I don’t see why Admins don’t have a way to restart the gateway from the web interface. It’s very inconvenient to have to log into the physical machine or use another interface besides the web interface to restart the gateway.
I suppose the first reason that comes to mind would be Security.
On top of that, restarting a Gateway is really best only done from the local machine. What would happen if your web-based restart failed? You would have no access to resolve the issue.
2 Likes
I agree it would be useful. In many cases you do have access to the physical machine to correct issues, it's just... easier if we don't have to do that.
How do you mean security here, would having that ability open up potential vulnerabilities like RCE? If it's just about unauthorised access having the ability to mess with things, there is much worse things that could be done already.
1 Like
Doesn’t restoring a gateway backup restart the gateway? I would think having web access to that is worse in terms of security than just being able to restart.
2 Likes
Security shouldn’t be a concern when you are already logged into the gateway already. If someone wanted, they can do WAY more damage then simply restarting the thing like deleting projects and what not.
We have incidences where we just need to restart the gateway to resolve wackiness happening and we always need access to the physical machine to do so which is a HUGE inconvenience.
The bottom line is, I see no reason why, in this day and age, an administrative interface doesn’t have the ability to restart a service that it is designed to control.
If you really want, you can probably set this up on your own. You can have a gateway message handler shell out a command to restart the gateway something like gwcmd -r. Check out Gateway Command-line Utility - Ignition User Manual 8.0 - Ignition Documentation for more info. The gwcmd is in the Ignition install folder. But again, as @cmallonee says, what if there is an error during restart - you are SOL and then you’ll need to be there physically to restart.
If you need to do something that requires a full stop and then start as some changes to the Gateway require, there’s no way around that and you’d need to be there physically or RDP in. Unless you set up another web server on that computer that you can tell to manage the stopping/starting of Ignition - but this seems like another set of potential security concerns.
I think your best bet is to talk with IT of whatever customer you are working with to try to get secured RDP access to the machine. Then you can do whatever you need to that way without having to physically be there.
There is ALWAYS a risk of a service not coming back online when restarting it, it doesn’t mean that there shouldn’t be a way to restart it from the administrative interface.
I'm torn about this. Instinctively I think it's a bad idea to have it available in the gateway web interface. I also don't think gateway backup restoration should be allowed for anybody with Config section access. I can't think of many examples of other software that runs as a service that would allow a restart from the application interface either. Usually it's via the service mechanism for that OS or a separate tool.
The GCU is that "administrative interface", not the Gateway.
3 Likes
@Kevin.Herron Someone having the ability to restore the Gateway is WAAAAY more destructive than simply rebooting it. With all due respect everyone, almost every onprem application that we run has the ability to restart / stop via the interface, I see no reason why Ignition should be different.
Concerning security (and correct me if I’m wrong), Ignition doesn’t have an audit log to track what is being changed on the server by default. I see that you can set one up, but why this isn’t setup be default is beyond me.
Well as an easy workaround, if all you need to is restart it, why not back it up and immediately restore the backup?
Or again, have a gateway message handler or tag change that shells out to run the gateway command utility.
I get your point now though - if we can restore a backup and that restarts it, why not just be able to restart it wholesale.
1 Like
@bkarabinchak.psi I get that you can do workarounds, however, in an industry that is driven by audits and accountability, it would be VERY NICE to have an easy way of doing it that is tracked.
Setup an audit trail and make it a gateway tag change event and it will be tracked - you’ll see who changed the tag and when which will tell you when the gateway was restarted.
Or make it a gateway message handler called from a client and it’s trivial to track that way too.
It’s a good idea for a feature request for sure. It just seems like something that no one has particularly brought up before so it’s not something you get for free out of the box.
@bkarabinchak.psi Again, with all due respect, isn’t Ignition is designed to develop SCADA (mission critical) applications? How do you not have this kind of auditing setup by default right out of the box?
Well audit trails are saved to a database typically (unless you choose internal), but external databases typically so that many parties like the customer can look at it. How are you going to setup an audit trail before the engineer tells you what database to save events too?
It’s only a few button clicks to setup an audit trail after you set up a database. I don’t think that’s unreasonable tbh.
1 Like
@bkarabinchak.psi I understand that I can set it up myself. What I’m saying is that Ignition should auditing and tracking ANY changes to it’s settings by default right out of the box. I shouldn’t have to be remembering to set this up.
Ability to restart from the web interface would be convenient–have wished for a it a few times. With what else can be done there, I don’t see any reason not to include this ability.
It is easy to work around with a gateway message handler as @bkarabinchak.psi suggested. We have a Perspective project that gives some users the ability to restart a gateway (uses a message handler) from a web page. It would be more convenient from the gateway web interface for programmers, but due to some recurring internal historian issues that were gradually freezing up the gateway (later resolved by IA updates) we gave some operation supervisors the ability to restart gateway via the Perspective page (wouldn’t have wanted to give them config access on gateway).
2 Likes
But again, as @cmallonee says, what if there is an error during restart - you are SOL and then you’ll need to be there physically to restart.
If that's is already their status quo, I don't see how illustrating an unlikely edge case makes them 'SOL'. They're not saying its impossible, they're saying it is difficult and inconvenient.
"This will reduce your inconvenience overhead by 95% but 5% of the time you're SOL (aka right where you are now)" would, to me, be a selling point, not a deterrent. Again, assuming you are taking the necessary precautions to keep unauthorized or untrained people out of your gateway. Which, if Inductive is assuming that is not a given, then I'm surprised the gateway has ANY functionality at all.
3 Likes
Has there been any upgrade that allows restarting the Gateway from the web interface?
No, but you could take and then immediately restore a gateway backup. That'll force a restart.