PI Nexus+ / Administration Guide
Issue Fixes
This chapter allows administrators to fix issues from PI Nexus+, names the rights a fix needs, and shows where its audit trail is. How to fix and undo is in Fixing issues in the User Guide.
Overview
This chapter allows administrators to fix issues from PI Nexus+, names the rights a fix needs, and shows where its audit trail is. How to fix and undo is in Fixing issues in the User Guide.
PI Nexus+ writes to a PI System only when an Admin uses a write feature. Issue fixes are off for every server until you allow them, per server and per kind of fix. Until a write is allowed on any server (an issue fix, Compression Tuning or a database's recalculation) and while nothing has been written, users see no PI Nexus+ writes tab in Change History and no Fix..., Revert... or Apply plan... button. They need a production license: an Evaluation installation shows previews and steps, and Apply says "Fixing is available with a production licence."
Allow fixes for a server
- On Admin > PI Data Archives or Admin > AF Servers, select the server and open its Writes tab.
- Tick Fixes of each kind you want: PI point attributes (PI Data Archives) and Access (identities, mappings and security) (both server kinds).
- Tick the acknowledgement of each kind you switch on, and choose Save Writes. The server's Writes column lists what is allowed.
The acknowledgement says that fixes run as the account PI Nexus+ connects to the server with, or as the OpenID Connect client, and that this account needs the rights of that kind. Saving changes nothing on the server. The server must be enabled first; an existing permission can still be switched off. Every change is recorded in the Security Audit.
Rights the connection account needs
The web application queues a fix and the scanner service writes it, so the rights belong to the scanner service account (or the target's OpenID Connect client).
| Kind of fix | Rights |
|---|---|
| PI point attributes | Write in the security of each point it changes (ptsecurity; the account's PI identity needs w) and write on the PIPOINT table |
| Access on a PI Data Archive | Write on PIUSER (identities) and PIMAPPING (mappings) |
| Access on an AF Server | Admin on the identities and mappings, and on the collection or database whose security a plan changes |
A fix the account is not allowed to make ends Failed with the refusal of PI or AF, and nothing is written. PI Nexus+ never changes PI security itself to get a right it lacks. Everything else in PI Nexus+, including the whole access read, stays read only.
Compression Tuning and recalculation
Compression Tuning is allowed on the same Writes tab of the PI Data Archive (see PI Data Archives); recalculation is allowed per AF database (see AF Servers and Databases). The Compression Tuning permission also gates undoing a Compression Tuning apply. Applying from the Compression Tuning page runs as the app pool identity, undoing runs on the scanner service, so both accounts need the point write rights. Both features' writes are listed under Change History > PI Nexus+ writes.
Find the audit trail
- Change History > PI Nexus+ writes lists every fix, undo, revert, Compression Tuning apply and recalculation, who asked, and the values before and after. Everyone can read it, except that Access fixes are shown to Admins only.
- Admin > Security > Security Audit records who switched fixes on or off, queued a fix or undo, kept a conflict, and how each fix ended.
- Change History marks a change that a fix made as By PI Nexus+ fix, with a link to its record.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Fix... is disabled: "Fixes are switched off for ..." | The kind of fix is not allowed for that server | Allow it on the server's Writes tab |
| Fix... is not shown | The user is not an Admin | Map the user to the Admin role |
| A fix ends Failed with a PI or AF refusal | The connection account lacks a right | Grant the right in the table above and fix again |
A point attribute fix or undo ends Failed with [-10401] No Write Access - Secure Object | The point's security does not give the connection account write (PI enforces this for piadmins too) | Add write for an identity the account is mapped to in the point's ptsecurity, then fix again |
| A fix ends Conflict | The object changed after the preview | Open the issue and choose Fix... again |
| An item stays Applied | The follow-up read has not run, or the issue persists for another cause | Wait a few minutes; the record updates itself once the read has run |
