant the Coresight Service account all permissions listed in Required PI Coresight service account access permissions. OSIsoft strongly recommends that you create a custom account for the PI Coresight service. If you choose to ignore this recommendation, then you should review the other applications running on the application server computer. All applications running on this computer will have the Coresight access permissions on the SQL, PI, and PI AF servers. For security reasons, consider removing some or all of the other applications running on this computer. Required PI Coresight service account access permissions The service account requires the following access permissions: Login access to the Microsoft SQL Server used by PI Coresight and limited access to the PI Coresight database (access to other databases on this SQL Server is not needed). PI Coresight automatically configures the Microsoft SQL Server login, database, and security settings when you install the PI Coresight database, if you have the appropriate authorization to the Microsoft SQL Server. For the PI Indexed Search Crawler service: Read access to PIUsers, PIDBSEC, PIMappings and PIPOINT. PI Coresight 2014 Installation and Administration Guide 13

18 Preparation for a new PI Coresight installation By default, the PIWorld identity has read access to PIUsers and PIDBSEC, therefore explicit access for these two groups is not required unless you have disabled PIWorld. Read and write privileges to the ProgramData folder, in which the search index files are located. The index files can be large, especially if you have many PI Servers or complex databases. The crawler can access the PI Server with a trust or a mapping, however mappings must exist for each PI Coresight user, so that the index can successfully associate Windows users with the PI Identities that have access to points. PI servers: On each allowed PI server, the PI Coresight service account needs read access to all PI Points that can be accessed by PI Coresight. See Configure PI Coresight access to PI Server data. PI AF servers: The PI Coresight service account needs read access to the PI AF servers and to all allowed PI AF databases on each PI AF server. In addition, the PI Coresight service account needs read access to all PI AF elements and tables that can be accessed by PI Coresight. See Configure PI AF authentication and permissions. Folders configured for import of PI ProcessBook displays: The application pool identity must have permission to access any folder from which you import PDI or SVG files. See Configure folders for import. Prepare the PI Coresight application server computer 1. Open the required ports for the configured PI Coresight website. All required ports must be open for PI Coresight to function properly. Typical required ports Port Used by 80 or 443 PI Coresight web server 5450 PI Server 5457 PI AF Server 2. If you are installing on a web server that hosts multiple sites on the same port, you need to temporarily change the port number before installation: a. In Internet Information Server (IIS) Manager, select the website where you want to install PI Coresight, right-click and select Edit Bindings. b. In Site Bindings, select the first row and click Edit. c. Change the port number to a unique number and click OK. d. After installation, you can change the port number back to the original number. 3. If you are installing on an existing PI WebParts or PI Web Services application server, then you must create a separate website with a unique port number. You cannot install PI 14 PI Coresight 2014 Installation and Administration Guide

19 Coresight under an existing web application. Make a note of this website. During installation, enter it when prompted for the website. 4. Download the required software: OSIsoft Prerequisites kit and the PI Coresight installation kit. You can download these kits from the OSIsoft Tech Support website ( Microsoft SQL Server installation kit (you can skip this step if you plan to use an existing SQL Server installation). The setup kit for SQL Server Express is available for download on the OSIsoft Technical Support website. See Microsoft SQL Server requirements for a list of supported versions. 5. From the Microsoft Server Manager application: Install the Web Server (IIS) role (required) and install the Application Server role (required for Windows Server 2012, optional for Windows Server 2008). Install at least the minimum role services. See Role services for web server and Role services for application server for lists of required and recommended role services. Install the Required server features. 6. Run the OSIsoft Prerequisites installation kit. Preparation for a new PI Coresight installation 7. Install Microsoft SQL Server (if you plan to use an existing SQL Server installation, then skip this step). Server Manager roles and features PI Coresight has the following requirements: Web server (IIS) role with at least the minimum role services listed in Role services for web server. The server features listed in Required server features. OSIsoft recommends, but does not require, that you perform the following configuration steps: For Windows Server 2008 R2, install the Application server role. No non-default role services are required for this role, but consider adding the additional recommended roles listed in Role services for application server. Enable HTTP compression on the PI Coresight application server. See Enable HTTP compression on the PI Coresight application server Role services for web server Windows Server 2008 R2 Windows Server 2012 Common HTTP Features Required: Static Content Default Document HTTP Errors Recommended: All except WebDAV Publishing Required: Static Content Default Document HTTP Errors Recommended: All except WebDAV Publishing PI Coresight 2014 Installation and Administration Guide 15

20 Preparation for a new PI Coresight installation Windows Server 2008 R2 Windows Server 2012 Application Development Health and Diagnostics Security Performance Management Tools Required:.NET Extensibility Recommended: ASP.NET ISAPI Extensions ISAPI Filters Required: None Recommended: HTTP Logging Logging Tools Request monitor Tracing Required: Windows Authentication Request Filtering URL Authorization Basic Authentication Recommended: All Required: All Required: IIS Management Console Recommended: IIS Management Scripts and Tools Management Service Required:.NET Extensibility 3.5.NET Extensibility 4.5 Recommended: ASP.NET 3.5 ASP.NET 4.5 ISAPI Extensions ISAPI Filters Required: None Recommended: HTTP Logging Logging Tools Request monitor Tracing Required: Windows Authentication Request Filtering URL Authorization Basic Authentication Recommended: All Required: All Required: IIS Management Console Recommended: IIS Management Scripts and Tools Management Service Role services for application server The following role services are required or recommended for Application Server. 16 PI Coresight 2014 Installation and Administration Guide

21 Preparation for a new PI Coresight installation Windows Server 2008 R2 Windows Server 2012 Recommended:.NET Framework Windows Process Activation Service Support - HTTP Activation Web Server (IIS) Support Required:.NET Framework 4.5 Windows Process Activation Service Support - HTTP Activation Recommended: Web Server (IIS) Support Required server features Windows Server 2008 R2 Windows Server 2012 Windows Process Activation Service Process Model.NET Environment Configuration APIs Process Model.NET Environment 3.5 Configuration APIs.NET Framework 3.5 Features.NET Framework WCF Activation HTTP Activation.NET Framework 3.5 (including.net 2.0 and 3.0) HTTP Activation Non-HTTP Activation PI Coresight 2014 Installation and Administration Guide 17

22 Preparation for a new PI Coresight installation 18 PI Coresight 2014 Installation and Administration Guide

23 PI Coresight installation OSIsoft recommends the following configuration: For the PI Coresight database, use the same Microsoft SQL Server that PI AF uses The PI Servers and PI AF servers are in the domain where: The PI Coresight application server resides. Microsoft SQL Server hosts the PI Coresight database Caution: New for PI Coresight 2014: You must have a digital certificate to complete installation (the installation program allows you to create and use a self-signed certificate, if required). You must specify your AF server during installation. Minimum AF server and PI Server versions have changed, see PI System requirements for PI Coresight. You need to know the PI Coresight service account name in current use for PI Coresight. For more information on how to retrieve this account, see PI Coresight application pools and service accounts. If you plan to import PI ProcessBook displays, allow extra disk space (approximately 500KB per display). PI mappings are required for all client users to search PI servers and AF servers (a PI trust is not sufficient for search, but can still be used for viewing data). A PI mapping associates a user or group with a PI identity. PI Coresight administrators must be members of the PI Web API Admins group, in order to allow PI Servers and AF databases. Before you start the installation, check the prerequisites shown in Pre-install checklist for PI Coresight Pre-install checklist for PI Coresight 2014 Storage space Recommendation or Requirement Approximately 250MB + 5 MB per user For each imported PI ProcessBook display, allow an extra 500KB For more information Hardware requirements for PI Coresight application server PI Coresight 2014 Installation and Administration Guide 19

24 PI Coresight installation Recommendation or Requirement For more information Domain user account for PI Coresight service To keep your data secure, OSIsoft recommends you create a domain account for the PI Coresight service. After install, you must configure the application pools to use this identity. Create a domain user account for PI Coresight Configure PI Coresight service accounts PI Coresight service account access permissions Software on PI Coresight application server Microsoft SQL Server Login access to the SQL Server used by PI Coresight and limited access to the PI Coresight database Read access to PIUsers, PIDBSEC, PIMappings and PIPOINT. Read and write privileges to the ProgramData folder, in which the search index files are located. The PI Coresight service account can access the PI Server with a trust or a mapping. Important: Mappings must exist for each PI Coresight user to the PI Server. Read access to all PI Points on each allowed PI server Read access to the PI AF servers, allowed PI AF databases, and elements and tables. Read access to any folder configured to import PDI or SVG files. Windows Server 2008 R2 SP1 64- bit, or later IIS 7.5, or later Microsoft.NET Framework, version R2, or later Standard, Enterprise, and Express are all supported. Ensure Allow Triggers to Fire Others is set to True. OSIsoft recommends that you host your PI Coresight database on the same SQL Server that PI AF uses. Required PI Coresight service account access permissions PI Coresight application pools and service accounts Configure folders for import PI Coresight application server software requirements Microsoft SQL Server requirements 20 PI Coresight 2014 Installation and Administration Guide

25 Recommendation or Requirement For more information PI System PI Server version , and later Server Manager roles and features PI Asset Framework 2010, and later The web server (IIS) role must have at least the minimum role services shown in Role services for web server The server features shown in Required server features are also required. PI System requirements for PI Coresight Server Manager roles and features Microsoft Silverlight Version , or later Ensure Silverlight is at the required version Ports on the PI Coresight application server computer 80 or 443: PI Coresight web server 5450: PI Server 5457: PI AF Server Installing user privileges db_creator server role ALTER ANY LOGIN permission Write access to the Configuration database on the default AF server Log on to the application server as a System Administrator, using a domain user account that belongs to the local Administrators group. Prepare the PI Coresight application server computer Install PI Coresight PI Coresight installation SSL digital certificate AF server name During installation, you need to specify a certificate that you have purchased from a certificate authority, or you can create and use a self-signed certificate. During installation, you need to specify the name of the default PI AF server. Install PI Coresight Follow the steps in this procedure to install PI Coresight for the first time. Before you start When you install PI Coresight for the first time, the PI Coresight database is created. Therefore, the user performing the installation (through the installation program, administration web site or by using the go.bat script) must have the following privileges: The db_creator server role. ALTER ANY LOGIN permission. Users can be granted this permission by use of the statement GRANT ALTER ANY LOGIN TO "domain\account". If a user is a member of the securityadmin server role, they already have ALTER ANY LOGIN permission. PI Coresight 2014 Installation and Administration Guide 21

26 PI Coresight installation The installing user also requires write access to the Configuration database on the default AF server. You access the Configuration database by using PI System Explorer. The Configuration database is constructed from information contained within the AF SQL Server database (PIFD). Make sure you have met the prerequisites listed in Pre-install checklist for PI Coresight During installation, you will see setup screens for the following software: 1. PI Web API 2. PI Indexed Search Crawler The machine hosting the PI Indexed Search Crawler must be a member of a domain. 3. PI Coresight If the computer where you installed PI Coresight is later added to a domain, you must uninstall and reinstall PI Web API and the PI Indexed Search Crawler. If you used a selfsigned certificate, you will need to generate a new certificate when you reinstall. 1. Log on to the application server as a System Administrator, using a domain user account that belongs to the local Administrators group. 2. Right-click the PI Coresight setup executable and select Run as Administrator to launch the installation wizard. The installer displays a list of software components that are required by PI Coresight. Some components might already be present on your computer. 3. Review the list of software components and click OK to proceed with the installation. The installation kit installs the required components including PI AF client, PI Web API, and PI SDK. 4. The install kit will prompt you to specify: The name of a PI AF Server. An SSL digital certificate (either a certificate you have purchased from a certificate authority or the installation program allows you to create and use a self-signed certificate). This certificate is used for internal communication between PI Coresight server components, and is not necessarily used for securing client access to the website. For more information about securing the website with SSL, see Configure Secure Sockets Layer (SSL) access. A directory location for PI Coresight. OSIsoft highly recommends that all OSIsoft components are installed in the same root folder. For example, Program Files\PIPC. A website name where PI Coresight will be installed. If you are installing on an existing PI WebParts or PI Web Services application server, enter the website you created when you prepared the application server--see Prepare the PI Coresight application server computer. 5. The install kit prompts you to begin the installation. The installation process creates the following items: The pre-populated Windows groups on the application server: PI Coresight Admins, PI Coresight Users, and PI Web API Admins The PI Coresight Administration website 22 PI Coresight 2014 Installation and Administration Guide

27 PI Coresight installation The PI Coresight website, plus the application pools: CoresightServiceAppPool and CoresightAdminAppPool Two Windows services: PI Web API and PI Index Search Crawler 6. For the PI Web API installation, choose the Custom setup type. 7. When prompted during the PI Web API installation for an account, choose the CoresightService account that was created. 8. When prompted during the PI Web API installation for a trusted certificate, either select an existing SSL certificate or choose the option to create a self-signed certificate and then select it. For more information, see Configure Secure Sockets Layer (SSL) access. 9. Follow the directions in Configure PI Coresight service accounts to ensure all services are running under the correct accounts. 10. After the installation completes, reboot your machine, and then follow the instructions in Configure PI Coresight after installation to finish the configuration. Silent installation To invoke a silent installation, enter the following command: setup.exe -f silent.ini You can customize the silent.ini file to provide a default PI Server configuration, as follows: [COMMANDLINE] 4 = /qn REBOOT=Suppress ALLUSERS=1 PI_SERVER= localhost PI_ALIAS=localhost PI_TYPE=3 PI_PORT=5450 PI_USER=piadmin INSTALLDIR="C:\Program Files\PIPC" Multilingual UI available to install The PI Coresight Multilingual User Interface (MUI) is available for download from the OSIsoft Technical Support website ( After the MUI is installed on the web server, users can change the language seen in PI Coresight by modifying the language settings in their browser. PI Coresight Multilingual User Interface (MUI) support allows users to view the application in eight different languages: French German Spanish Portuguese Simplified Chinese Japanese Korean Russian PI Coresight 2014 Installation and Administration Guide 23

28 PI Coresight installation 24 PI Coresight 2014 Installation and Administration Guide

29 Configure PI Coresight after installation After installation completes, configure PI Coresight by following these steps: 1. Configure PI Coresight application pools to use the PI Coresight service account. See Configure PI Coresight service accounts for more information. If you opted to use the machine account rather than a dedicated domain account, then you can skip this step. 2. Create the PI Coresight database. PI Coresight uses Microsoft SQL Server to store user settings and displays. The database for PI Coresight storage is not created as part of the installation. See PI Coresight database creation. 3. Disable Secure Sockets Layer (SSL), version 2.0 and earlier, on the PI Coresight application server. See Disable SSL Version 2 and earlier. 4. Optionally, configure SSL access. See Configure Secure Sockets Layer (SSL) access. You must use SSL and Basic authentication for most mobile client apps and browsers. If you have configured your SSL site to use Basic authentication and then you upgrade PI Coresight, Basic authentication is disabled and needs to be re-enabled. For more information, see PI Server authentication on mobile devices. 5. Configure access to PI server data. See Configure PI Coresight access to PI Server data. 6. Configure access to PI AF databases. See Configure PI Coresight access to PI AF databases. Configure PI Coresight service accounts If you are using a domain account for the Coresight service account, then you must configure the application pools to use this identity, as described below. If you plan to use the machine account for the PI Coresight service, then you do not need to configure the application pools accounts. Caution: OSIsoft strongly recommends that you create a domain account for the PI Coresight service. If you use the machine account (the default), then all the applications running on the application server computer will have all the access permissions on the SQL, PI, and PI AF servers that the PI Coresight service has. This is a security risk. At a minimum, consider removing some or all of the other applications running on this computer. As described in these steps, you must ensure that the Enable 32-bit Applications setting is set to False. PI Coresight is a 64-bit application and will not work properly in a 32-bit application pool. 1. Run Internet Information Services (IIS) Manager. 2. Under Connections, click Application Pools to display the list of application pools. The list includes the two Coresight application pools: PI Coresight 2014 Installation and Administration Guide 25

30 Configure PI Coresight after installation CoresightAdminAppPool runs the PI Coresight Administration website, located at CoresightServiceAppPool runs the main PI Coresight application services located at 3. Right-click the CoresightAdminAppPool and choose Advanced Settings. The Advanced Settings dialog box opens. 4. Under General, the Enable 32-bit Applications setting should be False. PI Coresight is a 64- bit application and will not work properly in a 32-bit application pool. 5. Under Process Model, click in the Identity field and then click the Browse button. The Application Pool Identity dialog box opens. 6. Click the Custom account radio button and then click Set. The Set Credentials dialog box opens. 7. Enter the user name and password for the Coresight service account. Click OK on this and subsequent dialog boxes. 8. In the application pools list, repeat these steps for the CoresightServiceAppPool application pool. 9. Open the control panel for the service and select PI Indexed Search Crawler. Right-click and select Properties. 10. Select the Log On tab and choose the option This account. Select the Active Directory account that is used as the PI Coresight service account. If a domain account is not being used you can skip this step. PI Coresight database creation To create the PI Coresight database, follow these steps: 1. Configure the Microsoft SQL Server connection. See Configure the Microsoft SQL Server connection. 2. Use one of the following methods to create the PI Coresight database: Use the PI Coresight Administration website, as described in Create the PI Coresight database. This is the easiest way to create the database. Manually create the PI Coresight database on the Microsoft SQL Server as described in Manually create the PI Coresight database. This method is required if the PI Coresight application server is not configured for Kerberos delegation, however if you are working on the PI Coresight server machine itself, Kerberos is not required. Configure the Microsoft SQL Server connection The user logged into the PI Coresight administration site must have access to the Microsoft SQL Server in order to complete this procedure. 26 PI Coresight 2014 Installation and Administration Guide

31 Configure PI Coresight after installation Ensure the SQL Server configuration setting Allow Triggers to Fire Others is set to True. For more information, see Microsoft SQL Server requirements. Follow these steps to configure your connection to a local or remote Microsoft SQL Server. 1. In your web browser, navigate to the PI Coresight Administration website. By default this site is located at: where webserver is the name of the PI Coresight web server. If you access the PI Coresight Administration website from a browser that is running locally on the PI Coresight application server, then you must run the browser as an administrator. To do this, right-click the browser s shortcut icon and select Run as Administrator. 2. Click Configuration in the navigation at left and choose the PI Coresight Database tab. 3. To specify the Microsoft SQL Server instance to host the PI Coresight database, click the dropdown button next to the SQL Server field and select the server you want, or type its name directly in the box, for example,.\sqlexpress. 4. Click Save. Create the PI Coresight database The method shown here is applicable in only the following situations: Kerberos delegation is configured between the PI Coresight application server and the SQL Server computer. The PI Coresight database is located on the same computer as the PI Coresight application server. You are running your browser locally on the same computer as the PI Coresight application server. If your configuration does not meet these conditions, follow the instructions in Manually create the PI Coresight database. Before you start To create the Coresight database, you must have: The db_creator server role ALTER ANY LOGIN permission (meaning you have been granted this permission by use of the statement GRANT ALTER ANY LOGIN TO "domain\account" or you are a member of the securityadmin server role). 1. In your web browser, navigate to the PI Coresight Administration website. By default this site is located at: where webserver is the name of the PI Coresight web server. PI Coresight 2014 Installation and Administration Guide 27

32 Configure PI Coresight after installation If you access the PI Coresight Administration website from a browser that is running locally on the PI Coresight application server, then you must run the browser as an administrator. To do this, right-click the browser s shortcut icon and select Run as Administrator. 2. Click Configuration in the navigation at left and choose the PI Coresight Database tab. 3. Click Save. A green check mark appears next to the Microsoft SQL Server and database names to verify successful configuration. Manually create the PI Coresight database To create the PI Coresight database, you must have the following privileges: Membership of the db_creator server role ALTER ANY LOGIN permission You can be granted this permission by use of the statement GRANT ALTER ANY LOGIN TO "domain\account". If you are a member of the securityadmin server role you already have ALTER ANY LOGIN permission. To upgrade the PI Coresight database, you must have the following minimum database role memberships, or be a member of the db_owner database role. db_datareader db_datawriter db_ddladmin You can use the following steps to create, upgrade and configure a PI Coresight database on a Microsoft SQL Server. 1. On the application server find the SQL directory and copy it. This directory is typically located here: Program Files/PIPC/Coresight/Admin/SQL 2. On the machine running SQL Server, paste the folder and all its contents to a local directory. 3. On the machine running SQL Server, open a command prompt as Administrator, navigate to the local directory used in Step 2, and run the Go.bat script: Go.bat DBServer DBName CoresightService DBServer is the name of the SQL server If DBServer contains any spaces, enclose the string in double quotes. DBName is the name of the PI Coresight database CoresightService is the name of the PI Coresight service account 28 PI Coresight 2014 Installation and Administration Guide

33 Configure PI Coresight after installation You need to format CoresightService according to which type of account you are using: CoresightService account type Domain user Network Service, and the SQL Server is not installed on the PI Coresight application server Network Service, and the SQL Server is installed locally on the PI Coresight application server Format for CoresightService domain\service account name Enter the application server computer domain account. Active Directory computer accounts always end in a dollar sign, for example: "domain\computer name$" "NT AUTHORITY\Network Service" If CoresightService contains any spaces, enclose the string in double quotes. 4. After the command has completed, return to the PI Coresight Configuration page on the PI Coresight Administration website. 5. Click the PI Coresight Configuration tab. 6. Click the change link in the table row for the PI Coresight database. 7. Enter the name of the PI Coresight database you created, or click the ellipsis button to search for it. 8. Click Set. When you have successfully completed the configuration, a green check mark appears in the Status column next to the Microsoft SQL Server and database names. Examples of input parameters for go.bat The following examples demonstrate the use of input parameters with the Go.bat script. Default local instance of SQL Server, custom domain account For the command: Go.bat.\ PICoresight mydomain\coresightaccount The PI Coresight SQL database is named PICoresight The default local instance of SQL Server is used. A custom domain account is used. Specific instance of SQL Server, machine account For the next command: Go.bat sqlserver\sqlinstance PICoresight mydomain\coresightserver$ The PI Coresight SQL database is named PICoresight A particular instance of SQL Server is used. The machine account of the PI Coresight application server is used. Local SQL Express database, services running under default application pool For this command: go.\sqlexpress Coresight "NT AUTHORITY\NETWORK SERVICE" output.log PI Coresight 2014 Installation and Administration Guide 29

34 Configure PI Coresight after installation The PI Coresight SQL database is a SQL Express database named Coresight and is local. The PI Coresight web services run under the default application pool. The output.log keyword causes the results to be captured and stored in the file TEMP \coresightdbupgrade.log (for example, C:\Users\username\AppData\Local \Temp\coresightdbupgrade.log). Disable SSL Version 2 and earlier OSIsoft strongly recommends that you disable support for SSL Version 2.0 and earlier, on the Coresight application server. These versions of SSL represent a security risk. Windows Server 2008 R2 has SSL v2.0 turned off by default but Windows Server 2008 and other versions may have it turned on. For instructions, see the Microsoft article How to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services ( Configure Secure Sockets Layer (SSL) access OSIsoft recommends that you enable SSL for your PI Coresight website; this is required by most mobile clients. For more information see PI Server authentication on mobile devices. To fully secure access to PI Coresight, use a digital certificate obtained from a trusted thirdparty registrar or from your enterprise's private certificate authority. While the installation program can create a self-signed certificate, you should only use that option should if the PI Coresight website will not be secured using SSL. To run PI Coresight from a website that is using SSL, follow these steps. 1. Configure the IIS site that hosts the PI Coresight website to use SSL. For more information, see the Microsoft articles How to implement SSL in IIS ( support.microsoft.com/kb/299875) and SSL Certificate Installation in Microsoft IIS 8 and IIS 8.5 ( 2. Use an editor to open the web.config file located in the Services folder: Program Files/PIPC/Coresight/Services/web.config 3. Change to secure http by replacing httptransport with httpstransport. Enable HTTP compression on the PI Coresight application server HTTP compression allows web servers and web clients to make more efficient use of available bandwidth and can improve transmission speeds. To enable dynamic HTTP compression in Internet Information Services (IIS) on the PI Coresight application server, perform the following steps. 30 PI Coresight 2014 Installation and Administration Guide

35 Configure PI Coresight after installation OSIsoft recommends that you enable compression, but it is not required. If you enable compression, it will affect every web application on the machine, not just PI Coresight. 1. Ensure that both the Static Content Compression and Dynamic Content Compression role services are installed under Web Server\Performance on the application server. See Server Manager roles and features for a full list of all the role services that are required or recommended. 2. Register two MIME types on the application server. To register the MIME types, open an Administrator command prompt and navigate to the folder c:\windows \System32\inetsrv: a. Execute the following two commands: appcmd set config /section:httpcompression /+dynamictypes. [mimetype='application/soap+msbin1', enabled='true'] /commit:apphost appcmd set config /section:httpcompression /+dynamictypes. [mimetype='application/json', enabled='true'] /commit:apphost PI Coresight 2014 Installation and Administration Guide 31

36 Configure PI Coresight after installation If either of these MIME types is already installed on the server, you will receive an error similar to: Cannot add duplicate collection entry of type 'add' with unique key attribute. You can ignore this error. b. Restart IIS by running IISRESET on the application server from the same command prompt. 3. Enable Static and Dynamic Compression in IIS Manager. a. Open Control Panel > Administrative Tools > Internet Information Services (IIS) Manager b. In the left pane, locate the website under which PI Coresight was installed (by default, this is "Default Web Site") and click this entry. c. In the IIS section, double click Compression. d. If they are not already selected, check Enable dynamic content compression and Enable static content compression, and close IIS Manager. 32 PI Coresight 2014 Installation and Administration Guide

37 Configure PI Coresight access to PI Server data To set up PI Coresight access to PI Server data: 1. Configure access permissions for the PI Coresight service account. PI Coresight users should be able to use their existing PI server access permissions. 2. Configure PI Server authentication for the Coresight service account and for PI Coresight users. 3. Finally, use the PI Coresight Administration website to allow PI Coresight users access to each allowed PI Server. See Allow access to each PI server from PI Coresight. Configure PI server access permissions The Coresight service account requires read access to PI point data security and point security on each PI server that is available to PI Coresight users. PI Coresight users need data security and point security for any PI points that they are allowed to view. If these users already have the appropriate access on the PI server, then you do not need to configure access permissions for them. You define PI server access permissions on a PI identity, PI user or PI group. On each PI server that you plan to access through PI Coresight, follow these steps: 1. Create a PI identity for PI Coresight or identify an existing PI identity that has the required access permissions. Since read access to each PI point is required, it is easiest to use an existing PI identity that already has that access. See Create the PI identity. 2. If you created a new PI identity for PI Coresight, then you need to grant the PI identity read access to the PI points. See Grant the PI identity the required access permissions. 3. Finally, set up authentication. The procedure depends on your configuration. See Configure PI server authentication. Create the PI identity 1. Run the PI System Management Tools application. 2. Under Collectives and Servers, select a server. 3. Under System Management Tools, select Security > Identities, Users, & Groups. 4. Select the PI Identities tab. 5. Click the New Identity button to open the New Identity dialog box. 6. In Identity, type a name for the new identity. This is the only field that is required when you create a new identity. Note the following restrictions on identity names: PI Coresight 2014 Installation and Administration Guide 33

38 Configure PI Coresight access to PI Server data The name must be unique. The name cannot include the vertical pipe ( ) character or the colon (:) character. The name cannot be a positive integer, although it can contain numbers. For example, the name "407" is not valid, but the name "Admins407" is valid. The name is not case sensitive. If you try to create an identity with an invalid name, an error message appears and the identity is not created. Note that you can change an identity name any time after creation. 7. Select the appropriate server from the drop-down Server list. This list is populated from the selected servers under Collectives and Servers. Only version and later PI Servers appear in the list. Earlier versions of the PI Server do not support PI identities. 8. Optionally, enter a brief description in Description. There are no restrictions on the contents of this field. 9. At the bottom of the dialog box, select the Identity cannot be deleted check box. This prevents the identity from being accidentally deleted. To delete this identity, you must first edit the identity and clear this check box. 10. Click Create. The new PI identity now appears in the PI Identities tab. Grant the PI identity the required access permissions To grant the PI identity read access to the PI points on a PI server, you need to grant to the identity: Read access on the PIPOINT and PIMAPPINGS database tables. Use the Database security tool in PI SMT (Security > Database Security). Read access to the point data for each PI point. The simplest method is to use Tag Configurator to edit the points in bulk. Alternatively, you can use PI SMT to edit point security on each point. If the indexed search service is running under a different account than the PI Coresight service, that account also needs these access permissions. Configure PI server authentication Configure PI server authentication for PI Coresight through Windows Integrated Security (WIS). Important: OSIsoft does not recommend that you use a PI trust to configure authentication. If you use a PI trust, you will not be able to search for data. To use WIS authentication, the following criteria must apply: 1. WIS requires Kerberos delegation. Kerberos delegation enables users in a distributed application environment to access remote data sources through Windows authentication. See Enable Kerberos delegation. 2. WIS requires that you use PI mappings to authenticate users on the PI server. If you are not already using PI mappings to authenticate PI server users, then you need to set up the 34 PI Coresight 2014 Installation and Administration Guide

39 Configure PI Coresight access to PI Server data requisite mappings in order to use WIS. The PI Server Security Configuration Guide explains how to do this. Caution: If you support PI Coresight users on the PI Coresight iphone or ipad apps or on mobile browsers and you use WIS to authenticate PI Server users, then you need to configure SSL and Basic authentication. Follow the instructions in PI Server authentication on mobile devices. Configure WIS authentication Follow these steps: 1. Enable Kerberos delegation. 2. Create a PI mapping for the PI Coresight service account identity. 3. If PI mappings for the PI Coresight users do not exist, you need to create them. See the Configuring PI Server Security Guide for guidance. Enable Kerberos delegation To enable PI Coresight to connect using Windows Integrated Security, configure Kerberos delegation for the PI Coresight application server. If you are using a Custom Host name instead of a NetBIOS name, refer to the Microsoft archives for information about: SPN checklist for Kerberos authentication with IIS 7.0/7.5 ( If you are accessing the web server with a NetBIOS name, such as Coresight, follow these steps: 1. On your domain controller, open Active Directory Users and Computers. 2. Select Computers under the domain of the PI Coresight application server. 3. Right-click the PI Coresight application server and click Properties. 4. Specify a trust setting for the computer. For a Windows Server 2003 or 2008 domain controller: on the Delegation tab, select one of the following two options: Trust this computer for delegation to any service (Kerberos only) Trust this computer for delegation to specified services only When delegating to specified services, you must click Add, Users or Computers and specify the name of the PI Server. Then locate the PIServer/server-name SPN and select it as the service to which to allow delegation. PI Coresight 2014 Installation and Administration Guide 35

40 Configure PI Coresight access to PI Server data After you finish In some Active Directory environments, you also need to disable kernel-mode authentication and create service principal names (SPNs), as described in Optionally disable Kernel-mode authentication Optionally disable Kernel-mode authentication In some situations, you might need to disable kernel-mode authentication: If you require access to websites or services that are not hosted in IIS, which are installed on the PI Coresight server. For example, the PI Web API website. If you want to restrict delegation to the PI Coresight service account, rather than to the server machine account in Active Directory. To disable kernel-mode authentication, use Internet Information Server (IIS) Manager to configure the security settings for the PI Coresight web application. 1. In Internet Information Services (IIS) Manager, select the PI Coresight web application and double-click the Authentication icon under the features view. 2. Select Windows Authentication and click the Advanced Settings link in the right pane. 3. Uncheck Enable Kernel-mode authentication. 4. If you are running PI Coresight under a custom domain account, open an Administrator command prompt with domain administrative rights and create two Active Directory Service Principal Names (SPNs). One SPN is for the netbios name and one for the fully-qualified DNS name of the PI Coresight application server: setspn -S http/netbios-server-name domain\service-account setspn -S http/fully-qualified-dns-name domain\service-account 5. Specify a trust setting for the service account. For a Windows Server 2003 or 2008 domain controller: on the Delegation tab, select one of the following two options: Trust this computer for delegation to any service (Kerberos only) Trust this computer for delegation to specified services only When delegating to specified services, you must click Add, Users or Computers and specify the name of the PI Server. Then locate the PIServer/server-name SPN and select it as the service to which to allow delegation. Examples setspn -S http/myserver mydomain\coresightservice setspn -S http/myserver.mydomain.int mydomain\coresightservice Create PI mappings You need PI mappings for the PI Coresight service account and for PI Coresight users. If your PI Coresight users are existing PI server users, then you can use their existing mappings. Otherwise, you need to create them. See the Configuring PI Server Security Guide for tips. 36 PI Coresight 2014 Installation and Administration Guide

41 Configure PI Coresight access to PI Server data To create a mapping: 1. Open PI SMT. 2. Under Collectives and Servers, select the server. 3. Under System Management Tools, select Security > Identities, Users, & Groups. 4. Select the identity, user, or group that you want to map. 5. In the toolbar, click the properties button. The Properties dialog box opens. 6. In the Properties dialog box, click the Mappings and Trusts tab. The top portion of the dialog box shows all existing mappings for this PI identity, user, or group. The bottom portion shows all existing PI trusts. 7. Click the Add button under the mappings portion of the dialog box. The Add New Mapping dialog box opens. The Add button is disabled if the selected PI identity is flagged as disabled or not usable in a mapping. 8. Enter the Windows account. This can be an AD principal or a local Windows group or user. To select the account either: Click the browse button to browse for the account. Type in the account name. If you choose to type in the account name, click the resolve SID button to verify that this is a valid account. If the account is valid, an SID appears in the field. Otherwise, a dialog box with an error message opens. After you finish If you have difficulty creating the mapping, click the Help button in PI SMT. PI Server authentication on mobile devices OSIsoft recommends that you use Basic authentication with SSL encryption for mobile device users. This enables all supported mobile apps and browsers to authenticate to the PI Coresight server successfully. Some devices can also support Kerberos authentication. You can use NTLM rather than Basic authentication if the PI Coresight application server and the PI Server are installed on the same server machine. Kerberos authentication in mobile Safari for iphones and ipads Starting with ios 7, you can configure the mobile Safari browser to access the PI Coresight mobile website on iphones and ipads and use Kerberos authentication through the enterprise single sign on (SSO) feature. (This information does not apply to using the native ios PI Coresight apps.) PI Coresight 2014 Installation and Administration Guide 37

42 Configure PI Coresight access to PI Server data You must configure allowed websites through Apple enterprise management tools and they can be pushed to devices in various ways. For more information, see Apple's webpages about ios 7 and business ( Basic authentication With Basic authentication, user credentials are passed to the PI System. You should use the Basic authentication method if you use mappings on the PI Server to provide user specific security. However, Basic authentication sends the user credentials to the web server in plain text, so you must also configure the PI Coresight website to use Secure Sockets Layer (SSL). For more information, see Configure Secure Sockets Layer (SSL) access. Use Internet Information Server (IIS) Manager to configure the security settings for the PI Coresight web application: 1. Select the PI Coresight web application and double-click the Authentication icon under the features view. 2. Select Basic Authentication and click the Enable link in the right pane. 3. Select Windows Authentication. 4. Click the Providers link from the right pane. 5. Delete NTLM from the window that opens. 38 PI Coresight 2014 Installation and Administration Guide

43 Configure PI Coresight access to PI AF databases PI Coresight users can search PI AF data without having to specify or manually connect to a PI AF database. To enable this feature, you need to configure PI Coresight access to the relevant PI AF databases. Before you configure database access, make sure that you have the correct access permissions. Configure PI AF authentication and access permissions. Use the PI Coresight Administration website to grant PI Coresight users access to PI AF databases. If users have trouble seeing PI AF data, check the access permissions. Configure PI AF authentication and permissions PI AF uses Windows security. If you have a Windows group (domain, not local) that currently has the required access permissions, then you can just add the Coresight service account to that group. Otherwise, you will need to manually grant the required access. Configure read access for the PI Coresight service account for the following: Each AF server that you want to access through PI Coresight. See Configure access to a PI AF server. Each AF database that you want to access through PI Coresight. See Configure access to a PI AF database. All the PI AF elements, event frames and tables that you want to access through PI Coresight. See Configure read access for PI AF objects. Individual PI Coresight users access the PI AF server data through their own Windows accounts. If existing PI AF users get PI AF access through their domain accounts, then you do not need to configure access for these users. If users get PI AF access through a local group or account on the PI AF server, then they will not be able to see AF objects in PI Coresight. If you cannot switch to a domain account, you can use the following workaround. You can create the same local group on the PI Coresight application server with the same name and the same members. As long as these two groups are completely identical, the users should have the correct access to PI AF through PI Coresight. Configure access to a PI AF server 1. Open PI System Explorer. 2. Choose File > Connections. The Servers dialog box opens and lists all PI servers and PI AF servers for which a connection is configured. The currently connected PI server and PI AF server are indicated with green circles. PI Coresight 2014 Installation and Administration Guide 39

44 Configure PI Coresight access to PI AF databases 3. If the currently connected PI AF server is the server to which you want to configure access, skip this step. Otherwise, right-click on the name of the server you want to configure in the list and choose Connect. 4. Right-click the connected PI AF server and choose Security > Server. The Permissions dialog box for that server opens. 5. Click Add. The Select Users or Groups dialog box opens. 6. Enter the Coresight service account name and click OK. The Coresight service account name appears in the Group or user names field. 7. In the Permissions field, check the Read check box in the Allow column. 8. Click OK. Configure access to a PI AF database 1. Open PI System Explorer. 2. Choose File > Connections. The Servers dialog box opens and lists all the PI servers and PI AF servers for which a connection is configured. The currently connected PI and PI AF servers are indicated with green circles. 3. If the currently connected PI AF server is the server to which you want to configure access, skip this step. Otherwise, right-click on the name of the server you want to configure in the list and choose Connect. 4. Right-click the connected PI AF server and choose Security > Databases. The Permissions dialog box for that server opens. 5. Click Add. The Select Users or Groups dialog box opens. 6. Enter the Coresight service account name and click OK. The Coresight service account name appears in the Group or user names field. 7. In the Permissions field, check the Read check box in the Allow column. 8. Click OK. Configure read access for PI AF objects The PI Coresight service account needs read access to each AF element, table, and event frame that you want to access through PI Coresight. You can set access permissions for AF objects in PI System Explorer or in PI AF Builder. PI AF Builder is a Microsoft Excel plug-in that allows you to edit PI AF objects in bulk. If you need to edit the security settings for many objects, then PI AF Builder is the best choice. In PI AF, library objects are always readable regardless of their security settings. This means you do not need to grant read access for the following AF objects: categories, templates, enumeration sets, reference types, and UOMs. 40 PI Coresight 2014 Installation and Administration Guide

45 PI Coresight administration tasks This section explains how to perform various PI Coresight administration tasks. Set up user access Configure user access to the PI Coresight application Configure Firefox and Chrome browsers for PI Coresight clients Check the health of your PI Coresight installation You can use the PI Coresight Administration website Overview page to check the health of your PI Coresight installation: Check PI Coresight status Manage access to data, ownership, and reports You can use the Administration website to control access to your data, manage ownership of objects, and generate reports: Allow access to each PI server from PI Coresight Add a PI server to the registered PI servers list Configure PI AF database connections Add an AF server to the list of registered AF servers Reassign display ownership Reset user settings Generate reports Manage access to PI ProcessBook displays Starting with PI Coresight 2014, you can configure your application server to enable PI Coresight users to view PI ProcessBook displays. Use the Administration web site to specify which folders you want PI Coresight to monitor for PI ProcessBook displays: Configure folders for import Update the PI Coresight database Update the SQL Server instance and PI Coresight database Change the account of the PI Coresight database Adjust time zone and regionalization settings Change time-zone settings Change regionalization settings PI Coresight 2014 Installation and Administration Guide 41

46 PI Coresight administration tasks Uninstall Uninstall PI Coresight Configure user access to the PI Coresight application The PI Coresight Users group controls access to the PI Coresight application. It is a local Microsoft Windows user group on the PI Coresight application server. To grant a user access to the PI Coresight application, add the user account to this group. To revoke access, remove the user account from this group. By default the PI Coresight Users group includes Authenticated Users as a member. With this configuration, anyone who can access the application server can also access PI Coresight. To limit access to PI Coresight, first remove Authenticated Users from the group, and then add authorized users. To open the PI Coresight application, in a supported browser, users navigate to: webserver/coresight/ where webserver is the name of your PI Coresight web server that you specified during installation. Configure Firefox and Chrome browsers for PI Coresight clients To use the Firefox or Google Chrome browsers for PI Coresight clients, you must first add the PI Coresight application server as a trusted site. For a list of supported browsers, see Supported browsers for PI Coresight. Add the PI Coresight application server as a Google Chrome trusted site This procedure describes how to add a server to the whitelist of Chrome trusted sites by editing the Windows registry. You can also add entries to the whitelist using the command line (--auth-negotiatedelegate-whitelist) or via Windows Group Policies. 1. To configure Chrome s trusted sites by editing the registry, create the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome 2. Under this key create a string (REG_SZ) value named AuthNegotiateDelegateWhitelist. 3. Set this value to the name/url of the PI Coresight application server. 4. For more information see the article on Chrome policy templates ( support.google.com/a/bin/answer.py?hl=en&answer=187202) ( support.google.com/a/bin/answer.py?hl=en&answer=187202). 42 PI Coresight 2014 Installation and Administration Guide

47 PI Coresight administration tasks Add the PI Coresight application server as a Firefox trusted site 1. Open Firefox and type about:config into the address bar. Confirm any warning dialogs that may appear. 2. Enter auth in the Search field to filter the list. 3. Locate these two preference fields: network.negotiate-auth.trusted-uris network.negotiate-auth.delegation-uris 4. Double-click each field and enter the name/url of the PI Coresight application server. The PI Coresight Administration website and Administrator users The PI Coresight Administration website provides a graphical user interface for PI Coresight administration tasks. The Overview page shows you a snapshot of your current PI Coresight installation. To access the site, browse to: where webserver is the name of your PI Coresight web server. To grant a user access to the PI Coresight Administration website, add their user account to the PI Coresight Admins group and to the PI Web API Admins group. These are local Microsoft Windows user groups on the PI Coresight application server. By default, only the user who runs the installation is added to these groups. In addition to having access to the PI Coresight Administration website, users in the PI Coresight Admins group can perform restricted tasks in the main PI Coresight application, such as reassigning individual displays to another user. If you are running a browser locally on the PI Coresight application server, it must be run by an administrator for any changes to take effect. To set your browser to run as administrator, right-click the browser's shortcut icon and select Run as administrator. Check PI Coresight status Use the PI Coresight Administration website to check the status of your PI Coresight installation and make configuration updates. The Overview page shows you a current snapshot of the following information: PI Coresight Database shows the SQL Server instance and the PI Coresight database. The Status column displays a green checkmark if the PI Coresight application server can connect to the PI Coresight database running on SQL Server. PI Servers Allowed PI servers that are used by PI Coresight for searching and retrieving data. Additionally, the current user of the PI Coresight Administration website as well as the application pool identity are shown for each allowed PI Server. PI Coresight 2014 Installation and Administration Guide 43

48 PI Coresight administration tasks The Status column shows a green checkmark if the application pool account can connect to the PI Server. The Indexed column shows a green checkmark if the indexed search service can successfully crawl the PI Server. PI AF Servers/Databases Allowed AF Servers and corresponding databases that are used by PI Coresight for searching and retrieving data. The Status column shows a green checkmark if the application pool account can connect to the PI AF database. The Indexed column shows a green checkmark if the indexed search service can successfully crawl the PI AF database. Indexed Search Service Status shows the URL of the service for indexed search. The Status column shows a green checkmark if the PI Coresight application server can successfully communicate with this service. When you first install PI Coresight 2014, your allowed PI servers and AF databases are crawled to find metadata to build indexes to improve the performance of commonly used queries. If you have large databases, initial crawling will take longer than if your databases are smaller. To maintain these indexes as your data changes over time, the indexed search service periodically runs the crawlers to gather updated metadata. File Version Status indicates whether all file versions meet minimum requirements. To make configuration updates, click Manage Configuration next to the appropriate list. Alternatively, you can use the navigation tabs at left. For example, to make a PI Server available to your users' searches, you need to change its status to Allowed. Therefore, click Manage Configuration next to PI Servers Allowed and at the Configuration page that opens you can add or remove access to any PI Server that is available on the PI Coresight application server. The Version Information link at top right opens a list showing the versions of all software components that are installed to run PI Coresight. The Connection Status column indicates whether a file exists and meets the minimum version requirements. Access to PI and AF data Allow access to each PI server from PI Coresight Add a PI server to the registered PI servers list Configure PI AF database connections Add an AF server to the list of registered AF servers Allow access to each PI server from PI Coresight Use the PI Coresight Administration website to allow access to each PI server that your users are working with: 1. On the Overview page, click Manage Configuration next to the PI Servers Allowed list. Or click Configuration in the navigation tree at left and then choose the PI Servers tab. 2. To add a PI Server for use, click Allow next to that server. 44 PI Coresight 2014 Installation and Administration Guide

49 If the PI Server that you are looking for is not in the list, see Add a PI server to the registered PI servers list. The Test Connection button tests whether you can connect to the appropriate PI Server using the CoresightService account. This is the identity used by the PI Coresight application pools. 3. After you finish making changes, click Save to update the PI Coresight application server with your selections. Add a PI server to the registered PI servers list Configure a connection from the PI Coresight application server to each PI server that you plan to use with PI Coresight: 1. On the application server, open the PI SDK utility. The PI SDK utility is installed as part of the PI Coresight installation. 2. Choose File > Connections. The PI Connection Manager dialog box opens 3. Choose Server > Add PI Server. The Add PI Server dialog box opens. 4. Configure the connection. Connection parameters include: Network Path/FQDN The DNS name of the computer where the PI Server resides. If the node cannot be resolved automatically, you can also enter the fully qualified domain name (for example, MyServer.MyDomain.com, instead of MyServer) Confirm Select Confirm to verify the connection to the new server. If the initial connection fails, the Add Server dialog box remains open to allow you to try the connection again with correct server information. Make sure to clear this option if you know a server does not yet exist, or is unreachable at the moment. Connection Type Displays the PI Server version, which indicates a certain level of available functionality. PI systems on OpenVMS use PI2 connections, and PI systems on Windows or UNIX use PI3 connections. Port Number The TCP/IP port number for the server machine. PI systems on OpenVMS use port 545, and PI systems on Windows or UNIX use port Configure PI AF database connections PI Coresight administration tasks 1. On the Overview page, click Manage Configuration next to the PI AF Servers/Databases Allowed list. Or click Configuration in the navigation tree at left and choose the PI AF Servers tab. PI Coresight 2014 Installation and Administration Guide 45

50 PI Coresight administration tasks The PI AF Servers and Databases page appears. This page presents the AF Servers recognized by PI Coresight. To add an AF server to the list, see Add an AF server to the list of registered AF servers. 2. If an AF Server has a triangle symbol beside it, you can expand it to see a list of AF databases on that server in the Databases column: a. To verify the connection to an AF Server, click Test Connection in the Connection Status column. b. To allow access to all databases, select All. Alternatively, to enable access to a subset of the databases, select the checkboxes of only those databases to which you want to allow access. 3. If an AF Server does not have a triangle symbol beside it, click Test Connection to initiate a connection to that server. If the connection is successful, you can then see the databases that reside on that server. 4. After you have finished making changes, click Save to update the PI Coresight application server with your selections. Add an AF server to the list of registered AF servers If the list of registered PI AF servers and databases does not include the AF server that you want, follow these steps: 1. Run PI System Explorer locally on the PI Coresight application server. PI System Explorer is installed as part of the PI Coresight installation. 2. Choose File > Connections. The Servers dialog box opens. This dialog box lists all the PI servers and PI AF servers for which a connection is configured. The currently connected PI and PI AF servers are indicated with green circles. 3. Right-click the AF server that you want to add to the list of registered servers and choose Connect. If the server you need is not displayed, refer to the PI System Explorer help for instructions (you can access the help by clicking Help > Help Topics). Configure folders for import Starting with PI Coresight 2014, you can configure your application server so users can view PI ProcessBook displays. Use the Administration website to specify which folders you want PI Coresight to monitor for PI ProcessBook displays. When the monitoring service detects a new, modified, or deleted PI ProcessBook file in these folders, it automatically adds, updates, or deletes it from PI Coresight. All PDI and SVG files in the specified folders and any subfolders are automatically imported into the PI Coresight application server. 46 PI Coresight 2014 Installation and Administration Guide

51 PI Coresight administration tasks Caution: To keep your data secure, OSIsoft recommends you implement the following measures: Restrict network access to the import folders to only those users and groups who require it. You can authorize users and groups by using the security settings of the Windows operating system for folders and shared volumes. Enable Windows Security Auditing to track who adds, deletes, or modifies the files in the import folders. For more information see: Apply or Modify Auditing Policy Settings for a Local File or Folder ( cc aspx). PI Coresight never modifies the contents of an imported folder. 1. On the Overview page, click Import Folder Management. 2. To add a new folder, enter the path in the Folder column. You can optionally also enter an alias for the folder in the Friendly Name field. Then click Add. The Folder Accessible field indicates whether the folder is accessible by the monitoring service. After you add a folder, the Folder Accessible status shows a question mark until you refresh the PI Coresight administration page. If the path to the new folder is accessible and no errors occur, it shows a green check mark. A red X indicates that there is a problem with the file-monitoring process accessing the specified folder. To determine the cause, investigate errors in the PISymbols Admin event log. In general, file monitoring errors are due to an invalid path, or the CoresightServiceAppPool application pool account might have insufficient privilege to access the import folder hierarchy. It can take a few minutes for the folder monitoring process to start importing files, because the process searches for all files to import before starting the actual import process. The folder is accessed using the identity of the CoresightServiceAppPool application pool. 3. (Optional) Click Show Status to see information about any errors that occurred during import. 4. (Optional) To modify a friendly name, enter your changes in the Friendly Name field and click Apply. 5. (Optional) If you no longer want to import PI ProcessBook displays from a folder, click the Remove button. All files from that folder will be removed from the PI Coresight application server; the actual PI ProcessBook files are not touched. After you delete import folders, reindex the PI Coresight SQL Server database and update its statistics. PI Coresight 2014 Installation and Administration Guide 47

52 PI Coresight administration tasks Update the SQL Server instance and PI Coresight database If you access the PI Coresight Administration website from a browser that is running locally on the PI Coresight application server, then you must run the browser as an administrator. To do this, right-click the browser s shortcut icon and select Run as Administrator. Before you start The currently logged-in Windows user must have administrator access to the Microsoft SQL Server in order to complete this procedure. The method shown here is applicable in only the following situations: Kerberos delegation is configured. The PI Coresight database is located on the PI Coresight application server. If the currently logged-in Windows user is running the PI Coresight administration page in their browser while logged onto the web server. If your configuration does not meet these conditions, follow the instructions in Manually create the PI Coresight database. 1. On the Overview page, click Manage Configuration next to the PI Coresight Database table. Or click Configuration in the navigation tree at left and then choose the PI Coresight Database tab. 2. To change the Microsoft SQL Server instance that hosts the PI Coresight database, click the dropdown button next to the SQL Server field and select the server you want, or type its name directly in the box, for example,.\sqlexpress. 3. Enter the name of the PI Coresight database you want to use in the Database field, or click the dropdown button to choose an existing database. After you select a database, PI Coresight verifies whether it can be used as is, or if an upgrade is necessary. If you enter a new database name, and the user running the Administration website has sufficient permissions to create a database on the Microsoft SQL Server, a new database of that name is created. To create a new Coresight database, you must have: The db_creator server role ALTER ANY LOGIN permission (meaning you have been granted this permission by use of the statement GRANT ALTER ANY LOGIN TO "domain\account" or you are a member of the securityadmin server role. ) PI Coresight connects to the specified database. 4. Click Save. 48 PI Coresight 2014 Installation and Administration Guide

53 PI Coresight administration tasks Update display ownership and reset user settings Reassign display ownership Reset user settings Reassign display ownership To reassign ownership of all the displays from one user to another, follow this procedure. 1. Click Display Management in the navigation tree at left. 2. In the From field, select the user name for which you want to reassign display ownership. 3. In the To field, select the user name of the new owner. 4. Check the box I understand this operation cannot be undone. 5. Click Reassign Displays. At the Homepage of the PI Coresight application, administrators can reassign any public display from one user to another. Click the Edit display settings icon and select another username in the Display Owner field. This field is populated with users who have accessed a display. Reset user settings PI Coresight users can save preferences for certain ways of viewing and handling information, for example, the configuration for viewing tables. Other information is recorded automatically, such as the last page viewed. If necessary, the administrator can clear all settings for a user and set them back to default values. 1. Click User Settings in the navigation tree at left. 2. Choose the user in the drop-down box. 3. Click Clear Settings. Generate reports PI Coresight administrators can view or export reports about usage of PI Coresight, such as reports that show detailed information about the contents of the displays in your database. 1. Click Reports in the navigation tree at left. 2. If appropriate, select a time range for your report. 3. Click View or Export: PI Coresight 2014 Installation and Administration Guide 49

54 PI Coresight administration tasks View shows the report in your browser. Export saves the report information to a.csv file. Backup strategy for the PI Coresight database To develop your strategy, see the Microsoft documentation about SQL Server backups ( msdn.microsoft.com/en-us/library/ms aspx). Your strategy should be tailored to your environment, but ideally you need to backup your PI Coresight SQL Server database every day. Standard maintenance best practices include: Backups of logs Daily data backups Periodic re-index and update statistics on all databases, and always after importing displays, deleting import folders, or deleting many displays Use Microsoft SQL Server Management Studio or the sqlcmd command utility. OSIsoft recommends that you change your database from the simple recovery model to the full recovery model to allow point-in-time recovery. The installation kit configures the database with a simple recovery model by default. With this simple recovery model, transaction logs cannot be backed up and point-of-failure recovery is not possible. If you set the database to the full recovery model, the transaction logs are also backed up. The transaction logs are truncated so they do not grow without bounds and either point-in-time or point-of-failure recovery is allowed. Consider these further points as you design your backup strategy: Place the backup file on a different physical disk from where the SQL Server data is located. You might not be able to write to the root folder of the C:\ drive. Use another drive, such as a network drive, or a subfolder. Frequency of backup depends on your application; nightly backups are usually best. You can set the timing and frequency of backups and whether full or differential backups are done. Daily, full backup is recommended. SQL Express 2008 does not include a job scheduler, so you need to use a Windows utility to schedule the backup. You can use the following command to run the backup: sqlcmd -S SQLINSTANCE -d PI Coresight database -Q "EXEC = = 1;" -E You need the sysadmin, db_owner, or db_backupoperator role (the least privilege is the best security practice). Change the account of the PI Coresight database If the PI Coresight Application Pool ID is changed after the PI Coresight database has been created, then you need to modify the account used to access the PI Coresight database. Run the following SQL commands: ALTER USER "DVService" with LOGIN="<domain>\<Application Pool ID>" 50 PI Coresight 2014 Installation and Administration Guide

55 PI Coresight administration tasks ALTER USER "<domain>\<application Pool ID>" with NAME="DVService" Reassign a display from the Homepage At the Homepage of the PI Coresight application ( administrators can reassign any public display from one user to another. Click the Edit display settings icon and select another username in the Display Owner field. This field is populated with users who have accessed a display. To reassign ownership of all the displays from one user to another, see Reassign display ownership. Time zone and regionalization settings Change time-zone settings Change regionalization settings Change time-zone settings By default, PI Coresight uses the time zone of the client machine to display information. To override the client time zone and set every user browsing to the PI Coresight website to use the same time zone, follow this procedure. 1. Use an editor to open the web.config file located in the PI Coresight root installation folder. 2. Add the following line to the web.config file: <appsettings> <add key="pisymbols_systemtimezoneid" value="yourtimezoneid"/> where YourTimeZoneID is one of the time zone IDs listed in System time zone IDs. For example, to set the PI Coresight time zone to Pacific Standard Time for all users, you would add the following line to the web.config file: <appsettings> <add key="pisymbols_systemtimezoneid" value="pacific Standard Time"/> System time zone IDs System Timezone ID Dateline Standard Time UTC-11 Samoa Standard Time Hawaiian Standard Time Alaskan Standard Time Pacific Standard Time (Mexico) Display Name (GMT-12:00) International Date Line West (GMT-11:00) Coordinated Universal Time-11 (GMT-11:00) Samoa (GMT-10:00) Hawaii (GMT-09:00) Alaska (GMT-08:00) Baja California PI Coresight 2014 Installation and Administration Guide 51

56 PI Coresight administration tasks System Timezone ID Pacific Standard Time US Mountain Standard Time Mountain Standard Time (Mexico) Mountain Standard Time Central America Standard Time Central Standard Time Central Standard Time (Mexico) Canada Central Standard Time SA Pacific Standard Time Eastern Standard Time US Eastern Standard Time Venezuela Standard Time Paraguay Standard Time Atlantic Standard Time Central Brazilian Standard Time SA Western Standard Time Pacific SA Standard Time Newfoundland Standard Time Display Name (GMT-08:00) Pacific Time (US & Canada) (GMT-07:00) Arizona (GMT-07:00) Chihuahua, La Paz, Mazatlan (GMT-07:00) Mountain Time (US & Canada) (GMT-06:00) Central America (GMT-06:00) Central Time (US & Canada) (GMT-06:00) Guadalajara, Mexico City, Monterrey (GMT-06:00) Saskatchewan (GMT-05:00) Bogota, Lima, Quito (GMT-05:00) Eastern Time (US & Canada) (GMT-05:00) Indiana (East) (GMT-04:30) Caracas (GMT-04:00) Asuncion (GMT-04:00) Atlantic Time (Canada) (GMT-04:00) Cuiaba (GMT-04:00) Georgetown, La Paz, Manaus, San Juan (GMT-04:00) Santiago (GMT-03:30) Newfoundland E. South America Standard Time (GMT-03:00) Brasilia Argentina Standard Time SA Eastern Standard Time Greenland Standard Time Montevideo Standard Time UTC-02 Mid-Atlantic Standard Time Azores Standard Time Cape Verde Standard Time Morocco Standard Time UTC GMT Standard Time Greenwich Standard Time (GMT-03:00) Buenos Aires (GMT-03:00) Cayenne, Fortaleza (GMT-03:00) Greenland (GMT-03:00) Montevideo (GMT-02:00) Coordinated Universal Time-02 (GMT-02:00) Mid-Atlantic (GMT-01:00) Azores (GMT-01:00) Cape Verde Is. (GMT) Casablanca (GMT) Coordinated Universal Time (GMT) Greenwich Mean Time : Dublin, Edinburgh, Lisbon, London (GMT) Monrovia, Reykjavik W. Europe Standard Time (GMT+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna Central Europe Standard Time Romance Standard Time Central European Standard Time (GMT+01:00) Belgrade, Bratislava, Budapest, Ljubljana, Prague (GMT+01:00) Brussels, Copenhagen, Madrid, Paris (GMT+01:00) Sarajevo, Skopje, Warsaw, Zagreb W. Central Africa Standard Time (GMT+01:00) West Central Africa Jordan Standard Time (GMT+02:00) Amman 52 PI Coresight 2014 Installation and Administration Guide

57 PI Coresight administration tasks System Timezone ID GTB Standard Time Middle East Standard Time Egypt Standard Time Syria Standard Time South Africa Standard Time FLE Standard Time Israel Standard Time Display Name (GMT+02:00) Athens, Bucharest, Istanbul (GMT+02:00) Beirut (GMT+02:00) Cairo (GMT+02:00) Damascus (GMT+02:00) Harare, Pretoria (GMT+02:00) Helsinki, Kyiv, Riga, Sofia, Tallinn, Vilnius (GMT+02:00) Jerusalem E. Europe Standard Time (GMT+02:00) Minsk Namibia Standard Time Arabic Standard Time Arab Standard Time Russian Standard Time (GMT+02:00) Windhoek (GMT+03:00) Baghdad (GMT+03:00) Kuwait, Riyadh E. Africa Standard Time (GMT+03:00) Nairobi Iran Standard Time Arabian Standard Time Azerbaijan Standard Time Mauritius Standard Time Georgian Standard Time Caucasus Standard Time Afghanistan Standard Time Ekaterinburg Standard Time Pakistan Standard Time West Asia Standard Time India Standard Time Sri Lanka Standard Time Nepal Standard Time Central Asia Standard Time Bangladesh Standard Time (GMT+03:00) Moscow, St. Petersburg, Volgograd (GMT+03:30) Tehran (GMT+04:00) Abu Dhabi, Muscat (GMT+04:00) Baku (GMT+04:00) Port Louis (GMT+04:00) Tbilisi (GMT+04:00) Yerevan (GMT+04:30) Kabul (GMT+05:00) Ekaterinburg (GMT+05:00) Islamabad, Karachi (GMT+05:00) Tashkent (GMT+05:30) Chennai, Kolkata, Mumbai, New Delhi (GMT+05:30) Sri Jayawardenepura (GMT+05:45) Kathmandu (GMT+06:00) Astana (GMT+06:00) Dhaka N. Central Asia Standard Time (GMT+06:00) Novosibirsk Myanmar Standard Time SE Asia Standard Time North Asia Standard Time China Standard Time North Asia East Standard Time Singapore Standard Time (GMT+06:30) Yangon (Rangoon) (GMT+07:00) Bangkok, Hanoi, Jakarta (GMT+07:00) Krasnoyarsk (GMT+08:00) Beijing, Chongqing, Hong Kong, Urumqi (GMT+08:00) Irkutsk W. Australia Standard Time (GMT+08:00) Perth Taipei Standard Time Ulaanbaatar Standard Time (GMT+08:00) Kuala Lumpur, Singapore (GMT+08:00) Taipei (GMT+08:00) Ulaanbaatar PI Coresight 2014 Installation and Administration Guide 53

58 PI Coresight administration tasks System Timezone ID Tokyo Standard Time Korea Standard Time Yakutsk Standard Time Cen. Australia Standard Time AUS Central Standard Time Display Name (GMT+09:00) Osaka, Sapporo, Tokyo (GMT+09:00) Seoul (GMT+09:00) Yakutsk (GMT+09:30) Adelaide (GMT+09:30) Darwin E. Australia Standard Time (GMT+10:00) Brisbane AUS Eastern Standard Time West Pacific Standard Time Tasmania Standard Time Vladivostok Standard Time Central Pacific Standard Time New Zealand Standard Time UTC+12 Fiji Standard Time Kamchatka Standard Time Tonga Standard Time (GMT+10:00) Canberra, Melbourne, Sydney (GMT+10:00) Guam, Port Moresby (GMT+10:00) Hobart (GMT+10:00) Vladivostok (GMT+11:00) Magadan, Solomon Is., New Caledonia (GMT+12:00) Auckland, Wellington (GMT+12:00) Coordinated Universal Time+12 (GMT+12:00) Fiji (GMT+12:00) Petropavlovsk-Kamchatsky - Old (GMT+13:00) Nuku'alofa Change regionalization settings To support one regionalization format for all users browsing to a PI Coresight website, follow this procedure. 1. Use an editor to open the web.config file in the root PI Coresight installation folder. 2. Locate the line for the globalization element. The default value looks like this: <globalization culture="auto" uiculture="auto" /> 3. Modify the culture value to the desired sitewide region option: <globalization culture="sitewideregion" uiculture="auto" /> where sitewideregion is the code for the appropriate region. For a list of codes, go to the Microsoft Developer Network website: For example, to set PI Coresight to use the French Canadian regionalization format for all users, type: <globalization culture="fr-ca" uiculture="auto" /> Uninstall PI Coresight Launch the Programs and Features Control Panel applet, select PI Coresight, and select Uninstall. 54 PI Coresight 2014 Installation and Administration Guide

59 URL parameters for controlling the presentation of displays You can use a URL to open PI Coresight displays programmatically from other applications. You can use the URL to: Create a temporary display that shows a single trend populated with specified data items; the URL can also specify a time range for the display. Open an existing saved display and, optionally, specify a time range for the display. Specify kiosk mode to open a display with limited interactivity. Configure an existing display to use other assets that share the same AF template. To do this, specify the assets to show in a display by appending?asset to the URL, followed by the path of the new asset. Specify the element for a PI ProcessBook element relative display that you've accessed from within PI Coresight. Set the time zone for a display so that users see data in the time zone you specify, rather than in the time zone of their client machine. Hide the toolbar or timebar, or both, in a display. Prevent automatic redirection for users of PI Coresight on mobile devices. Users of a smaller device or browser window are automatically redirected to the mobile version of PI Coresight. However, you can bypass this behavior, such as in cases where you have embedded a PI Coresight or PI ProcessBook display in your own dash board. A URL must include URL-encoded characters where needed. For example, the plus sign (+) indicates <Space> in HTML. To enter an actual plus sign as part of a URL, it must be encoded as "%2B". For the URL syntax: &EndTime=+8h you need to use: &EndTime= %2B8h. See the reference page for more information about URL encoding. Creating a new temporary display with particular data items A URL can specify data items to show in a single trend on a temporary (ad hoc) display. The data items can be any combination of PI tags, attributes, and (AF element) assets. If the URL specifies an asset, all of its attributes appear in the trend. Users can save a temporary display for later use by making a copy of the display. The URL can include start and end time parameters for the display time range using any PI time expression. If no start and end times are specified, the default time range of 8 hours ago until now is applied, and the time range is continuously updating. PI Coresight 2014 Installation and Administration Guide 55

60 URL parameters for controlling the presentation of displays Examples The following URL creates a temporary display with one trend containing a single attribute (Fuel) from the B-210 asset. Attributes are delimited by the pipe ( ) character. No start and end times are specified, so the default time range applies to the display. \B-210 Fuel The following URL creates a temporary display with a single asset (B-210) in a specified time range. This shows data for all attributes of B-210 in the trend on the temporary display during the time range of midnight September 25, 2012, to midnight September 27, \B-210&StartTime=25-sep-12&EndTime=27-sep-12 Multiple data items, delimited by semicolons. Notice that attributes from the same asset (Temperature and Fuel) must be specified completely. No start and end times are specified, so the default time range applies to the display. \B-210 Temperature;\\piserver\aPIPoint Opening an existing saved display A URL can open an existing saved display. Make sure users have access to the saved display by marking the display as public. You can append start and end time parameters for the display time range using any PI time expression. If no start and end times are specified, the time range of the saved display applies. Examples The following URL opens the saved display 3117 (named PowerAnalysis). No time range is specified so the display opens with the time range from the saved display. This URL opens the saved display 3117 (named PowerAnalysis) with the specified time range of midnight September 25, 2012, to midnight September 27, &StartTime=25-sep-12&EndTime=27-sep-12 Applying kiosk mode to a display A URL can specify a display with limited interactivity using kiosk mode. You can apply kiosk mode to either a temporary display or a saved display. When a display is in kiosk mode: The display is read-only. Only the workspace of the display is visible. Left-side panels for example, Search and Cart are omitted. To further limit interaction, the Help and Homepage links are not available. 56 PI Coresight 2014 Installation and Administration Guide

61 URL parameters for controlling the presentation of displays Users can interact with the timebar and symbols but are unable to save any changes. Refreshing the browser displays the original view of the display. To place a display into kiosk mode, append this parameter to the URL:?mode=kiosk Examples The following URL creates a temporary display in kiosk mode. The display will show one trend containing a single attribute (Fuel) from the B-210 asset during the time range of midnight September 25, 2012, to midnight September 27, B-210 Fuel&StartTime=25-sep-12&EndTime=27-sep-12&mode=kiosk This URL opens the saved display 3117 (named PowerAnalysis) in kiosk mode. No time range is specified so the display will open with the time range from the saved display. Reuse displays for assets built from the same AF template You can configure an existing display to use other assets that share the same AF template. To do this, specify the assets to show in a display by appending?asset to the URL, followed by the path of the new asset. 1. Obtain the paths of the assets you want to use to replace the existing assets on the display. You can find these paths in PI Coresight search results, or in PI System Explorer. 2. Specify the related assets by updating the existing display URL. Append the string?asset followed by the path of the new asset. Separate multiple asset paths with a semicolon (;). Example In the following example, a PI Coresight display named BoilerFanInformation contains two table symbols one shows information about a boiler, and the other shows information about a fan. The boiler asset on the display was built from an AF element template of type Boiler, and the fan asset was built from an AF element template of type Fan. An engineer wants to use this display to show information about a different boiler and fan, which were built from the same templates. The original BoilerFanInformation display has the URL: To see information about a different boiler and fan on this display, perform these steps: 1. In PI System Explorer, identify the paths to the AF assets of interest. 2. Append the following string to the "BoilerFanInformation" display URL:?Asset=\\AFServer1\DB1\CrackingProcess\Equipment\Boiler309;\\AFServer1\DB1\ Cracking Process\Equipment\Fan486 This creates the URL: PI Coresight 2014 Installation and Administration Guide 57

62 URL parameters for controlling the presentation of displays \AFServer1\DB1\ CrackingProcess\Equipment\Boiler309;\\AFServer1\DB1\ Cracking Process\Equipment\Fan486 The tables on the display now show Boiler asset information for Boiler309 and Fan asset information for Fan486. You do not have to specify an asset for each template, for example, you could have specified only a fan in the URL, and not specify a boiler. Specify the element for PI ProcessBook element relative displays For an element-relative display (ERD), when you view it in PI ProcessBook, you change the element you are viewing by selecting another element in the Elements of Interest pane. When you view a PI ProcessBook ERD from within in PI Coresight, you use a different method to switch elements. Append?CurrentElement to the URL, followed by the path to the element for which to show data. Relative path syntax of PI AF elements is supported. For example, each of the following URLs shows data from a different element on the ERD identified as 15914: \\AFServer1\DB1\CrackingProcess\Boiler202 \\AFServer1\DB1\CrackingProcess\Boiler209 Set the time zone for a display You can use a URL parameter to set the time zone for a display so that users see data in the time zone you specify, rather than in the time zone of their client machine. You do this by specifying a time offset from UTC time (Coordinated Universal Time) in the URL of a display. This offset is only used for: The specified display Trend previews of dynamic symbols on that display Temporary (ad hoc) PI Coresight displays accessed from a PI ProcessBook display The timebar shows the UTC string. Daylight saving time does not affect displays that use this parameter. As an example, assume you want to specify the time zone in which your users view data for the following display: 58 PI Coresight 2014 Installation and Administration Guide

63 URL parameters for controlling the presentation of displays Append the TZ parameter to the URL. For example: The TZ parameter name and the UTC keyword are not case sensitive. The offset can be positive or negative. To apply a positive offset, you must encode the + (plus) sign as %2B. Syntax and examples There cannot be any spaces within the time zone offset specification, for example: TZ=UTC-3:00. You can enter the time offset in either of the following formats: H:MM or HH:MM For example: TZ=UTC-5:05 If you specify minutes, you must use two digits and precede them with a : (colon). Values for minutes can range from 00 to 59. For example: tz=utc%2b8:05 +n or -n hours. Values for hours (n) can range from 1 to 13. For example: tz=utc-1 In Mozilla Firefox browsers, the UTC+H format can fail, because the + (plus) sign is not properly transmitted (whether or not it is encoded as %2B). Any invalid specifications cause the display to revert to the client time zone. Hide the toolbar or timebar You can use the URL parameters HideToolbar and HideTimebar to hide the toolbar or the timebar in a display. The setting applies to: The specified display Temporary (ad hoc) PI Coresight displays accessed from a PI ProcessBook display After being hidden, to revert to showing the toolbar and timebar, you need to remove the HideToolbar and HideTimebar parameters and reload the display. As an example, assume you want to hide the toolbar or timebar in the following display: To hide the toolbar, append the parameter?hidetoolbar to the URL. For example: The parameter name is not case sensitive. There cannot be any spaces within the parameter specification. To hide the timebar, append the parameter?hidetimebar to the URL. For example: PI Coresight 2014 Installation and Administration Guide 59

64 URL parameters for controlling the presentation of displays To hide both the toolbar and the timebar, append the parameters? HideToolbar&HideTimebar to the URL. For example: PowerAnalysis?hideToolbar&HideTimebar Prevent automatic redirection to PI Coresight mobile website Based on the size of the device or browser window, a user of a smaller device or browser is by default redirected to the PI Coresight mobile website. You might find it necessary to bypass this behavior, such as when you embed a PI Coresight or PI ProcessBook display in your own dashboard. To override the default behavior, add redirect=false to the PI Coresight URL. This parameter causes the user to view the full PI Coresight web application, regardless of the device or window size. Examples The following URL opens the saved display 3117 (named PowerAnalysis) in the full PI Coresight web application, even when accessed from small devices or browser windows PI Coresight 2014 Installation and Administration Guide

65 High availability options for PI Coresight The high availability (HA) solutions described here are independent of PI Coresight. These strategies are recommendations, but all systems have unique requirements, therefore you should discuss these strategies with your database administrator and Internet Information Services (IIS) administrator while planning your architecture. HA options are available for PI Coresight at both the database and application server levels. Each of these options has its own benefits. Database options include: Clustering Mirroring AlwaysOn Availability Groups Transactional replication PI Coresight application server options include: Network load balancing (NLB) Application request routing (ARR) NLB and ARR in an active/passive failover configuration NLB and ARR in an active/active failover configuration Database level options Employing HA at the database level prevents the PI Coresight database in Microsoft SQL Server from becoming a single point of failure. You should implement HA for the PI Coresight database in the same way as applying HA to any other SQL Server database. Microsoft provides a general description of their HA implementation options for MS SQL Server in the article Overview of SQL Server High Availability Solutions ( After connection, a replicated database acts in the same way as the database it replaces, therefore the only configuration change required is to make the PI Coresight application aware of the replicated database. You do this when you specify the connection string in the web.config file. For example: connectionstring = "Data Source=myPrimaryServer;Failover Partner=mySecondaryServer; Initial Catalog=myDataBase;Integrated Security=True; Application Name=&quotCoresight Web Service&quot" The web.config file is located in one of the following directories: %pihome64%\coresight\services for versions 1.x %pihome64%\coresight for versions 2.x The following table summarize the benefits and disadvantages of each SQL Server HA option. PI Coresight 2014 Installation and Administration Guide 61

66 High availability options for PI Coresight SQL Server HA option Advantages Disadvantages Clustering Allows full-time read-write access to the PI Coresight database. No re-synchronization required. Cluster members always use the latest shared copy of the database. Mirroring Allows full-time read-write access to the PI Coresight database. Fast failover time (compared to SQL clustering). Two copies of the database on independent hardware. The members can be physically separated by a long distance. AlwaysOn Availability Groups Allows full-time read-write access to the PI Coresight database. Fast failover time (compared to SQL clustering). Two copies of the database on independent hardware. No witness server required. Transactional replication Two copies of the data on independent hardware. Requires a significant initial investment in cluster hardware. Can be slow to failover between cluster members (compared to mirroring). Only one copy of the database. Distance between nodes is limited to a few meters, because they share a physical drive. Requires a third "witness server" for hot failover. If run in asynchronous mode, the mirror database may not always be up-to-date. SQL Enterprise is required to utilize Availability Groups. Failover is not supported. Load balancing is not supported. No protection from replicated data being changed. PI Coresight application server HA options HA at the application server level can provide load balancing and fault tolerance. The following table outlines some of the pros and cons for different network load balancing (NLB) and application request routing (ARR) implementations. For a more detailed discussion of the configuration, benefits, and drawbacks for these scenarios, see the IIS article Achieving High Availability and Scalability - ARR and NLB ( EXTENSIONS/CONFIGURING-APPLICATION-REQUEST-ROUTING-(ARR)/ACHIEVING-HIGH- AVAILABILITY-AND-SCALABILITY-ARR-AND-NLB). The following table summarize the benefits and disadvantages of each PI Coresight application server HA option. 62 PI Coresight 2014 Installation and Administration Guide

67 High availability options for PI Coresight PI Coresight Application Server HA options Advantages Disadvantages Application request routing (ARR) Divides the data access load on the application server. Other features are available that allow ARR to act as a reverse proxy, if desired. Network load balancing (NLB) Divides the data access load on the application server. NLB and ARR (active/passive) Provides true HA since there is no single point of failure. Other features are available that allow ARR to act as a reverse proxy if desired. Does not provide true HA, because the ARR node remains a single point of failure. Limited scalability, because the traffic is channeled through a single node. Larger investment required, in terms of setup and number of available machines required. NLB and ARR (active/active) Provides true HA since there is no single point of failure. Provides true scalability since traffic is not channeled through a single node. Other features are available that allow ARR to act as a reverse proxy, if desired. For further information about high availability and the PI System, see the High Availability section under PI Server on PI Live Library ( pub.xql?action=publist_home). PI Coresight 2014 Installation and Administration Guide 63

68 High availability options for PI Coresight 64 PI Coresight 2014 Installation and Administration Guide

69 Appendix A View and configure PI Coresight message logs This appendix explains how to view PI Coresight messages and how to configure message logging. By default PI Coresight messages appear in the Windows Event Viewer tool on the PI Coresight application server. View the message logs 1. Open the Windows Event Viewer tool on the PI Coresight application server computer. By default, the tool is accessible directly from the Windows Start menu. 2. Click the + button to expand Applications and Services Logs. PI Coresight application messages appear under the following categories: OSIsoft-PIDataServices Admin Operational OSIsoft-PISymbols Includes search and data retrieval messages (including all messages from the administration website and file monitoring services). Admin Operational OSIsoft-PISystemSearch Admin Operational OSIsoft-Search Admin 3. You can optionally create a custom view to see all of these events in one place: a. Right-click the Custom Views row in the left pane of the Windows Event Viewer and select Create Custom View. b. Give the view a name, for example, PI Coresight Events. c. Select the XML tab. d. Check Edit query manually and add the following text: <QueryList> <Query Id="0" Path="OSIsoft-PIDataServices/Admin"> <Select Path="OSIsoft-PIDataServices/Admin">*</Select> <Select Path="OSIsoft-PIDataServices/Operational">*</Select> <Select Path="OSIsoft-PISymbols/Admin">*</Select> PI Coresight 2014 Installation and Administration Guide 65

70 Appendix A View and configure PI Coresight message logs <Select Path="OSIsoft-PISymbols/Operational">*</Select> <Select Path="OSIsoft-PISystemSearch/Admin">*</Select> <Select Path="OSIsoft-PISystemSearch/Operational">*</Select> <Select Path="OSIsoft-Search/Admin">*</Select> <Select Path="PIWebAPI/Admin">*</Select> </Query> </QueryList> Collect analytic and debug events using Windows Performance Monitor For debugging purposes, you can enable trace logs to collect diagnostic data to provide to OSIsoft Technical Support. Templates for this type of data collection are available through Technical Support. You can configure event trace logs to be collected for a dynamic time period, by using Event Trace Sessions. For more information about data collectors, see this Microsoft article about performance and reliability monitoring: Suppress duplicate messages (message throttling) You can prevent client applications from flooding logs with duplicate messages when there is a recurring problem. The default value is 5 minutes, meaning that if the same message repeats within 5 minutes, logging applications will not log that message. To modify this setting, edit the web.config file located on your client machine. Edit the following entry under <appsettings> to adjust throttling settings: <add key="errorsuppressiontime" value="" /> The value is a time in minutes. So the following line would set message throttling to ten minutes: <add key="errorsuppressiontime" value="10" /> If the value is zero, then message throttling is disabled. OSIsoft recommends that you do not disable message throttling. 66 PI Coresight 2014 Installation and Administration Guide

71 Technical support and other resources For technical assistance, contact OSIsoft Technical Support at or through the OSIsoft Tech Support Contact Us page ( The website offers additional contact options for customers outside of the United States. When you contact OSIsoft Technical Support, be prepared to provide this information: Product name, version, and build numbers Details about your computer platform (CPU type, operating system, and version number) Time that the difficulty started Log files at that time Details of any environment changes prior to the start of the issue Summary of the issue, including any relevant log files during the time the issue occurred The OSIsoft Virtual Campus (vcampus) website ( has subscription-based resources to help you with the programming and integration of OSIsoft products. PI Coresight 2014 Installation and Administration Guide 67

72 Technical support and other resources 68 PI Coresight 2014 Installation and Administration Guide