Logs showing evidence of use of HISINFO or HISSTRIP function execution

[NAT]

Hello,

We are investigating the removal of duplicate data points in the historic data tables which was not performed intentionally by system administrators. We have learned of the functions HISINFO and HISSTRIP.

1. Is there a SCADA log somewhere which will show when the software automatically performed these functions?

2. Is there a subroutine that calls these functions that we can search for in the logs instead?

Thanks for any assistance. 

[AdamWoodlandToo]

There is also the OptimiseData method on CHistoryBase that "removes duplicate records and re-orders data to optimize read operations", which requires the System Admin permission on the object. This doesn't appear to record an event in the Event Journal but does into the DB logs, i.e.:

02-OCT-2024 02:27:28.191 03F4 [DBHIS] Object 1: Optimise historic data from granule 22106 to 22111
02-OCT-2024 02:27:28.191 03F4 [DBHIS] Object 1: removed 0 deleted and 0 duplicated records, re-ordered 0 records (1 record total)

"Object 1" refers to the object in the database with an id of 1 (it was a blank database I started with), and granule 22106 to 22111 is the number of weeks from 1st Jan 1970 (22110 is the current week, that's how the weekly granules are stored on disk) so you should see corresponding files.

Some script (without error checking or permissions checking!) to run the OptmiseData method if it helps:

Option Explicit
Public Sub DoSomething
 Dim ScxObj
 Set ScxObj = Server.FindObject("AI") ' Set to fullname of a point with historic enabled
 ScxObj.Interface.Historic.OptimiseData()
End Sub

It would be fairly trivial to write a some script or logic to run this optimise data method on all points, although might be quite disruptive to users depending on how much data and how out of order the data is in the granules/files on disk.

scxcmd's HISSTRIP command doesn't seem to generate any event journal or DB log entry. Any Windows auditing you might have enabled such as sysmon might, depending on how that is configured. Does need write permissions to the hrd files rather than authenticate against the Geo SCADA database, so typically limited to Windows administrators, but check the ACLs.

The issue with HISSTRIP is that it will need a server restart for the changes to be read by DBServer.exe (unlike the OptmiseData which is done online), and if you have a hot-standby setup then the files on the main will be copied back when you restart. If you have a hot-standby setup you would really need to do a cold restart of the system for the changes to take effect (and if you have duty-duty enabled even more involved!). If it is a standalone server, would just need a restart.

[AndrewScott · Accepted solution]

ScxCmd HISSTRIP (and HISINFO) must never be used whilst the server is running. The server must be shutdown before using either of these commands as they can interfere with the operation of the historian, e.g. locking files and blocking access by the historian or more seriously changing files so they don't match the historian's view of the file (granule). You could break main-standby synchronisation by interfering with the files.

Historic data optimisation can also be applied by a system administrator to the whole database using the "StartHisOptimisation" method on the "Historian" aggregate of the root group. This can be cancelled using the "CancelHisOptimisation" method. Both of these methods log event journal messages and are recorded in the DB server logs.