4 Replies Latest reply on Dec 28, 2017 4:37 PM by caffreys_col

    Lots of PI archives with same modified time - why??


      Hi everyone,

      I need a bit of guidance/help. I've just been checking the PI archives before the Christmas holidays, and found that the last 32 archives all have the same "last modified time" in the archive list. Why would this be the case? The archives go back to July of this year and we don't put in historical data from more than 2-3 days (lab data analysis usually), so I can't see why they would all have the same last modified date. The backup time is different to the last modified time (which I would expect) but again they all have the same backup time. Our backup routine only covers the last 4 archives, so I'd expect them to have the same backup time, but not the last 32 archives. I've checked the event logs but can't see anything un-towards. I have correct a couple of tags which were faulty (syntactically incorrect) in the last couple of days, but I wouldn't have thought that would cause the behaviour I am seeing. We have just increased our archive size to 500mb, but again I wouldn't have thought that would cause any issues.


      The backup routine is set for 03:15, which is an incremental, but there is also a copy job, but I can't see this as a scheduled task. Am I missing something?

      For clarity, this is a PI server (site) which gets data from a PI-to-PI interface from another PI server (plant). The plant server archives are not seeing this behaviour.


      Any help, greatly appreciated.





        • Re: Lots of PI archives with same modified time - why??

          Hi Colin,


          I would encourage you to check out the following LiveLibrary article discussing PI Backup options:


          To answer your question about "Copy" backups - as discussed in the link, a copy backup is basically an On-Demand backup, which can be triggered by clicking "Backup Now" in PI SMT.  A copy type backup does not update the last modified times of archives, which is done to make sure more archives aren't necessarily backed up later by an incremental backup.


          I also noticed you mention "our backup routine only covers the last 4 archives".  Likely, if you inspect the scheduled task running the PI Backup at 3:15.  You will notice that the type is "incremental" and the -numarch parameter is likely 4.  For incremental backups with this setting, the 4 most recent archives will always be backed up in addition to any archives which have been updated since the last successful backup.


          The most common reason a PI Archive File is updated is because values were added, removed, or substituted within their time range.  I also noticed that all the last modified times for these archive below are the same.  Was there an interface doing history recovery around this time?  I noticed you mentioned PItoPI which can be configured to automatically recover history on startup. Or an AF Analysis being backfilled or recalculated?  Perhaps a custom application making edits to data?  These are the types of situations where we would most often find the last modified times of many archives all be updated at the same time similar to your situation.  I would recommend investigating if anything like this was going on on Dec 22 around 2:22am.


          Hope this helps,

          Adam Fink

          4 of 4 people found this helpful
            • Re: Lots of PI archives with same modified time - why??

              Hi Adam,


              Thanks for the feedback. I can't find any interface that would be doing history recovery at this time as no-one is on site at that time of day (02:24am) who would be starting/stopping interfaces. I haven't got any custom apps which run at that time of day either so it can't be that. I've looked at the message logs on the PI server and I can't see anything either so I am really stumped. I've checked the PI-AF box and there are no event frames which were generated at that time. If data was being backfilled by an analysis I would of thought that would show up with an event frame being generated.


              I've looked at trends of the PI server stats and the only 2 traces that spike at the same time stamp are;

              PI snapshot subsystem out of order snapshots/sec

              PI archive subsystem cache flush operations/sec


              I think that would suggest there is a manual upload of some sort going on from somewhere, possibly via Excel, which is giving me issues (not the first time). I'll see what I can find out...