I have many PCs, which send data to PI manualy, so that all tags have one pointsource L. How I can to know, which from pc send value to a tag? Or it can't possible?
Enabling PI Audit may be the best way of doing this, although if there is a lot of manual data, your audit databases will grow very large (I've seen badly tuned audit records grow 10x the size of the PI archives!) I don't see Audit Viewer in my list of downloads so I guess it is a licensed tool?
Whenever I've implemented custom manual interfaces I include a logging tag which is updated with the windows domain username for each write (obviously this works when all data is being updated at the same timestamp), is there the possibility of re-engineering the solution slightly?
What did you mean by "send data to PI manually"? Is it done by one of our interface products? Or a client program such as PI Manual Logger? According to documentations, pointsource L is used for tags that are not associated with any interface though.
It is not recorded "where" the PI value came from. One can use the PI message log on the server to determine what interfaces/programs may have been connected to the PI server at the time of writing but it is not a precise answer.
If it is being written quite regularly, you can use some PI archive activity tools to help narrow it down.
Is it possible to monitor buffering subsystem on a client's mashines some how?
Maybe IO rate tag or something?
You can monitor the buffer subsystem on client machines with windows performance counters (and even store it in PI by using PI Performance Monitoring interface), this can provide information on when the buffer has written values but only approx when and how many.
You have a performance counter called "Total events sent/sec" (\\server\PI Buffer Subsystem\Total Events Sent/sec).
This counter will indicate how many events the client has written but as far as I know it's not possible to monitor exactly which tag you where writing to.
If your user machines are locked down and you can push certain configuration of PIBufss to them then you could see who sent some data via counters (as per Andre's suggestions), but it still wouldn't give you a definitive answer. It would suggest they updated the value.
When I've previously been asked to track down who was updating some PI Point(s) I put on my "dog the bounty hunter" mask and ran some monitoring of the message logs (like Steve suggests), the PI Network Manager Statistics, and the PI Point(s) in question to see if there was a way to identify the source as the value(s) changed.
Really depends on how the manual entries are being entered in this case. In general there is no easy way to know.
PI AuditViewer is included by PI Data Archive license.
I checked and found that [My Downloads] tab > [PI Data Archive] section does not contain it.
Select [All downloads] tab and search "auditviewer" it should show [PI AuditViewer 2015 Install Kit] if you have license of PI Data Archive.
For putting username to the specific tag, I think it is a good way. We can use annotations too but it has performance issue.
Retrieving data ...