OSIsoft Self Paced Training Course

PI System Administration: Basics

OSIsoft, LLC
1600 Alvarado Street
San Leandro, CA 94577 USA
Tel: (01) 510-297-5800
Web: http://www.osisoft.com

© 2020 by OSIsoft, LLC. All rights reserved.

OSIsoft, the OSIsoft logo and logotype, Analytics, PI ProcessBook, PI DataLink, ProcessPoint, Asset
Framework (AF), IT Monitor, MCN Health Monitor, PI System, PI ActiveView, PI ACE, PI AlarmView, PI
BatchView, PI Vision, PI Data Services, Event Frames, PI Manual Logger, PI ProfileView, PI
WebParts, ProTRAQ, RLINK, RtAnalytics, RtBaseline, RtPortal, RtPM, RtReports and RtWebParts are all
trademarks of OSIsoft, LLC. All other trademarks or trade names used herein are the property of their
respective owners.

U.S. GOVERNMENT RIGHTS

Use, duplication or disclosure by the U.S. Government is subject to restrictions set forth in the OSIsoft,
LLC license agreement and as provided in DFARS 227.7202, DFARS 252.227-7013, FAR 12.212, FAR
52.227, as applicable. OSIsoft, LLC.

Published: July 28, 2021

2|Page
 PI System Administration: Basics

Table of Contents
1. Introduction .......................................................................................................................................... 6
1.1 Overview of the Course ................................................................................................................ 6
1.2 PI System software........................................................................................................................ 7
2. [Optional] Preparing for a PI System .................................................................................................... 8
2.1 Background: What Preparation is Needed?.................................................................................. 8
2.2 Background: Hardware Sizing ....................................................................................................... 8
2.3 Background: Software Prerequisites........................................................................................... 11
2.4 Background: Service Accounts and Certificates .......................................................................... 11
2.4.1 Service Accounts ................................................................................................................. 11
2.4.2 Group Managed Service Accounts ...................................................................................... 12
2.4.3 Certificates .......................................................................................................................... 12
2.4.4 Service Principle Names ...................................................................................................... 13
2.5 Background: Firewall Port Requirements ................................................................................... 13
2.6 Background: PI Data Archive License File Activation .................................................................. 13
3. PI Server Installation ........................................................................................................................... 16
3.1 Hands-On: PI Server Installation ................................................................................................. 16
3.2 Hands-On: Post-Install - Backup.................................................................................................. 17
3.3 Hands-On: Post-Install - Security ................................................................................................ 17
3.4 Knowledge Check: Final Post-Install Tasks .................................................................................. 19
3.4.1 Exercise - Create a Mapping ............................................................................................... 20
4. PI Interface Installation ....................................................................................................................... 21
4.1 Background: How Does the PI System Connect to Data Sources? ............................................. 21
4.1.1 PI Interfaces ........................................................................................................................ 21
4.1.2 PI Connectors ...................................................................................................................... 22
4.1.3 PI Adapters .......................................................................................................................... 22
4.1.4 Custom Applications ........................................................................................................... 22
4.2 Hands-On: PI Interface Installation ............................................................................................. 23
4.3 Knowledge Check: Confirming Connectivity ............................................................................... 24
4.4 Hands-On: PI Interface Configuration ......................................................................................... 24
4.5 Knowledge Check: The PI Data Archive Message Log ................................................................. 34
4.5.1 Exercise - Explore the PI Data Archive Message Log........................................................... 34

3|Page
 4.6 Knowledge Check: Confirming Interface Operation ................................................................... 32
4.6.1 Part 1: Check that you are receiving data for all points belonging to the interface in the PI
Data Archive ........................................................................................................................................ 32
4.6.2 Part 2: Check that data is flowing through the buffer ........................................................ 32
4.7 Knowledge Check: The Bufferer, the Betterer ............................................................................ 26
5. PI Point Management ......................................................................................................................... 28
5.1 Hands-On: Creating Points for Interfaces ................................................................................... 28
5.2 Background: Explore PI Points and Interfaces ............................................................................ 29
5.3 Background: Compression and Exception .................................................................................. 29
5.4 Reference: The Interface User Manual ....................................................................................... 29
5.5 Knowledge Check: Creating Digital Points .................................................................................. 30
5.5.1 Introduction to Digital Points .............................................................................................. 30
5.5.2 Digital State Sets ................................................................................................................. 30
5.5.3 Exercise: Create a Digital State Set and Point ..................................................................... 31
5.6 Hands-On: Creating Points in Bulk .............................................................................................. 32
5.7 Knowledge Check: Creating More Points.................................................................................... 34
5.7.1 Exercise - Create Points for Pump Current ......................................................................... 37
5.7.2 Exercise Solution ................................................................................................................. 37
6. Improving Interface Reliability ............................................................................................................ 39
6.1 Background: Interface Redundancy ............................................................................................ 39
6.2 Knowledge Check: Preparing a Second PI Interface ................................................................... 39
6.2.1 Exercise: Configure an OPC Interface on PIINT02 ............................................................... 39
6.3 Hands-On: Configure UNIINT Failover ........................................................................................ 40
6.3.1 Part 1: Prepare the shared folder ....................................................................................... 40
6.3.2 Part 2: Configure failover on one interface ........................................................................ 40
6.3.3 Part 3: Fix security for UFO status tags ............................................................................... 41
6.4 Knowledge Check: Interface Health Points ................................................................................. 43
6.4.1 UniInt Health Points ............................................................................................................ 43
6.4.2 Exercise - Create UniInt health points for both of your Interface instances ...................... 44
7. Managing User Access ........................................................................................................................ 45
7.1 Hands-On: Data Archive Security ................................................................................................ 45
7.2 Background: What is Asset Framework? .................................................................................... 46
7.3 Hands-On: Asset Framework Security ........................................................................................ 47

4|Page
 PI System Administration: Basics

7.4 Knowledge Check: Contractor Access ......................................................................................... 49

7.4.1 Part 1: Prepare your Data Archive and Asset Framework .................................................. 49
7.4.2 Part 2: Satisfying a new management request ................................................................... 50
7.4.3 Part 3: Satisfying another management request ................................................................ 50
7.4.4 Part 4: Check if your changes worked ................................................................................. 50
8. Managing Data .................................................................................................................................... 51
8.1 Background: What are Archive Files? ......................................................................................... 51
8.2 Knowledge Check: PI Archives in Depth ..................................................................................... 51
8.2.1 Exercise: Move old archives to a different drive ................................................................ 52
9. Final Exam ........................................................................................................................................... 54

5|Page
1. Introduction

1.1 Overview of the Course

Before reading this section, please refer to the following course YouTube
video: https://youtu.be/yJgPct6gAtg
Video

This course will teach new PI System Administrators to install, configure, secure and manage the core
components of a PI System, including:

• PI Data Archive installation and configuration

• PI Interface installation and configuration

• PI Point creation and administration

• User access configuration

During the class we'll cover best-practise configuration only, but will link out to documentation covering
older practises and methods when necessary. No matter if you're about to administer a new PI System or
are maintain an established one, you'll get a lot out of this class.

Throughout this class we will assume you have already completed the free PI System Basics class. We will
not cover any background or content that has already been covered in this class.

The course consists of text-based lessons, and video lectures. You are encouraged to follow along with all
video lectures using your Learning Cloud Environment. It is intended that you follow the video lectures in-
order, as a lot of configuration depends on prior lessons. Text-based lessons contain background theory,
documentation and other useful information.

Lessons are categorized using the following key words:

• Hands-On: These lessons contain hands-on walkthroughs on configuring your virtual

environment. Skipping these videos is not recommended, you will find that you cannot complete
some later lessons without first completing the earlier ones.

• Knowledge check: Exercises to complete using your virtual environment, or quizzes to keep your
skills sharp. Lessons will assume you have completed prior knowledge checks. Some knowledge
checks ask you to change the configuration of your virtual environment and skipping them may
result in you being unable to complete later exercises.

• Background: Readings or videos containing useful background information to assist your

understanding. These lessons are optional as they do not contain specific information regarding
your virtual environment.

6|Page
 PI System Administration: Basics

• Reference: Documentation or downloads you may find useful when applying this class to your
own system. You are not expected to read through all references, and will not be examined on
any content within them, but they are included for your convenience.

In the next lesson we'll cover the Learning Cloud Environment used in class, and what we'll accomplish in
this class in detail.

1.2 PI System software

The VM (virtual machine) used for this course has the following PI System software installed:

Software Version

PI Data Archive 2018 SP3

PI Asset Framework (PI AF) server 2018 SP3

PI Asset Framework (PI AF) client (PI System Explorer) 2018 SP3

PI Analysis & PI Notifications Services 2018 SP3

PI Interface Configuration Utility 1.5.0.7

PI Interface for OPC DA (Read Only) 2.7.1.41

For details on PI System software, please see http://www.osisoft.com/pi-system/pi-capabilities/product-

list/

After reading this section, please refer to the following course YouTube
video: https://youtu.be/WYPOsLvogkQ
Video

7|Page
2. [Optional] Preparing for a PI System

You can consider this chapter optional. If you will never plan for or install a PI System from scratch, the
knowledge contained in this chapter is not strictly needed. If you will only ever maintain a PI System
already in place, you can skip to the next chapter.

2.1 Background: What Preparation is Needed?

During this section we will cover prerequisites for a PI System Core installation. Even if your job
description doesn't involve installing software in any way - preparing for and installing a system is the
best way to learn how it all fits together. Preparing for a new PI System Installation consists of four
parts:

1. Size up and Procure hardware

2. Install software prerequisites

3. Create service accounts and certificates

4. Obtain a PI Data Archive license file

Documentation for PI Server installation can be found on PI Live Library

Installation best practices are found in the PI Data Archive Install Field Service
✔ Best
Technical Standard. This document can be downloaded from the [Reference: PI
Practice
Data Archive Install Technical Standards] lesson online.

2.2 Background: Hardware Sizing

On OSIsoft’s Customer Portal MS Excel spreadsheet “Hardware and PI System Sizing Recommendation
Spreadsheet” can be found and downloaded (link). You can also find the spreadsheet attached to this
lesson.

This spreadsheet gives recommendations for the following hardware resources based on current or
anticipated load and data volume.

• Storage Capacity

• Disk Throughput (IOPS)

• CPU Count

• Memory (RAM)

• Network Bandwidth

8|Page
 PI System Administration: Basics

The amount of disk space required depends primarily on the number of PI points that the PI system will
collect. See below to calculate the necessary disk space.

PI Data Archive Space Requirement Notes

Component

PI Data Archive and PI 160 MB PI SDK includes the PI API.

Software Development
100 MB temporary disk
Kit (PI SDK)
space for installation

PI Data Archive 11 MB per 1000 points + 1 Located on the same computer as the
databases MB PI Server.

Message log files 10 MB Located on the same computer as PI

Server, in the pi\log directory.

PI Archive files 10 MB per 1000 points

PI event queue 5 MB per 1000 points OSIsoft recommends that you place
the event queue on a different
physical drive from the PI archive files.

Rollback backup Size of PI Data Archive The PI Archive setup program

(upgrade only) databases + primary performs a minimal backup during the
archive upgrade.

For PI Data Archive, PI AF server, and Microsoft SQL Server, one or more Microsoft Windows compatible
computers, with a 64-bit operating system is required.

For best performance and improved security, OSIsoft recommends that you install MS SQL Server on a
different computer from PI Server. If you plan to install MS SQL Server on the same node as the PI Data
Archive, the SQL Express Edition should be installed so that the MS SQL Server does not compete with
system resources of the PI Server. The MS SQL Express Edition is limited to using only a single physical
CPU and 1 GB of RAM.

It is recommended that the PI AF server and PI Data Archive server be installed on different computers if:

• PI AF server will use time-series data from multiple PI Servers

• PI AF server is configured for high availability (such as a load balanced PI AF server, PI AF servers
connected to a mirrored MS SQL Server, or PI AF servers connected to clustered MS SQL
Servers).

The number of required computers depends on the size and complexity of the PI System. The size of a PI
System depends on the number of PI points and the number of units (elements) of equipment (such as
mixers, tanks, or meters or whatever else you have added into the asset database).

A simple, small system will have the PI Data Archive, the PI AF Server and MS SQL Server (the free MS
SQL Server Express may be used) installed on the same hardware (or virtualised) server, as shown
below:

9|Page
For distributed systems with large workloads and point counts, and with multiple PI Servers or PI Data
Archive Server collectives that link to a central PI AF database, OSIsoft recommends that you install PI
Data Archive Server collectives with two PI AF Servers with a Network Load Balancer over them, and
Microsoft SQL Server on separate, redundant computers to achieve the best level of performance and
scalability. This type of system is depicted below:

10 | P a g e
 PI System Administration: Basics

2.3 Background: Software Prerequisites

There are two major prerequisites for a PI System:

• Microsoft Windows
• Microsoft SQL Server
• A Data Source for Time Series Data

Except for select interfaces and adapters, all PI System software is Microsoft Windows-based. Any server
where PI System software will be installed must have Microsoft Windows installed on it.

Microsoft SQL Server is required by both PI AF Server, and PI Vision. In this class we'll be focusing on PI
AF Server - PI Vision installation is not covered in this class. To see which versions of Microsoft SQL
Server are supported, see the SQL Server Requirements documentation.

Your time-series data source will be defined by your desired project outcome. Which pieces of
equipment or data sources do you want to expose to your users? How do they expose their data now?
These topics will be covered in depth during the upcoming lesson on PI Interface Installation and
Configuration. For now, this course will assume you'll be using an OPC DA Server as your data source, as
it is by far the most common. During the upcoming lesson on PI Interface installation and configuration,
we will study this depth and cover non-OPC Server data sources. For more information on OPC DA, see
the OPC Foundation's page on the topic.

2.4 Background: Service Accounts and Certificates

Your IT Department will need to configure domain objects prior to installing the PI System, in the form
of:

• Service accounts

• Certificates

• Service Principle Names

The information below should give you a better idea on what each of what to ask your IT department for
regarding each of these topics.

2.4.1 Service Accounts

You can think of a service account similarly to a user account in a domain. It is an account that has been
created for the purpose of running a specific service. Modern security best practises dictate that services
that require different levels of access to different objects should run under different accounts. The
permissions on these accounts should follow the principle of least privilege - each one should have the
minimum privileges to perform its function and nothing more.

During this class, we will be using service accounts for the following services, and configuring least-
privilege for each:

11 | P a g e
 • PI AF Server

• PI Analysis Service

• PI Interface for OPC DA

• PI Buffer Subsystem

In this class we build a very simple system, but in a more complex production system, you may also need
service accounts for:

• PI Notifications Service

• Any additional individual PI Interface instances

• PI Vision

• PI Web API

• PI Data Archive Network Manager

• PI Connectors, PI Connector Relay, PI Data Collection Manager

• Any PI Integrators

• Any additional standalone or legacy PI System services

2.4.2 Group Managed Service Accounts

In this class we will be using a special type of account for this job, called Group Managed Service
Accounts (gMSAs). Most of the steps we work through in this class also work with other account types,
and when there are configuration differences we'll make sure to mention them. We use gMSAs because
their passwords are automatically managed by the domain, and they align much better with what we're
trying to achieve than other account types. Once the initial setup is done, your job as an administrator is
much simpler as password changes and maintenance is automatically performed. You can read more
about using this type of account with PI System Services here and you can read about migrating to
gMSAs here (both links require a validated OSIsoft customer portal account).

2.4.3 Certificates

You will need SSL Certificates generated for:

• PI AF Server

• PI Vision Server

There are many ways to generate these certificates, and the process you use will be decided by your IT
department. You will need to ask your IT department for certificates for these two servers, generated by
an authority that is trusted by all users that are going to be using the PI System at your organisation. For
more information on these certificates, see the PI Vision documentation here.

12 | P a g e
 PI System Administration: Basics

During this course we won't be installing PI Vision, but we will be installing PI AF Server, so we will need
a certificate. We'll be using a certificate generated by our Domain's Certification Authority. The
certificate we're using in this class have similar function to certificates generated by your IT department
for use within your corporate domain, trusted by domain-joined computers and users. This is the most
common type of certificate used for PI System Services the field.

2.4.4 Service Principle Names

This section relates specifically to the PI Vision and PI Web API components of the PI System. SPNs are
used by Kerberos authentication to associate a service instance with a service logon account. If you'll be
installing PI Vision and/or PI Web API, you'll need your IT department to set up SPNs for these services
before users are able to connect to them. For more information start reading the PI Vision
documentation from the chapter on Kerberos Delegation here.

2.5 Background: Firewall Port Requirements

When connecting to any server with PI System software installed, the port for the service(s) installed on
the server must be open. This is a task for your IT department to complete before an installation
proceeds. All servers in your learning environment already have the required ports open.

A quick summary of inbound ports that must be open for each service:

Service/Product Port

Data Archive 5450

Asset Framework Server 5457, 5459

PI Notifications 5468

PI Analysis Service 5463

PI Vision 80, 443

A full list of knowledge base articles on this topic can be found here.

A simple way of checking if a port is open from one machine to another is to take advantage of the Test-
NetConnection PowerShell cmdlet. Running the following command will attempt a connection to
MACHINE on port 5450.

Test-NetConnection MACHINE -Port 5450

If you see an error, the port is blocked. If you don't see an error, the port is open.

2.6 Background: PI Data Archive License File Activation

A License File must be generated before the PI Data Archive server is installed. The OSIsoft Customer
Portal allows you to generate your site-specific PI Server license file. This license file controls which

13 | P a g e
applications can run on the PI Data Archive Server and displays running parameters, such as the point
count limit.

When the license file is generated, view the PI Server Manifest to verify the server details.

In order to generate license file, a Machine Signature File (MSF) is required. The PI Server install kit is
capable to generate the MSF by itself, you must copy the install kit to a local disk on the PI Data Archive
Server computer and then run the kit.
The kit will generate the MSF file to Documents folder of user running it.

i.e. C:\Users\<username>\Documents

If the PI Data Archive Server is on a virtual machine (VM), run the utility on the VM. If you generate the
MSF on the wrong computer (on your laptop, for example) then the license activation file will match the

14 | P a g e
 PI System Administration: Basics

laptop computer. If you install PI Data Archive Server on a different computer or VM, the server will not
run as expected. The license file must be present during the installation. It can be on a flash drive, CD, or
any media that can be read by PI Data Archive Server during installation. The setup program copies the
license file to the %PISERVER%\dat directory during installation; the original file will no longer be used.

For more information, see the PI Data Archive Installation and Upgrade documentation here.

15 | P a g e
3. PI Server Installation

3.1 Hands-On: PI Server Installation

This is a hands-on chapter. It is recommend that you watch the video for
this chapter and follow the steps using your own virtual environment:
https://youtu.be/TcJ2Nw_R1Lk. Below are the configuration steps
Video performed in the video.
In this section we cover PI Server Installation. Documentation referenced in this video can
be found here.
Below is a step-by-step walkthrough on changes that are made to our virtual environment
during this lesson:
Part 1: Data Archive Installation
1. Connect to PISRV01
2. Double click the PI Install Kits shortcut on the desktop
3. Right click → Run as Administrator on the PI Server install kit
4. Click Next
5. Select to install the PI Data Archive role
6. Change the three installation directories so they all point to D:\ instead of C:\,
keeping the rest of the installation paths the same as default
7. Click Next
8. Click the Ellipsis "..." button next to License directory
9. Select the file D:\PI Install Kits\Training License\pilicense.dat
10. Click OK
11. Change the Historical and Future Archive data directories to all point to E:\, keeping
the rest of the installation paths as default
12. Change the Event Queues directory to point to D:\, keeping the rest of the
installation path as default
13. Click Next
14. Click Install, and wait until it finishes.
Part 2: Asset Framework Installation
1. Connect to PISRV02
2. Double click the PI Install Kits shortcut on the desktop
3. Right click → Run as Administrator on the PI Server install kit
4. Click Next
5. Select to install the AF Server and PI Analysis Service roles

16 | P a g e
 PI System Administration: Basics

6. Click Next
7. Click Next on the SQL Server Connection page without making any changes
8. Click Select under the HTTPS section
9. Click OK
10. Click Next
11. Change the PI AF Application Service to run under PISCHOOL\SVC-PIAF$
12. Change the PI Analysis Service to run under PISCHOOL\SVC-PIANALYT$
13. Change the PI SQL DAS to run under PISCHOOL\SVC-PIRTQP$
14. Click Next
15. Click Install, and wait until it finishes.

3.2 Hands-On: Post-Install - Backup

This is a hands-on chapter. It is recommend that you watch the video for
this chapter and follow the steps using your own virtual environment:
https://youtu.be/3b7pLe22Nzs. Below are the configuration steps
Video performed in the video.
Below is a step-by-step walkthrough on changes that are made to our virtual environment
during this lesson:
1. Connect to PISRV01
2. Open a command prompt with the shortcut on the taskbar
3. Type the following commands

D:
cd %piserver%\adm
pibackup E:\PIBackup -install

4. Click the Windows Start button

5. type Task Scheduler and press the enter key on your keyboard
6. Click Task Scheduler Library
7. Right click on PI Server Backup and click Run
8. After a few minutes, ensure the backed up files are created at E:\PIBackup

3.3 Hands-On: Post-Install - Security

This is a hands-on chapter. It is recommend that you watch the video for
this chapter and follow the steps using your own virtual environment:
https://youtu.be/28OSQGrIPVk. Below are the configuration steps
Video performed in the video.

17 | P a g e
In this lesson we assume you will exclusively use the modern method to authenticate
services and users that connect to the PI Data Archive; PI Mappings. We switch off PI Trusts
completely as they're not being used by our system. If your organisation still uses legacy PI
Trusts for authentication, we recommend reading the documentation for configuring PI
Interface connections using PI Trusts to fully understand how these work. Even if your
organisation has existing trusts, we do not recommend creating any new trusts for new
interfaces or services in your system.
Below is a step-by-step walkthrough on changes that are made to our virtual environment
during this lesson:
Part 1: Create a Mapping for your administrator user
1. Connect to PISRV01
2. Through the Start menu, open PI System Management Tools
3. Navigate to Security → Mappings and Trusts
4. Click New Mapping in the top left corner
5. Enter the following
o Windows Account: PISCHOOL\student01
o PI Identity: piadmins
6. Click Create
7. Close and reopen PI System Management Tools
8. Navigate back to Security → Mappings and Trusts
9. Ensure the account name in the bottom left hand corner says
"PISCHOOL\student01 | piadmins, PIWorld". If it still says piadmin (without the s
on the end) go back and begin these steps again.
Part 2: Create an Identity and Mapping for the Analysis Service
1. Navigate to Security → Identities, Users and Groups inside PI System
Administration Tools on PISRV01
2. Click the New Identity button in the top left of the window
3. Type the name SVC-PIANALYT
4. Click Create
5. Navigate to Security → Database Security
6. Double click on PIPOINT
7. Click Add
8. Select SVC-PIANALYT
9. Click Add
10. Check the box next to Write
11. Click OK

18 | P a g e
 PI System Administration: Basics

12. Navigate to Security → Mappings & Trusts

13. Click New Mapping in the top left corner
14. Enter the following
o Windows Account: PISCHOOL\SVC-PIANALYT$
o PI Identity: SVC-PIANALYT
15. click Create
Part 3: Disable the Temporary Lookback Trust [Note: This step should only be done for new
PI Systems, or if you have already checked that you do not have any applications that require
the loopback trusts to be in place to function]
1. Navigate to Security → Mappings & Trusts inside PI System Administration Tools
on PISRV01
2. Click the Trusts tab at the top of the screen, just below the row of buttons
3. Double click the only trust in the list: !Proxy_127!
4. Check Trust is Disabled
5. Click OK
Part 4: Raise the Security Slider to Maximum [Note: This step should only be done for new PI
Systems, or if you have already checked that you do not have any applications that require
trusts to be in place to function]
1. Navigate to Security → Security Settings inside PI System Administration Tools on
PISRV01
2. Drag the Slider up to the top
3. Click Save
Part 5: Restart the Data Archive Services
1. On PISRV01, start a command prompt with the shortcut in the taskbar
2. run the following commands:
D:
cd %piserver%\adm
pisrvstop.bat
pisrvstart.bat

3.4 Knowledge Check: Final Post-Install Tasks

Great, so we've installed our server, let all the services in, and configured backups. Except...
we forgot one service. During installation of the AF server, we were asked for a service
account for the Real-Time Query Processing (RTQP) Engine Service to run under. The RTQP
service requires read access to the PI Data Archive. If we have a service that needs access to
the Data Archive - what do we need to create to let it in?

That's right - a mapping.

19 | P a g e
3.4.1 Exercise - Create a Mapping

Follow the steps below to create the mapping for our RTQP Engine service:

1. Connect to PISRV01
2. Open PI System Management Tools (SMT)
3. Use PI SMT to create an identity for the service, and a mapping for the account to the
new identity. During installation of the AF Server we specified PISCHOOL\SVC-PIRTQP as
the account to run the RTQP Engine Service.

20 | P a g e
 PI System Administration: Basics

4. PI Interface Installation

4.1 Background: How Does the PI System Connect to Data

Sources?
There are a number of software components that can be used to extract data from a data
source and store it in the Data Archive and/or the AF Server. If you have a data source that
you'd like to read from, the easiest way to find the appropriate software component is to
search our Interface List. The search on this page finds any of the below components that can
connect to your desired data source, and directs you to references where you can find out
more.

4.1.1 PI Interfaces

OSIsoft has over 450 different interfaces in it's library of software, and their reliability and
resiliency has made them an industry standard for decades. They do not automatically
synchronise data streams or asset hierarchies from a data source to a PI System. Configuration
and maintenance must be manually done by the administrator for the most part.
We will focus on interfaces in this class because:

• They are by far the most common method of connecting a PI System to a data source that
you will find in the wild
• They require far more maintenance and setup by PI System Administrators than other
connection technologies - if you are a PI System Administrator in the early 2020s in almost
any organisation that uses the PI System, you must be familiar with interface configuration
and maintenance

So even though they are the oldest technology we list on this page - and we recommend using
any of the more modern methods below where possible, we'll still focus on Interfaces in this
course.

21 | P a g e
4.1.2 PI Connectors

PI Connectors follow a much more modern design and architecture, and require considerably
less maintenance and management than interfaces. Their features most notably include
automatic point creation - normally a very time consuming task for PI System Administrators
that manage interfaces. If you can find a PI Connector that supports your data source using the
aforementioned interface list search, you should use it over an equivalent interface in almost
every case. The technologies may not completely overlap and you may need to reconsider your
architecture, but it will be a worthwhile exercise.
For example, you'd like to read from a data source that supports several different OPC
standards. The source is capable of being both an OPC UA and OPC DA server. Is this case you
would most likely be much better off using the PI Connector for OPC UA over the PI Interface
for OPC DA. Before making a choice between connection technologies, thoroughly read the
documentation for each.

4.1.3 PI Adapters

PI Adapters are a newer technology, designed for fast deployment on low-power equipment.
They are not managed through user interaction, but through programmatic service calls.
Configuring PI Adapters are beyond the scope of this course, but if you have a scenario where
there is highly distributed equipment and must extract that data using low-power consuming
devices that must be managed in bulk, you may want to look into PI Adapters. You can find out
more on PI Live Library under the "Edge" subheading.

4.1.4 Custom Applications

Many organizations develop their own applications to both read from and write to the PI
System using technologies such as PI AF SDK, PI Web API, or OMF. The use of these

22 | P a g e
 PI System Administration: Basics

technologies is beyond the scope of this course, but as a PI System Administrator, you should
know that programmatically accessing or writing to the Data Archive and Asset Framework
components is always an option if you can't find an out-of-the-box method of integrating
systems together.

4.2 Hands-On: PI Interface Installation

This is a hands-on chapter. It is recommend that you watch the video for
this chapter and follow the steps using your own virtual environment:
https://youtu.be/emNsxVcfHQE. Below are the configuration steps
Video performed in the video.
Below is a step-by-step walkthrough on changes that are made to our virtual environment
during this lesson:
Part 1: Install the PI Interface Configuration Utility
1. Connect to PIINT01
2. Open the PI Install Kits folder on the desktop
3. On the installer for PI ICU, right click → Run as Administrator
4. Click OK
5. Click OK
6. For the Default Data Server, input: PISRV01
7. Click Next
8. Change the installation directories to install to D: instead of C:. Keep the rest of the
paths the same as the default.
9. Click next, and continue through the rest of the installer
Part 2: Install the PI Interface for OPC DA (Read only)
1. On the installer for the OPC Interface, right click → Run as Administrator
2. Click OK
3. Click OK
4. Click Next
5. Continue through the rest of the installer until it is complete
Part 3: Install the PI API for Windows Integrated Security
1. On the installer for the PI API for Windows Integrated Security, right click → Run as
Administrator
2. Click OK
3. Click Install
4. Continue through the rest of the installer until it is complete

23 | P a g e
4.3 Knowledge Check: Confirming Connectivity

This step should have been done during prerequisites, but it's usually a good idea to make sure
the interface machine can connect to the correct port on the Data Archive machine before even
getting started installing. This way, if the port is blocked you can contact your IT department
and make sure the issue is resolved before you need to configure the system.

1. Open your connection to PIINT01

2. On PIINT01, open a Windows PowerShell console
3. Type and run the following command:

Test-NetConnection PISRV01 -Port 5450

This command will attempt to initiate a TCP connection on port 5450 to PISRV01, our Data
Archive. If successful, it means that we should be able to proceed with our configuration of our
interface. If the command gives an error, it means you need to talk to your IT department about
allowing a connection from your interface machine through to your PI Data Archive on port
5450.

4.4 Hands-On: PI Interface Configuration

This is a hands-on chapter. It is recommend that you watch the video for
this chapter and follow the steps using your own virtual environment:
https://youtu.be/7MyWwfbBVzI. Below are the configuration steps
Video performed in the video.
References in this Video:
• Find more information on the PI Interface for OPC DA here
• Find more information on the PI Buffer Subsystem here
• If configuring an interface instance to read from an OPC Server not on the same
machine as the instance, you must go through DCOM configuration, explained here.
NOTE: During this course we assume that the interface machine is a member of the same
Windows Domain as the PI Data Archive, and set up authentication with this in mind. If
policies within your organisation do not allow this, authentication can still be configured
with the use of Windows Credential Manager. Read more about this in the knowledge base
article here (requires a validated OSIsoft customer portal login account).
Below is a step-by-step walkthrough on changes that are made to our virtual environment
during this lesson:
Part 1: Create the Identity and Mapping for the interface connection on the PI Data Archive
1. Connect to PISRV01
2. Open PI System Management Tools through the Start menu
3. Navigate to Security → Identities, Users and Groups

24 | P a g e
 PI System Administration: Basics

4. Click New... in the top left corner

5. Type the name SVC-PIINT
6. Click Create
7. Navigate to Security → Mappings and Trusts
8. Click New... in the top left corner
9. Type the following details
o Windows Account: PISCHOOL\SVC-PIINT$
o PI Identity: SVC-PIINT
Part 2: Configure the Interface Instance
1. Connect to PIINT01
2. Open the PI Interface Configuration Utility (ICU) from the Start menu
3. Click the Interface menu at the top → New Windows Interface Instance from BAT
File...
4. Select the file D:\Program Files
(x86)\PIPC\Interfaces\OPCInt_ReadOnly\OPCInt_ReadOnly.bat_new
5. Select PISRV01 from the drop down menu
6. Click OK
7. Click the OPCInt menu in the side-bar down the left hand side
8. Click the List Available Servers button
9. Open the drop-down menu under OPC Server Name: and select
OPCSample.OpcDa20Server.1
10. Click Apply in the bottom right corner
11. Click the Service menu in the side-bar down the left hand side
12. Click the Create button
Part 3: Configure Buffering
1. On PIINT01, Inside the ICU, click the menu at the top of the window Tools →
Buffering
2. Click Yes
3. Click Continue with configuration
4. Check the box next to PISRV01
5. Click Next
6. Click Next, then click Yes
7. Change the Buffer location to D:\Buffer
8. Click Next

25 | P a g e
 9. Click Exit new installation wizard
Part 4: Configure Service Accounts
1. On PIINT01, open Computer Management with the shortcut in the taskbar
2. Navigate to System Tools → Local Users and Groups → Groups
3. Double Click on PI Buffering Administrators
4. Click Add
5. search for the account svc-piint and click Check Names, then OK
6. Click OK
7. Open the Windows Services applet with the shortcut in the taskbar
8. On the PI Buffer Subsystem service right click → Properties
9. Go to the Log On tab
10. Change it to run under This account and fill in PISCHOOL\SVC-PIINT$ as the name,
and leave the passwords blank
11. Click OK, and OK again until you are brought back to the services console
12. Repeat steps 8 through 11 for the PI-opcint_ReadOnly1 service, making it also run
under the PISCHOOL\SVC-PIINT$ account
13. Right click and restart the PI Buffer Subsystem service
14. Close all ICU and Buffer Manager windows
Part 5: Configure Dependencies and Start the Interface Instance
1. On PIINT01, open the ICU
2. Select opcint_ReadOnly1 -> PISRV01 from the large drop down select box at the top
of the window
3. Click the Service menu in the side-bar down the left hand side
4. Click Yes
5. Click the play ► button at the top of the window to start the interface

4.5 Knowledge Check: The Bufferer, the Betterer

We have configured an interface, configured buffering for it, and confirmed that everything is
working. But, there's another opportunity to configure buffering in our system.

The PI Analysis service, which we installed on PISRV02, also writes data to the PI Data Archive.
The Analysis service is in charge of watching the Asset Framework server for calculations and
analytics it should run, running the analytics, and writing the results to PI Points. Actual
configuration of these calculations is done in other training classes and we won't configure
them here, but it's our responsibility to make sure things work reliably once analytics start

26 | P a g e
 PI System Administration: Basics

running. Because the analysis service needs to write to PI Points, it also benefits from buffering
being configured. Follow the below steps to configure buffering for this service.

Note: When performing most actions in this course in a production environment, you should
not be logging directly into the server machines. This activity is on exception, however. You
must configure buffering while being logged in to the machine itself.

1. Connect to PISRV02
2. The Interface Configuration Utility isn't installed on this machine - but that's ok. We can
access the buffer manager from PI System Explorer (PSE) too. Open PSE by clicking Start
> PI System > PI System Explorer.
3. Select Tools > Buffering Manager
4. Click Yes to the question asking if you'd like to configure buffering
5. Click Continue with Configuration
6. Change the Buffer location to D:\Buffer
7. Click Next
8. Exit the Wizard

Now we've configured buffering, we need to make sure it connects to the PI Data
Archive using an account that can write to analysis points. In an earlier exercise, we
configured the SVC-PIANALYT group managed service account to have these privileges.

9. Open the Windows Services panel by clicking on the icon for it in the taskbar
10. Modify the PI Buffer Subsystem service so it logs in as the PISCHOOL\SVC-PIANALYT
account (hint: this account is a group-managed service account so you may need to do
special things with dollar signs and passwords. If you don't know what to do, the
configuration is very similar to the configuration we did in the interface buffering video,
but with a different account this time).
11. Create a service dependency for PI Analysis Service on PI Buffer Subsystem to ensure
that PI Buffer Subsystem starts first on machine start. To do this, run Windows
command prompt with the icon in the taskbar and execute the following command:

SC CONFIG PIAnalysisManager depend= pibufss

12. Open Computer Management from the Windows Start menu. Navigate to System Tools
→ Local Users and Groups → Groups
13. Double click on the PI Buffering Administrators group, and add the SVC-PIANALYT
account to the group
14. Use the Windows Services panel to restart the PI Buffer Subsystem service. It should
warn you that it will restart the PI Analysis service as well.
15. Close and reopen Buffering Manager. The status indicator should be green if you have
configured buffering correctly.

27 | P a g e
5. PI Point Management

5.1 Hands-On: Creating Points for Interfaces

This is a hands-on chapter. It is recommend that you watch the video for this
chapter and follow the steps using your own virtual environment:
https://youtu.be/n89Acel0Q40. Below are the configuration steps performed in
Video the video.

References for this video:

• In this video we cover creating our first point that will be loaded on our OPC
Interface instance. All point attribute configuration for the OPC Interface is detailed
here.
• When using other interfaces, check the documentation for appropriate PI Point
configuration. All interfaces have a similar point attribute configuration section in
their documentation.
Below is a step-by-step walkthrough on changes that are made to our virtual environment
during this lesson:
Part 1: Create a Point
1. Connect to PISRV01
2. Open PI System Management Tools (SMT) from the Start menu
3. Navigate to Points → Point Builder
4. Fill in the following attributes, on their corresponding tabs:
o General
▪ Name: pump1.bearingtemp
▪ Descriptor: Bearing Temperature of Pump 1
▪ Point Source: OPC
▪ Eng Units: degc
o Classic
▪ Location 1: 1
▪ Location 2: 0
▪ Location 3: 1
▪ Location 4: 1
▪ Location 5: 0
▪ Instrument Tag: Sample Process/Pump1/BearingTemp

28 | P a g e
 PI System Administration: Basics

o Security
▪ Data Security → Add... → SVC-PIINT → Check both the Read and
Write boxes
5. Click Save in the top left
6. Wait for at least 2 minutes
Part 2: Confirm the new tag is receiving new data
1. On PISRV01 inside SMT, navigate to Data → Current Values
2. Click the Tag Search in the top left corner
3. Enter a Point Source of opc
4. Click Search
5. Click Select All
6. Click OK
7. Click the play ► button at the top of the window to start updating values
8. Ensure your tag's value changes every few seconds

5.2 Background: Explore PI Points and Interfaces

This is a background chapter with video content only. It is recommend that you
watch the video for this chapter: https://youtu.be/Yleu86Y3SH4.
Video

5.3 Background: Compression and Exception

This is a background chapter with video content only. It is recommend that you
watch the video for this chapter: https://youtu.be/6-scv3oQ7Kk.
Video

Exception and Compression for points is controlled on a point-by-point basis. The Excdev,
Excmax, Compdev and Compmax explained in the video are in the "archive" tab on Point
Builder in PI System Management Tools. Go ahead and look at the settings on the points you
already have set up.
For more details on how Exception and Compression works, see the full details video.

5.4 Reference: The Interface User Manual

Every PI System component, including Interfaces, has a corresponding User manual.
Documentation for the most common interfaces and connectors can be found on OSIsoft Live
Library, under the "Interfaces and Connectors" subheading (you may need to click the "+ View

29 | P a g e
More" button below to see the whole list). In this class we're using the PI Interface for OPC DA,
who's documentation can be found here.
As a PI System Administrator, you'll become very familiar with the documentation for the
interfaces your organisation uses. The most common places you'll refer to are the sections for
PI Point Configuration. We recommend reading through some of this section now and growing
accustomed to it, now you know the basics of creating points in the PI Data Archive. Every
interface has a similar section, and most interfaces have different requirements when it comes
to point configuration - you'll need to read this section of the documentation each time you're
configuring a new interface type.

5.5 Knowledge Check: Creating Digital Points

5.5.1 Introduction to Digital Points

When creating a PI Point, you must specify a Point Type. So far we've only used the default float32 point
type, which allows a point to store single-precision floating-point numbers. The PI Data Archive also
allows you to store a few other types of data, most notably digital data.

5.5.2 Digital State Sets

PI Points of type Digital are used to store data values that have discrete states exemplified above.
Example of typical states are Open/Closed for a valve or On/Off for a switch. While the user is interested
in the actual state, PI Data Archive stores this information as an integer. This integer is then associated
with a Digital State Set; a grouping of these states. Whenever the value is requested, PI Data Archive

30 | P a g e
 PI System Administration: Basics

retrieves the integer value, does a lookup in the Digital State Set, and then presents the associated text
value.

Digital Sets are kept in a common table for all points of type Digital to access. The Digital State Set must
exist prior to the creation of the digital point. When defining a point use the DigitalSet attribute to store
the associated Digital Set name. The digital states are case preserving, but not case sensitive, so you can
refer to them with upper and lower case, but any display will show the configured upper or lower case.
There is a large default set called System that contains system error messages and other information. All
points, including non-digital points, can receive and archive a state from the System digital states set
(Shutdown, PtCreated, Over Range, Under Range, I/O Timeout, etc.).

Warning: Do not edit the SYSTEM set on your PI System!

5.5.3 Exercise: Create a Digital State Set and Point

One of the tags on our OPC Server is a digital tag. It has an itemID of Sample Process/Pump1/Status.
The tag sends through integers 0 through 4, and you've asked the operations team what these numbers
correspond with. You'd like your users to see the name of the state rather than just the number when
they're looking at the tag's value in the system.

State Name State Number

Off 0

Startup 1

Running 2

Warning 3

Error 5

We'd like to create a point to archive this controller’s mode of operation. However, in order to build the
point, you will first need a digital state set.

1. On PISRV01 open the PI SMT and navigate to Points → Digital States plug-in.

2. Create new Digital State Set called PumpStatus.

3. Fill the State Names according the table above.

4. Save it and restart PI SMT. We need to do this for the Point Builder to pick up the new state set.

5. Navigate to Points → Point Builder plug-in.

6. Create a new point with the following attributes:

o General Tab: Name: pump1.status; Description: Status of Pump 1; Point Source: OPC;
Point Type: Digital; Digital Set: PumpStatus

31 | P a g e
 o Classic Tab: Location 1: 1; Location 3: 1; Location 4: 1; Instrument Tag: Sample
Process/Pump1/Status

o Security Tab: Add the SVC-PIINT identity to Data Security, and give it Read/Write
permission

7. Save the configured PI Point.

8. Wait for the PI Interface to start collecting data for the new point.

9. Check the updates in Data → Current Values.

5.6 Knowledge Check: Confirming Interface Operation

You should now have a working interface. This exercise will guide you through some
checks to confirm its operation.

5.6.1 Part 1: Check that you are receiving data for all points belonging to the interface
in the PI Data Archive

You should now have a working interface. This exercise will guide you through some checks to
confirm its operation.

Part 1: Check that you are receiving data for all points belonging to the interface in the PI Data
Archive

1. Connect to PISRV01
2. Open PI System Management Tools (SMT)
3. Navigate to Data > Current Values
4. Search for all points that share a point source with your interface, and add them to the
list of tags in the Current Values plugin
5. Ensure all points have recent timestamps (note that the virtual environment is in UTC,
and may have a different timezone to your own), and click the Start Updating button.
You should see new values come through every now and again.

5.6.2 Part 2: Check that data is flowing through the buffer

Note: It is possible for an interface to be sending data to the PI Data archive without it travelling
through the buffer - but this is not what we want. Follow these steps to ensure that your data is
being properly buffered by the PI Buffer Subsystem before being sent on to the PI Data Archive

1. Connect to PIINT01
2. Open the PI Interface Configuration Utility (ICU)
3. Navigate to Tools > Buffering

32 | P a g e
 PI System Administration: Basics

4. Ensure that the X total events sent is greater than zero, and you are getting a non-zero
number of events per second. The number of total events sent should be increasing
over time.
5. Ensure that the X events in queue settles at around zero events. Every now and again it
may increase to a number greater than zero, then settle down again. You can use these
numbers to diagnose issues. If the X events in queue number is going up, it means that
the buffer is having trouble connecting to the PI Data Archive or does not have
adequate bandwidth to send all the data it needs to. If the X total events sent number
is not increasing, it means that the interfaces on this machine are not generating and/or
sending data through - this is most likely a problem with the interface configuration and
the interface message log should point you in the right direction.

5.7 Hands-On: Creating Points in Bulk

This is a hands-on chapter. It is recommend that you watch the video for this
chapter and follow the steps using your own virtual environment:
https://youtu.be/XJwH_WZgob0. Below are the configuration steps performed in
Video the video.
Note: When opening Excel for the first time, you may be asked if you want to install the PI
Builder Plugin. If you are, select Install. If you still do not see the PI Builder ribbon when you
open a new workbook, you can enable it by doing the following:
1. Click the File ribbon in the top left corner of the window
2. Click Options
3. Select the Add-Ins option in the left sidebar
4. Change the drop-down select menu, Manage: COM Add-ins
5. Click Go...
6. Check the box next to PIAFBuilder
7. Click OK
8. You should now see the PI Builder ribbon at the top of the window
During this exercise, we connect to PISRV01 and modify the spreadsheet "C:\Class
Documents\Exercise Files\tag export from DCS.xlsx". To skip the work done in this video and
go straight to the solution, you can do the following:
1. Connect to PISRV01
2. Open C:\Class Documents\Exercise Files\Solution\Pump Current Point Creation
Solution.xlsx
3. Select the PI Builder ribbon
4. Ensure the Data Server in the top left is PISRV01
5. Click the Publish button
6. Select Create and Edit in the select box

33 | P a g e
 7. Click OK
8. If you receive any errors about digital state sets, see the previous lesson Creating
Digital Points.
(In the video we specifically say NOT to use create and edit mode. This is specifically aimed
at those modifying production systems. In this case, because we're applying a solution, it
doesn't matter much and we do want to overwrite all current configuration)

5.8 Knowledge Check: The PI Data Archive Message Log

A very important part of troubleshooting and configuring a PI System is becoming familiar with
the message logs on both the PI Data Archive and your Interface machines.

5.8.1 Exercise - Explore the PI Data Archive Message Log

1. Connect to PISRV01
2. Open PI System Management Tools{ (SMT) and navigate to Operation > Message Log
3. Click the Retrieve Messages button in the top left. It is shaped like a magnifying glass. If
no messages are returned, you may need to modify the "End:" entry and search for
messages over a larger time range.

4. Scroll through the log, and modify the start and end times where needed. Try to find
messages similar to the following:

[Server] PISRV01 [ID] 7082 [Time] 10/16/2020 2:59:19 AM [Program] pinetmgr [Priority] 10
[ProcessOSUser] pinetmgr [ProcessID] 3252 [Severity] Debug
Successful login ID: 16. Address: . Name: SMTHost.exe. Identity List: piadmins | PIWorld. Environment
Username : PISCHOOL\student01. Method: Windows Login (SSPI,NTLM,HMAC-MD5,RSADSI RC4,128)

This message indicates that a successful connection was made from SMThost.exe (the
name for the PI System Management Tools application), by PISCHOOL\student01 (the
Windows account we are logged in with). This is the confirmation message that
appeared in the log just now when we opened up SMT and connected. Every connection
attempt is logged in the PI Server message log. This makes it an incredibly useful tool for

34 | P a g e
 PI System Administration: Basics

troubleshooting security problems. In the next few steps, we're going to create own
security problem and see what the log files look like throughout.

5. In SMT, navigate to Security > Mappings & Trusts.

6. Double click on the mapping for SVC-PIINT, check the box next to Mapping is disabled
and click ok.
7. On PIINT01, open the PI ICU and open a scrolling log with the View current PI Message
log continuously button. [Note: The Message log on an interface machine can also be
viewed and searched with an installed application called PI SDK Utility, available on the
Windows Start menu]
8. Open Windows Services, and restart the PI Buffer Subsystem service. Select Yes to the
prompt asking if you want to also restart your interface.
9. You should see an error message in your scrolling log similar to the following:

E 16-Oct-20 03:14:22 pibufss:pibufmgr<PISRV01> (2102)

>> Error connecting to server PISRV01:5450, [-10431] Authentication method is disabled by current
server policy
Attempt 1: [SSPI], [-10407] No Access - Secure Object, details: none
Attempt 2: [TRUST], [-10431] Authentication method is disabled by current server policy, details: none

This error indicates that the buffer attempted to connect to the Data Archive, but it was
not allowed in. A good rule of thumb is that if you see any error in a log with an error
code in the form 104XX - you should check your mappings and trusts, and make sure
that the account has the required privileges.

10. On PISRV01, in SMT, navigate back to the Message Logs and click Retrieve Messages.
Try to find some messages like the following:

[Server] PISRV01 [ID] 7138 [Time] 10/16/2020 3:20:22 AM [Program] pinetmgr [Priority] 10
[ProcessOSUser] pinetmgr [ProcessID] 3252 [Severity] Information
Unsuccessful login ID: 28. Address: 192.168.0.22. Name: pibufss(5348):remote. Credentials used:
PISCHOOL\SVC-PIINT$. Method: Windows Login (SSPI,Kerberos,HMAC-SHA1-96,Kerberos AES256-CTS-
HMAC-SHA1-96,256). Error: [-10433] No identity mapping for this request

[Server] PISRV01 [ID] 7138 [Time] 10/16/2020 3:20:22 AM [Program] pinetmgr [Priority] 10
[ProcessOSUser] pinetmgr [ProcessID] 3252 [Severity] Information
Unsuccessful login ID: 28. Address: 192.168.0.22. Name: pibufss(5348):remote. Credentials used:
PISCHOOL\SVC-PIINT$. Method: Trust. Error: [-10431] Authentication method is disabled by current
server policy

These messages indicate that the buffer attempted to authenticate to the data archive
using a Mapping, then a legacy Trust. Both have failed.

11. On PISRV01, in SMT, navigate back to Mappings & Trusts and re-enable your mapping.
Before clicking OK, change its PI Identity to piusers. This will make your interface be
given the piusers identity instead of the SVC-PIINT identity.

35 | P a g e
 12. On PIINT01, restart the PI Buffer Subsystem service
13. Check your scrolling log. You should see a lot of errors similar to the following:

E 16-Oct-20 03:29:14 pibufss:pibufmgr<PISRV01> (2111)

>> Error -10401 encountered while posting to point ID 28.
event time: 16-Oct-20 03:28:55.24400, value: 103.08, mode: precomp_arc.

This error indicates that the buffer service cannot write to this point because it doesn't
have permission to. By default the piusers identity doesn't have write access to tags,
only read access. Note the 10401 error code. If we got this error in a production system,
we'd go straight for the security tabs to check configuration to try to clear this error.

14. Check your PI Server message log again, and click Retrieve messages. You should see
this message:

[Server] PISRV01 [ID] 7082 [Time] 10/16/2020 3:28:54 AM [Program] pinetmgr [Priority] 10
[ProcessOSUser] pinetmgr [ProcessID] 3252 [Severity] Debug
Successful login ID: 34. Address: 192.168.0.22. Name: pibufss(944):remote. Identity List: piusers |
PIWorld. Environment Username : PISCHOOL\SVC-PIINT$. Method: Windows Login (SSPI,Kerberos,HMAC-
SHA1-96,Kerberos AES256-CTS-HMAC-SHA1-96,256)

Our buffer subsystem has connected with the identity "piusers". When troubleshooting,
we use both the logs on the Interface, and on the PI Data Archive to identify the
problem here. We see that the interface is connecting as the identity "piusers", and it is

36 | P a g e
 PI System Administration: Basics

having trouble writing to the interface's points. We can conclude that the "piusers"
identity doesn't have permission to write to the points.

15. On PISRV01, in SMT, navigate back to Mappings & Trusts and change the mapping's PI
Identity back to SVC-PIINT.
16. On PIINT01, restart the PI Buffer Subsystem service.
17. Check message logs on both the interface and the Data Archive. All errors should now
be cleared.

When going through the rest of this class, we recommend coming back to the PI Data Archive
message log and taking a look at the messages every now and then. When newly installed and
configured services connect, and when troubleshooting any issues you face, you'll find a wealth
of information in this log.

5.9 Knowledge Check: Creating More Points

Right after we created our points in bulk - one of your engineers called you and ask you to
also add another tag for pump input current. They've helpfully given you a DCS export for
the current tags for your pumps, but it's in a different format to the last one they gave you!

5.9.1 Exercise - Create Points for Pump Current

1. Connect to PISRV01
2. Open the Exercises folder on the desktop, and navigate to the spreadsheet called
"currenttags.csv".
3. Edit the file in Microsoft Excel so PI Builder can export the tags to the PI Data
Archive, then export them.
4. Use the Current Values plugin in PI SMT to ensure you're seeing new data come in
to the PI Data Archive for your new tags for pump current.

5.9.2 Exercise Solution

A solution spreadsheet can be found inside the Exercises folder on your virtual environment.
To skip this exercise and simply apply the solution, do the following:
1. Connect to PISRV01
2. Open C:\Class Documents\Exercise Files\Solution\Bulk Point Creation
Solution.xlsx
3. Select the PI Builder ribbon
4. Ensure the Data Server in the top left is PISRV01
5. Click the Publish button
6. Select Create

37 | P a g e
 7. Click OK

38 | P a g e
 PI System Administration: Basics

6. Improving Interface Reliability

6.1 Background: Interface Redundancy

This is a hands-on chapter. It is recommend that you watch the video for this
chapter and follow the steps using your own virtual environment:
https://youtu.be/atAFzUHx9jg. Below are the configuration steps performed in
Video the video.
References used in this video:
• For different failover scenarios and how the interface reacts, see this chapter in the
documentation.

6.2 Knowledge Check: Preparing a Second PI Interface

We're about to set up two interfaces to be a redundant pair. But before we do that - we have to
have a second interface machine, with exactly the same configuration as the first.

6.2.1 Exercise: Configure an OPC Interface on PIINT02

We'll need our PIINT02 configured in exactly the same way as our PIINT01. Follow the steps
below. You may need to refer to earlier lessons in this course if you don't remember the exact
steps. The "PI Interface Configuration" lesson earlier in the course covers steps 2 through 4 of
this exercise.

1. To save time, the PI Interface for OPC DA, the Interface Configuration Utility (ICU) and the PI API
for Windows Integrated Security are already installed on PIINT02 - there's no need to run the
installers, and no need to juggle while you wait for the install to complete. Open the ICU and
move to the next step.
2. Configure an OPC Interface Instance on PIINT02, using the same settings as on PIINT01. Do not
start the interface yet.
3. Configure Buffering on PIINT02.
4. Configure the interface instance and the PI Buffer Subsystem to run under the SVC-PIINT
account, and give the account appropriate permissions to run the buffer.
5. Connect to PIINT01 and turn off the interface with the stop button on the ICU.
6. Start the new interface instance on PIINT02. Ensure you are getting updated data by viewing the
interface's points in PI System Management Tools.

Once you have data flowing, you're ready for the next lesson.

39 | P a g e
6.3 Hands-On: Configure UNIINT Failover
This is a hands-on chapter. It is recommend that you watch the video for this
chapter and follow the steps using your own virtual environment:
https://youtu.be/hranir0BEM4. Below are the configuration steps performed in
Video the video.
Below is a step-by-step walkthrough on changes that are made to our virtual environment
during this lesson:

6.3.1 Part 1: Prepare the shared folder

1. Connect to PIINT02
2. Open Windows File Explorer using the shortcut on the taskbar
3. Navigate to D:
4. Right click in the white space and create a new folder called Interface Failover
5. On your new folder, Right click → Properties
6. Select the Sharing tab
7. Click Advanced Sharing
8. Check Share this folder
9. Click the Permissions button
10. Click the Add... button
11. Click the Object Types button
12. Check Service Accounts
13. Click OK
14. Enter the object name SVC-PIINT$ and click Check Names
15. Click OK
16. Check the Full Control → Allow checkbox
17. Click OK

6.3.2 Part 2: Configure failover on one interface

1. On PIINT02, Open the PI Interface Configuration Utility (ICU)

2. Select the interface instance opcint_ReadOnly1 -> PISRV01 from the Interface drop-
down select box
3. Select the UniInt → Failover menu on the left side of the window
4. Check the Enable UniInt Failover checkbox
5. Enter the following numbers:
o Failover ID# for this instance: 2

40 | P a g e
 PI System Administration: Basics

o Failover ID# of the other instance: 1

6. Click the Browse button next to Failover ID# of the other instance
7. Select PIINT01 → opcint_ReadOnly1
8. Click OK
9. Under UFO Type: select HOT
10. Right click on one of the tags in the table below and click Create UFO_State Digital
Set on Server PISRV01
11. Click OK
12. Right click on one of the tags in the table below and click Create all points (UFO
Phase 2)
13. Under Synchronization File Path: click the Browse button
14. In the address bar, enter \\PIINT02\Interface Failover
15. Click Open
16. Click Apply in the bottom right
17. Click OK
18. Restart the interface with the restart button at the top of the window

6.3.3 Part 3: Fix security for UFO status tags

1. On PISRV01, open a new blank workbook in Microsoft Excel

2. Select the PI Builder Ribbon
3. Ensure you have PISRV01 selected as the Data Server in the top left
4. Click PI Points → Find PI Points
5. Enter a search of *ufo* and click Search
6. Click OK
7. Click Clear All
8. Select the checkbox Security → datasecurity
9. Add the string " | SVC-PIINT: A(r,w)" to each row in the datasecurity column
10. Click Publish
11. Select Edit Only
12. Click OK

6.3.4 Part 4: Configure failover on the second interface

1. On PIINT01, open the ICU

41 | P a g e
 2. Select the interface instance opcint_ReadOnly1 -> PISRV01 from the Interface drop-
down select box
3. Select the UniInt → Failover menu on the left side of the window
4. Check the Enable UniInt Failover checkbox
5. Enter the following numbers: [NOTE: THESE ARE OPPOSITE TO THE NUMBERS IN
PART 2]
o Failover ID# for this instance: 1
o Failover ID# of the other instance: 2
6. Click the Browse button next to Failover ID# of the other instance
7. Select PIINT02 → opcint_ReadOnly1
8. Click OK
9. Under UFO Type: select HOT
10. Right click on one of the tags in the table below and click Create UFO_State Digital
Set on Server PISRV01
11. Click OK
12. Right click on one of the tags in the table below and click Create all points (UFO
Phase 2)
13. Under Synchronization File Path: click the Browse button
14. In the address bar, enter \\PIINT02\Interface Failover [NOTE: THIS IS THE SAME
LOCATION AS THAT CONFIGURED IN PART 2]
15. Click Open
16. Click Apply in the bottom right
17. Click OK
18. Restart the interface with the restart button at the top of the window

6.3.5 Part 5: Configure Disconnected Startup

1. On PIINT02, open the ICU

2. Select the UniInt → Disconnected Startup menu on the left side of the window
3. Check the box for Enable disconnected startup (with point caching)
4. Next to Cache Path: click Browse
5. Click OK
6. Click Apply
7. Start or restart the interface with the buttons at the top of the window
8. Repeat steps 1 through 7 with PIINT01

42 | P a g e
 PI System Administration: Basics

6.4 Knowledge Check: Interface Health Points

6.4.1 UniInt Health Points

UniInt Health Points are PI Points that collect information about the health of the interface.
They are created from the PI ICU, in the UniInt > Health Points section:

OSIsoft recommends that, at minimum, the following UniInt Health Points be created:
1. Heartbeat: This PI Point indicates whether or not the interface is running. The
heartbeat point is updated continuously unless the interface is shut down or in a
deadlock situation. As long as the interface is running, the value of the point cycles
incrementally from 1 to 15. The heartbeat point does not indicate whether the
interface is connected to or collecting data from a data source.
2. Device Status: This PI Point contains information about communication between
the interface and the data source. During normal operation, it contains the value
GOOD, indicating that the interface is communicating properly with the data source.
Otherwise, the point contains a string indicating status, formatted as follows:

43 | P a g e
 Status code | Description | Interface-specific text.

Example:
95 | Device(s) in error
This device status means that the PI Interface cannot communicate with the data
source.
3. IO Rate: This PI Point keeps a count of all point values (inputs, outputs, triggered
inputs) being sent to the Data Archive. If the value stops updating, the interface has
stopped collecting data.
4. Scan Class Scans Skipped: This PI Point counts, for a specific scan class, “skipped
scans”, i.e the number of scans that were not performed before the scan time
elapsed and the next scheduled scan was executed, for a defined reporting period (8
hours by default)

6.4.2 Exercise - Create UniInt health points for both of your Interface instances

1. On PIINT01, run PI ICU and browse to UniInt → Health Points

2. Right-click on the following Health Points and select Create:
o Heartbeat
o Device Status
o IORate
o Scan Class Scans Skipped.sc0
3. On PISRV01, using SMT, verify whether these Health Points are receiving data using
the Current Values plugin. If they are not receiving data, correct the problem, then
restart the interface. You may need to look in the interface message log for clues. If
you can't find and correct the problem, see "Health Points Solution.pdf" attached
to this lesson.
4. Repeat the above steps for the interface instance on PIINT02

44 | P a g e
 PI System Administration: Basics

7. Managing User Access

7.1 Hands-On: Data Archive Security

This is a hands-on chapter. It is recommend that you watch the video for this
chapter and follow the steps using your own virtual environment:
https://youtu.be/0oMVa5NgjQY. Below are the configuration steps performed in
Video the video.
References
• Full documentation on Data Archive security can be found here.
Below is a step-by-step walkthrough on changes that are made to our virtual environment
during this lesson:
Part 1: Configure security for PI Administrators
1. On PISRV01, open PI System Management Tools (SMT)
2. Navigate to Security → Mappings & Trusts
3. Click the New... button in the top left of the window
4. Enter Windows Account: PISCHOOL\PI Administrators
5. Enter PI Identity: piadmins
6. Click Create
Part 2: Configure security for PI Interfaces
1. On PISRV01, open SMT and navigate to Security → Identities, Users & Groups
2. Double click on SVC-PIINT
3. Change its name to PI Interfaces
4. Navigate to Security → Mappings & Trusts
5. Click the New... button in the top left of the window
6. Enter Windows Account: PISCHOOL\PI Interfaces
7. Enter PI Identity: PI Interfaces
8. Click Create
Part 3: Configure security for PI Users
1. On PISRV01, open SMT and navigate to Security → Identities, Users & Groups
2. Click the New... button in the top left of the window
3. Enter the Name: PI Users
4. Click Create
5. Navigate to Security → Mappings & Trusts

45 | P a g e
 6. Click the New... button in the top left of the window
7. Enter Windows Account: PISCHOOL\PI Users
8. Enter PI Identity: PI Users
9. Click Create
Part 4: Configure security for PI Point and Analysis Creators
1. On PISRV01, open SMT and navigate to Security → Identities, Users & Groups
2. Click the New... button in the top left of the window
3. Enter the Name: PI Point and Analysis Creators
4. Click Create
5. Navigate to Security → Mappings & Trusts
6. Click the New... button in the top left of the window
7. Enter Windows Account: PISCHOOL\PI Point and Analysis Creators
8. Enter PI Identity: PI Point and Analysis Creators
9. Navigate to Security → Database Security
10. Double click on PIPOINT
11. Click Add...
12. Select PI Point and Analysis Creators
13. Click Add
14. Click OK
15. Check the Write checkbox
16. Click OK
Part 5: Clean up unneeded identities
1. On PISRV01, open SMT and navigate to Security → Identities, Users & Groups
2. Right click → delete the following identities:
o PIEngineers
o PIOperators
o PISupervisors

7.2 Background: What is Asset Framework?

This is a background chapter with video content only. It is recommend that you
watch the video for this chapter: https://youtu.be/VWrxS48PpjY.
Video

46 | P a g e
 PI System Administration: Basics

This video provides some background if you are not familiar with Asset Framework. The next
lesson will go into how data flow works between Asset Framework and Data Archive, and
security on Asset Framework objects.

7.3 Hands-On: Asset Framework Security

This is a hands-on chapter. It is recommend that you watch the video for this
chapter and follow the steps using your own virtual environment:
https://youtu.be/oQHBhSzRI0E. Below are the configuration steps performed in
Video the video.
References
• Full documentation for Asset Framework security can be found here.
Note: This video assumes that all "Power Users" in your organisation belong to both the PI
Users and PI Power Users active directory groups. If this is not the case, some extra
configuration is needed to allow the Power Users to connect to the server at the top level.
For directions on these steps, see the next exercise.
Below is a step-by-step walkthrough on changes that are made to our virtual environment
during this lesson:

7.3.1 Part 1: Prepare Production and Development AF Databases

1. Connect to PISRV01
2. From the Windows Start Menu, open PI System Explorer
At this point, depending on what configuration you've done so far, you may be asked "There
are no PI AF Servers defined. Do you want to define one?" If you are, click Yes, then enter
PISRV02 as the host, and click OK.

If you get an error popup saying "Could not connect to net.tcp://pisrv01:5457...", this
indicates that your PISRV01 thinks that it has an AF server installed on it - which it doesn't.
To fix this and instead point at the AF server installed on PISRV02, click OK, wait for the
connection to time out, then click Select. Click the ... ellipsis next to the PISRV01 dropdown
menu, right click on PISRV01, select Properties, rename the Host to PISRV02, and click OK,
then OK, then Connect.
3. Click the Database button in the top left of the window
4. Right click on Database1 and rename it to Production (or if you don't have
Database1, click New Database and create a new one called Production)
5. Click the New Database button in the top left of the window
6. Name the new database Development
7. Click OK

47 | P a g e
7.3.2 Part 2: Configure security for PI Administrators

1. Connect to PISRV01, open PI System Explorer, and click the Database button in the
top left of the window
2. Click the small Show Properties button next to the greyed out Connect button
3. Select the Mappings tab
4. In the white space below the list of mappings Right Click → New Mapping
5. Type Account: PISCHOOL\PI Administrators
6. Select Identity: Administrators
7. Click OK
8. On the BUILTIN\Administrators mapping Right Click → Delete
9. Click OK

7.3.3 Part 3: Configure security for PI Users

1. Ensure you have the Mappings tab open in the PI AF Server Properties window
2. In the white space below the list of mappings Right Click → New Mapping
3. Type Account: PISCHOOL\PI Users
4. Select Identity: World
5. Click OK
6. On the Everyone mapping Right Click → Delete
7. Click OK

7.3.4 Part 4: Configure security for PI Power Users

1. Ensure you have the Identities tab open in the PI AF Server Properties window
2. In the white space below the list of identities Right Click → New Identity
3. Type Name: Power Users
4. Click the Mappings tab
5. Click Add...
6. Type Account: PISCHOOL\PI Power Users
7. Click OK
8. Click OK to leave the PI AF Server Properties window completely and return to the
Select Database window
9. On the Development database, Right Click → Security
10. Click Add...
11. Select Power Users

48 | P a g e
 PI System Administration: Basics

12. Click OK
13. Click OK to return to the Select Database window

7.4 Knowledge Check: Contractor Access

A common scenario that requires a more complex security setup is when you have a group
of contractors who need limited access to the system. where you may want to give
employees and contractors different access to the PI System. In this exercise you will
configure a model like this for your system, then test the configuration to make sure
contractors don't have access to data that they shouldn't be able to see. For a full step-by-
step solution to this exercise, see the attached "Contractor Security Solution.pdf" to the
online version of this lesson.

7.4.1 Part 1: Prepare your Data Archive and Asset Framework

• Create an identity for PI Contractors on both the Data Archive using System
Management Tools (SMT), and Contractors on the Asset Framework server using PI
System Explorer (PSE). For a step-by-step on how to do this, see the respective
lessons on Data Archive security and Asset Framework security.
• Create a mapping to the new identity for the group PI Contractors on both the Data
Archive and Asset Framework.
• On the Asset Framework Server, there is one extra configuration step that needs to
be completed to allow the contractors to connect to the server at the top level. Just
because a user has permission to see a database, it doesn't mean they're allowed to
connect to the server itself. The Contractors are not members of the PI Users active
directory group and will not be allowed in under the World identity we set up in the
previous lesson. Unlike the PI Data Archive, the World identity isn't given to all
authenticated connections automatically.
1. Connect to PISRV01, open PI System Explorer, and click the Database
button in the top left of the window
2. Click the Edit Security button at the top of the Select Database window.
This allows you to edit permissions to the server at the top level.
3. Click Add...
4. Select Contractors
5. Uncheck all Allow boxes except for Read and Read Data. This will modify all
permissions on the server, allowing contractors to connect and see all
objects. This is fine for now, don't worry - we're going to lock it down in the
next part of this exercise.
6. Click OK

49 | P a g e
7.4.2 Part 2: Satisfying a new management request

Management at our company has decided that the Status points for our pumps contain
confidential business information, It is important that our contractors cannot see these
points. In a previous exercise, we named these points with the convention PumpX.Status,
where X is the number of the pump.
• Configure the security on the Status tags so that the contractors cannot read their
data, or even see that they exist.

7.4.3 Part 3: Satisfying another management request

You've been asked to prepare a new database on Asset Framework, hosting data for Remote
Assets. The contractors have been hired to manage these assets, but as they are not
employees they are not permitted to see the Production or Development databases.
• Use PSE to create an additional database called Remote Assets, and allow your
contractors to view it, but not write to it.
• Configure the security for each of your other databases to block access to your
contractors completely.

7.4.4 Part 4: Check if your changes worked

1. Open extra copies of SMT and PSE as a contractor to check their access. To open
them as a contractor, follow these steps:
1. Right click on the application on your windows Taskbar
2. Hold the Shift key and right click on the name of the application
3. Select Run as different user
4. We'll run these applications as student04, who is in the domain group "PI
Contractors". For the credentials, enter:
▪ User: PISCHOOL\student04
▪ Password: *enter the password that was emailed to you after you
originally created your virtual machines
5. Test searching for any status tag using SMT, or opening any database apart
from the Contractor database in PSE
6. Test again using PISCHOOL\student02, who is a member of the PI Users
group. You should be able to connect to both the Data Archive and AF
Servers, but not make any changes.

50 | P a g e
 PI System Administration: Basics

8. Managing Data

8.1 Background: What are Archive Files?

This is a background chapter with video content only. It is recommend that you
watch the video for this chapter: https://youtu.be/zBN5m5JM2Es.
Video

This video was originally published in the playlist "Manage Archive Files & Check Archiving
Health". You can find the full playlist here.

8.2 Knowledge Check: PI Archives in Depth

In this lesson we'll take a look at the archives in our Data Archive. Take a look at the Archives
in your system by doing the following:
1. Connect to PISRV01 and open PI System Management Tools (SMT)
2. Navigate to Operation → Archives
You should see all archive files that are registered on your PI Data Archive. It's looking pretty
sad right now - you only have a single file. The archive's start time is about the time you
installed your Data Archive server, and the end time is "Current Time". Because the end
time is the "Current Time", we call this archive the Primary Archive - it is being written to
with data coming in live from your interface. You should also see a very small number in the
%Full column. When the archive gets almost full, a new archive is automatically created, and
we shift into it. When this happens, the end time of the previous archive is set to the time of
the shift. Let's simulate this now.
3. Right click in the white space underneath your archive and click Force shift
After waiting a few seconds, you now see two archive files:

One of them is your new primary archive. If data is written to the Data Archive server with a
timestamp within the old archive's time range, it is written to the old one. If data comes in
within the new time range, it is written to the new one.
A small warning - the action we performed - Force shift - isn't something you need to do
often. In fact, you should never perform a Force Shift if you suspect something is wrong
with your system. It hardly ever fixes any issues, and almost always causes more problems if
your system is already in trouble.
Before the PI Data Archive to write to an archive file, it must be registered. Windows won't
let us move an archive file while it's registered - if you try you'll get an error saying "This

51 | P a g e
action can't be completed because the file is open in PI Archive Subsystem". Let's say we'd
like to move an archive file from one drive to another. We'd need to unregister the archive,
move it with Windows File Manager, then register it again. This will only work if the PI
Archive Subsystem is allowed to access the folder we move it into.

8.2.1 Exercise: Move old archives to a different drive

It is common to have two (or more) devices or drives hosting your archive files. You may
want your recent archives on high performance storage, and your older archives on low
performance storage as they are accessed much less frequently. We'll set up an alternate
location to store archive files, then move an old archive into the folder. The new location
we'd like to host our older archives will be D:\PI\Archives. Usually this would be a
completely separate drive, one that doesn't have any other software installed on it - but
we're starting to run out of drives to use in our learning environment.
Part 1: Prepare the new archive folder
Before an archive can be registered, the PI Archive Subsystem service must have full control
permissions over that file location.
1. Open Windows File Explorer, and navigate to a new folder at the path D:\PI
2. Create a new folder called Archives
3. On your new Archives folder, Right Click → Properties
4. Go to the Security tab
5. Click Edit...
6. Click Add...
7. Click Locations...
8. Select PISRV01
9. Click OK
10. Enter the account name NT Service\piarchss
11. Click OK
12. Check the Full Control checkbox for Allow
13. Click OK
14. Click OK
Part 2: Move an old archive into the folder
1. Connect to PISRV01 and open PI System Management Tools (SMT)
2. Navigate to Operation → Archives
3. Take a note of the name of your old archive (the archive that does not have
"Current Time" as its End Time). You're going to move this file in a few steps, so try
to remember the last few numbers in its name. Once you think you can tell your two
archives apart, Right Click → Unregister Archive

52 | P a g e
 PI System Administration: Basics

4. Click Yes
5. Open Windows File Explorer
6. Navigate to E:\PI\arc
7. Select both the archive .arc file you unregistered, and its corresponding .arc.ann file.
The .ann file is an annotation file, and contains annotations to data contained in the
archive. whenever you move an archive file, you should always move both the
archive, and its annotations.
8. Move both files to the new D:\PI\Archives folder
9. Go back to SMT, and in the white space below your list of archives Right Click →
Register archive
10. Select the archive you moved to the D:\PI\Archives folder
11. Click Open
12. Your archive should appear back in the registry list, with the new path listed under
the Archive File column
If you're looking into automating this job, all of the above steps can be scripted with the
command line tool piartool. You can read about piartool here.

53 | P a g e
9. Final Exam

The final exam for this course is taken online. Please check the course listing online for more details.

54 | P a g e