Submitting your feedback...
Knowledge Base Article
KB00457 - What is the recommended procedure for applying Microsoft Operating System patches to PI Servers and interface nodes?
Product: PI Interface for Relational Database (RDBMS via ODBC) / PI ACE / PI AF / PI Interfaces / Notifications / PI Interface for OPC HDA / PI Interface for OPC DA / PI Data Archive / PI to PI Interface
Version(s): N/A
 

Issue

What is the recommended procedure for applying Microsoft Operating System patches to PI Servers and interface nodes?

Note: This article is limited to Microsoft patches that are specific to the targeted operating system(s). Patches for other Microsoft products such as SQL Server, .NET Framework, and Exchange are not addressed in this article.
 

Solution

PI Servers

PI Servers should never be configured to "auto update" patches. Patches should be downloaded and evaluated individually to determine the critical nature of each and when it might be applied. Microsoft sometimes releases patches before the regular "patch Tuesday". If patches are critical, you need a risk evaluation process to determine how vulnerable your systems are and how to handle critical updates.  Please see the MS Security Patch Compatibility page for information regarding OSIsoft's patch compatibility testing program for the PI Data Archive and PI Asset Framework.

You should be making regular backups of your PI Server to lessen risk in case a problem occurs that cannot be fixed easily.

Before applying a patch, you should verify that buffering is set up properly on all interface nodes to avoid data loss while the PI Server is stopped. See KB00300 for details on how to test buffering.

Before applying a patch, do the following on each PI Server:
  1. Make a backup copy of the PI Server.
  2. If the patch is applicable to the primary server and at least one secondary server in a collective, it might be desirable to apply the patch on the secondary PI Server(s) first.
  3. Stop all PI Server services on the machine. This step is to ensure that versions prior to PI Server 2010 SP1 (3.4.385.77) are allowed ample time for a complete shutdown, and is unnecessary if you are running PI Server 2010 SP1 and later (see KB00409 and PI Server 2010 SP1 release notes).
  4. Apply Microsoft patches to the machine.
  5. Restart the machine.
  6. Verify that all PI Services automatically restarted after the reboot (use the Windows Services control panel).
  7. Use the PI System Management Tools (PI SMT) to verify that the PI Server shows current values and archive values for tags.

PI Interfaces

Operating System patches tested for the PI Server are safe to apply on interface nodes.

Before applying a patch, do the following on each interface node:
  1. Make a disk image of the machine's hard drive.
  2. Apply Microsoft patches to interface node.
  3. Restart the interface node and ensure PI interface services startup.
  4. Test connectivity to the PI Server by running "apisnap" on the interface node:
    1. Change into the \Program Files\PIPC\bin directory (this is typically where apisnap.exe is installed)
    2. Type "apisnap hostname" and press Enter (where "hostname" is the name of the PI Server you are connecting to)
    3. Enter tagname for a tag being supplied data from the interface and verify snapshot value and archive value show timestamps from after restart.
    4. You can also use the PI System Management Tools (PI SMT) to look up tags receiving data from the interface and verify that tag current values and archive values exist after reboot.
If something goes wrong after a patch installation and it cannot be fixed in a reasonable time, you can still restore from disk image.

PI Asset Framework (PI AF) Server

Operating System patches tested for the PI Server are safe to apply to the PI AF Server. If the PI AF Server is on a different machine than the PI Server, then the PI AF Server machine might need the Operating System patches. If the SQL Server associated with the PI AF Server is running on a different machine than the PI AF Server, the SQL Server machine might need the Operating System patches as well.

For the PI AF Server:
  1. Take a backup of the PIFD database on the SQL Server associated with this PI AF Server.
  2. Stop the PI AF Server and the associated SQL Server if the SQL Server is running on the same machine.
  3. Apply the Operating System patches.
  4. Reboot the machine.
  5. Ensure that the PI AF Server and the associated SQL Server are running.
  6. Ensure that the associated SQL Server is running.
  7. Use the PI System Explorer (PSE) to verify that a connection can be made to the PI AF Server and that the PI AF Servercan be browsed.
If running a PI AF Collective:
  1. Take a backup of the PIFD database on the SQL Server associated with this PI AF Server.
  2. Apply the patch to the primary first, and then to each secondary server.
  3. When a reboot is needed, reboot the primary while any secondary servers are still running.
  4. After the primary has been rebooted, run a test using PI System Explorer (PSE) to verify connections are correct.
  5. Continue applying patches, rebooting, and testing the secondary servers one at a time until all machines have been updated.
For the SQL Server machine associated with PI AF Server:
  1. Take a backup of the PIFD database on the SQL Server associated with the AF Server.
  2. Stop the SQL Server.
  3. Apply the operating system patch.
  4. Reboot the machine.
  5. Ensure that the SQL Server is running.
  6. Use the PI System Explorer (PSE) to verify that a connection can be made to the PI AF Server and that the PI AF Server can be browsed. 

PI ACE Server

Operating System patches tested for the PI Server are safe to apply to the PI ACE Server.
  1. If running PI ACE 2.x, make sure that the PI ACE 2.x Scheduler is set to "automatic" restart. If running PI ACE 1.x, make sure that the PI ACE 1.x Scheduler is set to "automatic" restart. If both are used, verify that both are set to "automatic" restart.
  2. Verify that the service(s) above are restarted properly after the patch is applied and the machine is rebooted.
  3. Use the PI ACE Manager to make sure that all calculations are successfully started and that their output tags are being updated.

PI Notifications Server

Operating System patches tested for the PI Server are safe to apply to the PI Notifications Server.
  1. It is recommended that you create a restore point of the Operating System or have disk image backup before applying any patch.
  2. Verify that the PI Notifications Service is set to "automatic" restart.
  3. After applying the patch and restarting the machine, verify that the PI Notifications service is started successfully.
  4. If buffering is enabled, verify that is is running properly.
  5. Check the PI Message Log on the machine to ensure that PI Notifications service successfully connects to the PI Server and the PI AF Server. Also verify with PI System Explorer (PSE) to make sure that all the notifications are in "Running" state.
  For more information, see "AL00333 - Meltdown and Spectre: What PI System users need to know about these vulnerabilities".
Article ID: KB00457 Created: 2011-04-13
Article Type: Informational Last Updated: 2018-01-18