Coresight Squared - Coresight Installation

Blog Post created by lmlcoch on Aug 1, 2016

Coresight Squared


This series consists of three parts:
1. Server Core Installation and Configuration
2. PI Coresight Installation << you're here!

3. Extras: Kerberos and more



Service Accounts


Before movng on to PI Coresight installation, get the proper Service Accounts in place. To follow the principle of least privilege, use 3 separate accounts:


  1. Service Account to run both Coresight AppPools

  2. Service Account to run PI WebAPI Service

  3. Service Account to run PI Crawler Service


Required permissions:


PI Coresight service account

- Read access to everything in PI Data Archive and PI AF that will be accessed in PI Coresight

- Read access to any import folders with PI ProcessBook displays


PI Crawler service account

- Read access to PIUSER, PIDBSEC, PIPOINT, PIMAPPINGS tables in PI Data Archive

- Read access to everything in PI Data Archive and PI AF that PI Coresight users would like to search for


PI Web API service account

- Access to connect to any PI or AF Server that’s used in PI Coresight (required for successful registration of the source for indexing by PI Crawler)




PI Coresight Installation


The attached setup.ini file (or get it from pastebin) is the key that opens the door to Server Core for PI Coresight. The setup file is modified so that the Server Roles and Features check is skipped, and PI Buffer Subsystem module is removed as it’s not required by PI Coresight.


Important note regarding .NET Framework 4.6 (skip this note if Windows Server 2016 is used - it comes with .NET Framework 4.6 installed by default):

Considering the high number of reported .NET Framework 4.6 installation issues due to missing prerequisites, it’s good to install it via Windows Update before proceeding with PI Coresight installation.


There are two ways of doing this:

1) Slow: Wait for the updates to be installed automatically

Windows Update is running in Automatic mode (as we configured it in the preparation phase), so all required updates will be installed eventually.


2) Quick: Force a Manual update on a Server Core

To speed up the process, switch Windows Update to Manual mode and installed all available Updates immediately:

a) Open up sconfig > select Option 5 – Windows Update Settings > type m to switch Windows Update to Manual mode.


b) From the main sconfig menu, select Option 6 – Download and Install Updates > type a to search for all updates > type a again to install all updates.

Restart may be required to finish the installation of some of the Updates. This procedure may have to be repeated couple of times to get .NET Framework 4.6 installed.


c) Switch Windows Update back to Automatic mode (sconfig > select Option 5 – Windows Update Settings > type a to switch Windows Update to Automatic mode).


If you decide to go for a manual installation, the /q switch (silent installation) needs to be used when installing .NET Framework 4.6 on a Server Core.
The installation would be initiated by running: NDP46-KB3045557-x86-x64-AllOS-ENU.exe /q. As such, the /q switch is included in the modified setup.ini just in case.



Steps to follow:


1. Replace setup.ini


i. On any computer, run PI Coresight installation kit and unzip it to a folder (let’s call it installsrc), then cancel out of the installation before any components are installed.

ii. Go to installsrc and delete the original setup.ini file and copy & paste in the modified setup.ini .



2. Copy the installsrc folder to the Server Core machine and install PI Coresight


Use the Robocopy (available from the Command Prompt) or copy&paste feature in Windows Explorer.


For example, to copy Coresight 2016 install folder from C:\Temp on the local drive to C:\Temp on a remote machine called CORE:

robocopy "C:\Temp\Coresight2016" "\\CORES\c$\Coresight2016" /e



Using Command Prompt, run Setup.exe located in installsrc on the Server Core machine and click through install wizard answering prompts. PI System Explorer can be deselected as a feature during the AF Client installation since it’s not required, although it does make adding new PI and/or AF Servers much easier. In any case, PI Coresight is installed at this point.



3. Reboot the machine using shutdown /r /t 0 command


4. Configure PI Coresight Application Pools to run under a service account


If the Remote Administration step has been completed (as per the previous part of this series), configuring the AppPools to run under a custom service account is that much more convenient as it can be done remotely via IIS Manager.


Alternatively, use Powershell. For example, to configure Coresight AppPools to run under OSI\CoresightSVC:


Import-Module WebAdministration;
Set-ItemProperty iis:\apppools\coresightserviceapppool -name processModel -value @{userName="OSI\CoresightSVC";password="password";identitytype=3}
Set-ItemProperty iis:\apppools\coresightadminapppool -name processModel -value @{userName="OSI\CoresightSVC";password="password";identitytype=3}



5. Recycle both Coresight AppPools – run iisreset in Command Prompt or recycle the AppPools remotely via IIS Manager






PI Coresight - Finishing touches


1. Grant users access to the PI Coresight and/or PI Coresight Administration page


PI Coresight Application - Local Windows group PI Coresight Users on the PI Coresight server controls access to the PI Coresight application. By default, Authenticated Users group is a member

PI Coresight Administration – Local Windows group PI Coresight Admins on the PI Coresight server controls access to the PI Coresight Administration. In addition, a PI Coresight Administrator needs to be in an additional local group PI Web API Admins group in order to be able to allow/disallow PI and AF sources for PI Coresight. Only the user who runs the installation is added to these groups by default.


Local Users and groups can be accessed from Server Manager on a workstation of your choice.


Alternatively, Poweshell can be used to add Users or Groups to the Local Group. For example, to add user IT.local\AverageJoe to PI Coresight Admins local group on CORESIGHTSERVER machine, run:


$Group = "PI Coresight Admins"
$Domain = "IT.local"
$UserOrGroup = "AverageJoe"


Coresight can be configured to use any domain or local group instead of the default ones. I won’t go into the details, but if you’re interested, here’s a link to our documentation.



2. Manually create PI Coresight SQL Database


Copy over all files from %pihome64%\Coresight\Admin\SQL folder to a SQL Server machine.


Use robocopy (or copy&paste feature in Windows Explorer):

robocopy "C:\Program Files\PIPC\Coresight\Admin\SQL" "\\SQLSERVER\c$\Coresight-SQL" /e


b) Go to the SQL Server, open up the Command Prompt, navigate to the folder with the Coresight SQL files and execute:

GO.BAT DBSERVER DBNAME CoresightAppPoolAccount output.log


For example, to create a SQL database PICoresight in SQL Server MYSQLSERVER assuming OSI\CoresightSVC is the domain account running Coresight AppPools:

GO.BAT MYSQLSERVER PICoresight OSI\CoresightSVC output.log


For additional details, please see our online documentation.



Finally, link the Coresight application needs to the Coresight SQL Database. In a web browser, navigate to the Coresight Admin page > Configuration > PI Coresight Database and select the appropriate SQL Server and Coresight SQL Database.


Note: Due to Known Issue, the Admin page may indicate that the connection to the Coresight SQL Database is not healthy. To verify whether this is a false positive, navigate to the Coresight homepage, create a New Display and save it. If that works, all’s good.



3. Configure allowed PI and AF data sources in PI Coresight Admin page


Additional PI Data Archive Servers and PI AF Servers need to be added to the KST first unless only the defaults specified during the install are used.


Option 1) Use PI System Explorer (PSE)


If PSE was installed during the AF Client installation, use it to add additional PI and/or AF Servers. On the Server Core machine, use the Command Prompt to navigate to %pihome64%\AF (cd /d %pihome64%\AF) and then run AFExplorer.exe.

PSE will open normally and the File > Connections menu does the trick.


Option 2) PSE is not available - Manually add PI  / AF Servers


AF Servers information is stored in the AFSDK.config file (located in %programdata%\OSIsoft\AF). Navigate to the location in Command Prompt and open the file:

cd /d  %programdata%\OSIsoft\AF
notepad  AFSDK.config


Add a new AF Server into the PISystems collection: <PISystem name="AFSERVERNAME" host="AFSERVERHOST" protocol="Tcp" port="5457" accountName="" timeout="300" />. The Unique ID for the server is automatically populated upon the first connection.


For example: <PISystem name="CSAFBUILD" host="CSAFBUILD" protocol="Tcp" port="5457" accountName="" timeout="300" /> will get adjusted to: <PISystem name="CSAFBUILD" id="638f25d4-21ed-44ea-92bb-84305d373578" host="CSAFBUILD" protocol="Tcp" port="5457" accountName="" timeout="300" /> after the first connection.



PI Servers information is stored in the Registry under HKLM\SOFTWARE\PISystem\PI-SDK\1.0\ServerHandles hive.

Use Powershell to add a new PI Data Archive - set the value of the $PI variable as needed.


$Key = "HKLM:\SOFTWARE\PISystem\PI-SDK\1.0\ServerHandles\" + $PI
If ( -Not ( Test-Path $Key)){New-Item -Path $Key -ItemType RegistryKey -Force}
Set-ItemProperty -path $Key -Name "configString" -Type "String" -Value ""
Set-ItemProperty -path $Key -Name "confirmed" -Type "String" -Value "0"
Set-ItemProperty -path $Key -Name "defaultServer" -Type "String" -Value "0"
Set-ItemProperty -path $Key -Name "defaultUser" -Type "String" -Value "pidemo"
Set-ItemProperty -path $Key -Name "path" -Type "String" -Value $PI
Set-ItemProperty -path $Key -Name "port" -Type "String" -Value "5450"
Set-ItemProperty -path $Key -Name "serverID" -Type "String" -Value ""



Alternatively, create the necessary registry keys using Registry Editor.


In any case, upon the first connection to the PI Data Archive, the value of the ServerID property is added automatically.




At this point, PI Coresight + Server Core configuration should be fully functional. Next, configure Kerberos!



Update 22-Aug-2016:

-Added a small note on Windows Server 2016 and .NET Framework 4.6.

-Clarified the required PI WebAPI permissions