10 Replies Latest reply on Jul 9, 2014 4:10 PM by asorokina

    Potential causes for AfAttribute.GetValue to return "The requested server is not currently available"?

    Roger Palmen

      Hi all,

       

      I have these whopping 3 lines of code to get the value of an AF attribute. The attribute is a PI point on a PI server having a trust on the hostname where the application is run.

       

       

       
      AFTime aftime = new AFTime("*");
      AFAttribute attr = AFAttribute.FindAttribute(strElement, null);
      AFValue attrval = attr.GetValue(aftime);
      

       

       

      I run this little application using windows task scheduler. If i run the scheduled task under my own account, it runs fine and returns the value. However, if i run this using a service account (which has restrictions applied), i do not get an exception, but the  AFValue (attrval.ToString()), returns "The requested server is not currently available".

       

      Any ideas what would cause this behavour? Only think i can think of is the known servers table. That is stored in registry, but as i can connect using my own account, i assume this cannot be the issue. Any ideas where to look? I was hoping to get an exception and some details in the trace, but the code runs without problems.

       

      I have no access to the PI server (except reading data), so checking logfiles will be difficult, thus i prefer to diagnose from the node where i run the task.

        • Re: Potential causes for AfAttribute.GetValue to return "The requested server is not currently available"?

          Hi Roger,

           

          This looks to me like a security issue. I suggest starting with the local PI Message log, the Windows Security and AF Application and Service Event log but since the issue is likely with access to the PI Point, you may like to try accessing the PI Server log using pigetmsg.exe remote (e.g. pigetmsg -f -Node <YourPIServerNode> -Windows).

           

          If I am not totally mistaken, the way AF SDK connects depends on it's version and if you are using the RDA assembly. With older AF SDK versions and the legacy assembly of AF SDK 2.5 and 2.6, the connection should be through PI SDK while the RDA library of AF SDK 2.5 and 2.6 should do direct RPC's to the PI Server.

            • Re: Potential causes for AfAttribute.GetValue to return "The requested server is not currently available"?
              Roger Palmen

              Why did i not think of the local message log? 

               

              Anyhow, yes, it's definately security related. Where to look is the difficult part since i have a locked-down PI server. Application runs against AFSDK 2.5 on .NET4.0 so it's using the PI SDK.

               

              The local PI Message log gives me two messages:

               

              Time, ID, Severity, Message, Program
              7/7/2014 5:54:47.43701 PM ,2 ,Error ,Failed to connect to server <<PIservername>> : 0x8004078a ,TestAFandPIconnection
              7/7/2014 5:54:26.17101 PM ,4 ,Information ,Successfully connected to server <<PIservername>> as <<trust name>> ,TestAFandPIconnection

               

              Where <<PIservername>> is the PI server name, and <<trust name>> contains the name of the PI trust used.

               

              So this leads me to believe that 1) i have access to the PI server as i can create the connection, but 2) somewhere down the line i do not have access to the specific data or PI point? Any ideas on 0x8004078a? Searching returned nothing from my end.

               

               

               

              In the meantime i will try to recreate the specific behaviour on a test environment where i do have access to.

                • Re: Potential causes for AfAttribute.GetValue to return "The requested server is not currently available"?
                  Marcos Vainer Loeff

                  Hi Roger,

                   

                  Please, open the PISDKUtility and try to connect to the PI Data Archive. If so, please click on the Snapshot Tool and try to view the snapshot of the PI Point related to the original attribute described on your initial post.

                   

                  Let us know the result,

                    • Re: Potential causes for AfAttribute.GetValue to return "The requested server is not currently available"?
                      Marcos Vainer Loeff

                      Please follow the procedure above on the same machine that reported the initial error. If you still receive error  0x8004078a, I would:

                      • Clean the Known Servers Table.
                      • Check the DSN and make sure that the PI Data Archive hostname and FQDN return the correct IP address.

                      If that does not work, OSIsoft TechSupport is the correct channel to proceed.

                       

                      Hope it helps!

                        • Re: Potential causes for AfAttribute.GetValue to return "The requested server is not currently available"?
                          Roger Palmen

                          The tricky part is that the service account does not allow to logon to a session, so running the PISDK utility using the service account is not an option. Clearing the KST did not help.

                           

                          I did some experiments using a different PI server, and amazingly, the same two scheduled tasks (own account and service account) are able to get the data from the other PI server.

                           

                          So it's the combination of the specific account on the specific PI server, while i am 100% certain that the trust is on hostname only, so the trust cannot resolve to different security settings on the PI points.

                           

                          So i'm clueless here... two tests that cannot co-exist...  not much point on digging further here on this forum. I'll let you all know if i have been able to find the root cause!

                            • Re: Potential causes for AfAttribute.GetValue to return "The requested server is not currently available"?

                              Hi Roger,

                               

                              Roger Palmen @ CGI

                              I did some experiments using a different PI server, and amazingly, the same two scheduled tasks (own account and service account) are able to get the data from the other PI server.

                               

                              Is this a PI Data Archive (PI Server) Collective?

                               

                              0x8004078a translates "The requested server is not currently available."

                               

                              My first guess was you would be a victim of an DNS issue in combination with ReverseNameLookup but this should be independent from the user account except, there's a firewall in between that has some account based rules.

                               

                              The best option that I know of for troubleshooting issues like this is looking at the PI Message Log on the PI Server. Have you tried pigetmsg.exe?

                               

                               

                                • Re: Potential causes for AfAttribute.GetValue to return "The requested server is not currently available"?
                                  Roger Palmen

                                  Have to raise internal problem ticket to have someone to look at PI server message log to see if even something is trying to connect. Will take some time...

                                   

                                  But the DNS lookup issue is a hypothesis i can test using some additional code in my tool i created to investigate this issue. Thanks for the idea!

                                   

                                  No access using pigetmsg to the remote PI Server ([-10400] No Read Access - Secure Object]).

                                    • Re: Potential causes for AfAttribute.GetValue to return "The requested server is not currently available"?
                                      asorokina

                                      Hi Roger,

                                       

                                      What is the Security Protocol Order in PI SDK Connection Options? (PI SDK Utility -> Connections->in the menu: Connections -> Connection Options)

                                       

                                      Can you set PI Trust to be the first in the protocol order and try connecting to the problem PI Server with PI SMT/PI SDK Utility/other PI tool?

                                       

                                      What is the version of PI SDK?

                                       

                                       

                                       

                                      Kind regards,

                                       

                                      Anna

                                        • Re: Potential causes for AfAttribute.GetValue to return "The requested server is not currently available"?
                                          Roger Palmen

                                          Short update:

                                           

                                          Checking DNS lookup an reverse lookup for the PI server (and ping) caused no issues. Succesful for both accounts.

                                           

                                          Next started playing with security protocol order. Also got some ideas from a collegue who pointed out that when there should be no influence, there still might be.

                                          • Order: 1=Windows Security  2= PI Trust 3= Default User. Error message: The requested server is not currently available. Initial situation
                                          • Order: 1= PI Trust 2= Default User 3=Windows Security  . Error message: Unable to open a session on a server. The user name and password may be incorrect. Hey, we have a smoking gun...
                                          • Order: 1= PI Trust  (removed all others) Error message: Unable to open a session on a server. The user name and password may be incorrect. This is odd, i lost my trust???
                                          • Order: 1=Windows Security  (removed all others) Error message: Unable to open a session on a server. The user name and password may be incorrect. As expected
                                          PI Server version is 3.4.385.77. This is PI Server 2010R3 aka SP1, thus PI Identities are supported.
                                          If i do get a connection, the logging states <<PIservername>> connected as <<something>>. For the something i presumed this to be the PI Trust name. Only conclusion i can make is that <<something>>  is a PI Identity, and that i have been misinformed on the Trust that was created.
                                          I've some work to do to get this resolved, as i now have proof the PI Server access is not setup as i have been confirmed it is. Case closed!
                                          Improvement idea: show what type of protocol finally used? Which exact identity? Trust or PI User or Windows mapping..
                                            • Re: Potential causes for AfAttribute.GetValue to return "The requested server is not currently available"?
                                              asorokina

                                              Hi Roger,

                                               

                                              Thanks for sharing the update!

                                               

                                              Just to confirm your conclusion that PI Identity is being used in the local log message: here is what I have in the client message log, when I connect to my PI Server via trust

                                               

                                                       Successfully connected to server PIServer1 as piadmin

                                               


                                               

                                              On the PI Server message log shows the following:

                                               

                                              [Server] PIServer1 [Collective] PIServers [ID] 7076 [Time] 09.07.2014 17:26:18 [Program] pinetmgr [Priority] 10 [ProcessOSUser] SYSTEM [ProcessID] 6588 [Severity] Debug

                                               

                                              Successful login ID: 22105. Address: 120.34.56.78. Host: . Name: SMTHost.exe(992):remote. User: piadmin. OSUser: . Trust: Anna_SP

                                               

                                               

                                               

                                              It's very tricky when you don't have any access to the PI Server. It could be that the trust was created, but not configured correctly. Or (if a trust is configured with IP address) the connection goes through another network card and uses a different IP address. Or if there is NAT between client and server, so the client connection arrives at the PI Server with a different IP address...

                                               


                                               

                                              Good luck!

                                               

                                              Anna