4 of 4 people found this helpful
I would encourage you to check out the following LiveLibrary article discussing PI Backup options:
To answer your question about "Copy" backups - as discussed in the link, a copy backup is basically an On-Demand backup, which can be triggered by clicking "Backup Now" in PI SMT. A copy type backup does not update the last modified times of archives, which is done to make sure more archives aren't necessarily backed up later by an incremental backup.
I also noticed you mention "our backup routine only covers the last 4 archives". Likely, if you inspect the scheduled task running the PI Backup at 3:15. You will notice that the type is "incremental" and the -numarch parameter is likely 4. For incremental backups with this setting, the 4 most recent archives will always be backed up in addition to any archives which have been updated since the last successful backup.
The most common reason a PI Archive File is updated is because values were added, removed, or substituted within their time range. I also noticed that all the last modified times for these archive below are the same. Was there an interface doing history recovery around this time? I noticed you mentioned PItoPI which can be configured to automatically recover history on startup. Or an AF Analysis being backfilled or recalculated? Perhaps a custom application making edits to data? These are the types of situations where we would most often find the last modified times of many archives all be updated at the same time similar to your situation. I would recommend investigating if anything like this was going on on Dec 22 around 2:22am.
Hope this helps,
Thanks for the feedback. I can't find any interface that would be doing history recovery at this time as no-one is on site at that time of day (02:24am) who would be starting/stopping interfaces. I haven't got any custom apps which run at that time of day either so it can't be that. I've looked at the message logs on the PI server and I can't see anything either so I am really stumped. I've checked the PI-AF box and there are no event frames which were generated at that time. If data was being backfilled by an analysis I would of thought that would show up with an event frame being generated.
I've looked at trends of the PI server stats and the only 2 traces that spike at the same time stamp are;
PI snapshot subsystem out of order snapshots/sec
PI archive subsystem cache flush operations/sec
I think that would suggest there is a manual upload of some sort going on from somewhere, possibly via Excel, which is giving me issues (not the first time). I'll see what I can find out...
I've check the auditing and there is nothing recorded at those times.
I've just been told that one of our production schedulers runs a file at exactly the same time as the archives show they are being updated. He shouldn't be editing anything so I'm not sure how the archives think they are being updated. Is there a way to tell what was updated in an archive at a specific time, which wouldn't show up in the audit viewer??