Server Configuration and Maintenance

Open required network communication ports to access the web application and to initiate data collection.

Before you begin, install InsightCM on your machine.

Open required ports to access the web application. Without opening the necessary ports, you cannot configure your assets and devices or begin data collection.

Complete the following steps to open the ports according to your monitoring needs.

Now that you have opened the necessary ports to access the web application, secure your web application by enabling and requiring SSL connections.

Create an API key to enable access to InsightCM data services.

Use the API key you generated to enable secure access to InsightCM data services from your API.

Access your InsightCM data services in your preferred programming language using the HTTP API.

Before you begin, generate an API key.

Cutsforth recommends enabling Secure Sockets Layer (SSL) or Transport Layer Security (TLS) before proceeding to ensure that the key is encrypted as it is passed over the network.

var client = new HttpClient();
client.BaseAddress = new Uri(address);
client.DefaultRequestHeaders.Authorization = 
new AuthenticationHeaderValue("Api-Key", key);

var response = await client.GetAsync("IcmApi.svc/assets");
response.EnsureSuccessStatusCode();

connection = http.client.HTTPConnection(address)
headers = {"Authorization": "Api-Key {0}".format(key)}
startTs = int((datetime.now() - timedelta(days=1)).timestamp())
connection.request("GET", "/IcmApi.svc/dataEvents/
{0}?startTs={1}".format(asset["Id"], startTs), headers = headers)
response = connection.getresponse()
if response.status != 200:
    raise Exception("Request failed with status {0}".format(response.status))

Enable Secure Sockets Layer (SSL) connections for access to the web application.

Before you begin, create an SSL certificate.

By default, users do not need to access the web application via an SSL connection. InsightCM provides a placeholder SSL certificate that you need to replace with your own.

Complete the following steps to enable SSL connections to the web application.

Users can now access the web application via the following URLs: //serverDNSHostname and https://serverIpAddress. However, users are still able to access the web application through non-SSL (HTTP) connections.

Now that you have enabled SSL connections, require SSL connections (see Requiring SSL Connections).

Integrate InsightCM with your Windows Active Directory to require users to log in with Windows account credentials.

Complete the following steps to enable LDAP on your browser.

{
  "DisableBuiltinAccounts": false,
  "LdapConnectionString": "LDAP://icm.com/OU=Test,DC=ICM,DC=COM",
  "LdapDomainName": "icm.com",
  "LdapUsernameFilterToken": "sAMAccountName",
  "SessionTimeoutMinutes": 7200,
  "LdapServiceAccountUserName": "Administrator",
  "LdapServiceAccountPassword": "SecretPassword"
}

Now that users are required to log in with their Windows credentials, assign roles and permissions to each Windows user. After adding Windows Active Directory users to InsightCM roles, disable the built-in accounts and remove the stored LDAP username and password in the .json file.

Require users to connect to the web application using HTTPS.

Before you begin, enable SSL connections.

After you apply an SSL certificate to the https site binding, users can still browse and open the web application using an HTTP connection. Complete the following steps to require SSL connections.

Now that you have enabled and required SSL connections, further secure your system by integrating InsightCM with the Windows Active Directory.

Manage roles with differing levels of permission for editing or accessing your InsightCM system.

Before you begin, integrate your InsightCM system with your Windows Active Directory.

Assign individual users to roles with specific permissions in the InsightCM web application to ensure each user has the appropriate level of access.

Any Active Directory user you associated with this InsightCM role has the corresponding permissions.

After assigning Windows Active Directory users to InsightCM roles, return to the LoginAuth.json file and set DisableBuiltinAccounts to true and remove the stored LDAPServiceAccountUserName and LDAPServiceAccountUserPassword.

Relationships Between User Accounts and Permissions

Permissions determine which features in the InsightCM web application a user can access after logging in. Several factors determine which permissions a user receives:

Permissions	The ability to see and/or configure specific pages or tabs in the web application. You assign permissions to roles.
Role	An administrator-defined persona with assigned permissions. Note Refer to the Creating Roles and Assigning Permissions topic to learn how to define new roles and how to configure new or existing roles.
Active Directory group	A group in the Windows Active Directory service running on the server machine that contains user accounts. Groups map to roles. Refer to Integrating InsightCM with Windows Active Directory to require users to authenticate with Active Directory. Note The web application does not require you to authenticate users with Active Directory. An alternative is allowing users to log into the InsightCM web application with the names of built-in roles, which do not require a password.
User account	An account on the Windows domain whose credentials a user enters to log in to the web application. Accounts belong to Active Directory groups and therefore, they receive the permissions from any role to which their Active Directory group is mapped.

The following diagram shows the relationship between all four items. Notice that the user accounts receive permissions via a group. In other words, you cannot apply a set of permissions to just one account because you must apply a set of permissions to a group.

Learn how InsightCM Server can connect to data historians with the purchase, activation, and enablement of the Enterprise Gateway option. Connecting InsightCM to your historian software makes it possible for InsightCM to write new data to existing historian points and to pull data from historian points for feature calculation or visualization.

Interfacing with OPC UA Historians

Connect to the built-in OPC UA Server using InsightCM.

Before you begin, open port 49580. Refer to Opening Required Ports for Communication to learn how to open ports.

InsightCM automatically writes new feature values to pre-defined channels in the built-in OPC UA server. These channels are not customizable.

1. Launch Windows Services.

2. Select the InsightCM <version> entry in the list of services.

3. Click Restart.

   Note

   Restart the InsightCM software to integrate a data historian.

4. Launch InsightCM.

5. Click the Navigation menu () and select Options > OPC.

6. Select the Configure OPC checkbox.

7. Configure the OPC UA server properties and policies as needed.

8. Click OK.

Names of Items on the OPC UA Server

The InsightCM Server automatically writes all trend points to the OPC UA server installed with the InsightCM Server. The names that InsightCM Server assigns to these items in the OPC UA server follow a predefined scheme, and you cannot customize them. To query the OPC server for the values of tags, you must use the following naming scheme.

OPC Tag Naming Scheme

The OPC tag naming scheme follows the same format as the asset path. For example, consider the InsightCM Server tag for crest factor in the following asset tree:

Asset Tree:
Asset Path:	Unit 1|Motor|Accelerometer Vertical|Crest Factor

The InsightCM Server replaces the vertical bars with periods (.) when it creates and interacts with items in the OPC UA server, but otherwise maintains the same name, as shown below.

Item Name:

Unit 1.Motor.Accelerometer Vertical.Crest Factor

Securing the OPC UA Server

To authenticate or secure communication between the OPC UA client and the InsightCM OPC UA server, configure and exchange certificates.

1. Using your OPC UA client, generate an OPC UA client certificate.

2. Launch InsightCM, expand the Navigation menu () and select Options.

3. Navigate to Server Settings > OPC.

4. Enable the Configure OPC checkbox and configure the options that appear. If you select None in the Supported Security Policies section, you do not need to generate a client certificate.

5. Copy the certificate you created in step one to the location specified in the Client Certificate File Path field.

6. Click OK.

7. When InsightCM prompts you to restart services, click OK.

8. Copy the server certificate to your OPC UA client.

Refer to the documentation for your OPC UA client for more information on how to copy the server certificate to the OPC UA client. By default, the server certificate is located at C:\ProgramData\National Instruments\certstore\opcua\NI InsightCM OPC Server Certificate.der.

C:\ProgramData\Cutsforth\InsightCM\Auth\eDNAConfig.json

Configure your server fleet by modifying the .json file that installed to your server with InsightCM.

A new Fleet tab appears on your main dashboard.

Identify the server machine so your devices can locate the server.

Complete the following steps to configure the device transceiver settings so that the device can reliably communicate with InsightCM Server.

After you save the new server settings, reset the device connection to get the device to send the updated connection information files to the server.

Upload and download software packages, which this page refers to as system images or firmware.

The InsightCM Server installs some default software packages. If you create or receive updated or patched packages, use this page to upload it so you can apply the packages to devices.

An aging strategy prompts the server to delete historical data if certain conditions are met.

Systems with many devices or with devices performing frequent acquisitions can require significant disk space to store data. InsightCM provides features for automatically discarding data events after configurable conditions are met. This automatic process, called aging, conserves disk space while maintaining a desirable collection of data.

InsightCM applies the periodic aging strategy to individual data events that are not part of a stream. The streaming aging strategy is used to discard entire streams. InsightCM does not retain partial streams.

After the daily aging strategy runs, InsightCM retains a maximum of one trend point per hour, excluding streams. If a data event contains a data set and a trend point, InsightCM counts that as the trend point for that hour and deletes all other trend points.

Conserve disk space by configuring a strategy that automatically deletes historical data when certain conditions are met.

To learn more about the periodic and streaming aging strategies, refer to Aging Strategies. Complete the following steps to configure an aging strategy.

The following table compares how two different aging strategies operate on data. In these examples, assume Day 1 begins with zero data events.

The calendar-based strategy in the second row is useful when you want to access all acquired data only during the recent past. For example, if an equipment asset fails, you may want to review data from every acquisition that occurred 2 days prior to the failure. However, you may only need to view data from one acquisition per day twenty days prior to failure.

Now that you have configured an aging strategy, learn how to preserve some data events from aging strategies.

Ensure data from a specific acquisition remains available for viewing regardless of aging rules.

Before you begin, you need to have acquired data.

Feature and sensor data remains accessible whenever the Trend viewer time-axis contains the time at which the acquisition occurred. When you choose to retain data, InsightCM retains all the data associated with the sensor acquisition, such as feature values, the time waveform, and other measurements, such as the FFT curve.

Complete the following steps to identify which data events you want to retain.