Diagnosing Process Historian PH-Ready Rapid Disk Exhaustion (4GB/Day Logs in C:\ProgramData\Siemens\Logs)

In SIMATIC PCS 7 installations utilizing SIMATIC Process Historian (PH), the critical server failure where the Process Historian Ready Component (PH-Ready) on WinCC OS Servers fills the hard drive with massive log files (exceeding 4 GB per day in C:\ProgramData\Siemens\Logs) leading to server lockup occurs when the PH-Ready service enters an infinite error-logging loop. This condition is triggered by broken Microsoft Message Queuing (MSMQ) queues, desynchronized security certificates, unresolvable DNS hostnames between the OS and PH servers, or active debug trace settings. To resolve this and prevent disk exhaustion, engineers must identify the repeating error signature in PHReadyComponent.log, purge corrupted MSMQ private queues, reset the logging trace level to 'Error' only in the registry or configuration INI, and re-establish secure certificate trust between the OS and PH servers.

Architecture of the Process Historian Ready Component (PH-Ready)

The Process Historian Ready Component (PH-Ready) is a background Windows service installed on every WinCC OS Server in a SIMATIC PCS 7 plant. It acts as the local data collection agent, buffering process value archives (Tag Logging Fast/Slow) and alarm messages from WinCC SQL Server.

PH-Ready streams these records over the Terminal Bus to the centralized Process Historian server using Microsoft Message Queuing (MSMQ) and encrypted WCF/TCP sockets. Under normal operational conditions, PH-Ready writes minimal informational heartbeats to its log files, generating less than 10 MB of logs per week.

Root Cause Analysis: Why PH-Ready Floods the Disk with 4GB/Day Logs

When C:\ProgramData\Siemens\Logs expands by 4 GB per day, the service is stuck in a rapid-fire exception cycle executing hundreds of times per second:

Broken MSMQ Message Queues: If Windows Message Queuing experiences a quota overflow or corrupted storage files (C:\Windows\System32\msmq\storage), PH-Ready fails to enqueue tag packages. It retries continuously, writing a full multi-line stack trace on every attempt.
Communication Rejection by PH Server: If the Process Historian database is stopped, full, or rejecting incoming connections due to expired X.509 security certificates, the OS Server cannot offload its buffer.
Runaway Debug Tracing: During commissioning, engineers sometimes enable verbose trace logging (TraceLevel = Verbose / Debug) in PHReady.ini or the Windows registry and forget to revert it to standard production levels.
Missing Automatic Log Purging: Unlike standard circular archives, diagnostic log writers do not automatically delete old files if the logging service process crashes before executing rotation cleanup.

Investigating `PHReadyComponent.log` and Error Signatures

To identify the exact failure mechanism:

Navigate to C:\ProgramData\Siemens\Logs (or C:\Program Files (x86)\Siemens\Process Historian\Diagnostics).
Open the active log file PHReadyComponent.log in a text editor (e.g., Notepad++).
Identify the repeating log pattern:
- Pattern A: MSMQ Exception: Message queue is full or storage quota exceeded -> Indicates clogged local queues.
- Pattern B: SecurityNegotiationException: The caller was not authenticated by the service -> Indicates security certificate desynchronization or clock drift.
- Pattern C: EndpointNotFoundException: There was no endpoint listening at net.tcp://... -> Indicates network disconnection or stopped PH core service.

Purging MSMQ Queues and Re-establishing Server Trust

To clear the backlog and stop the runaway logging:

Stop Services: Open services.msc. Stop Process Historian Ready Component and Message Queuing.
Purge Corrupted Queues: Open Computer Management > Services and Applications > Message Queuing > Private Queues. Inspect ph_tag_queue and ph_alarm_queue. If clogged with dead messages, right-click and select Purge.
Clear Old Logs: Delete historical .log files in C:\ProgramData\Siemens\Logs to instantly recover disk space.
Run SIMATIC Security Control: On both the OS Server and the PH Server, execute SIMATIC Security Control as Administrator and click Repeat Settings to refresh DCOM, firewall, and certificate stores.
Restart Services: Start Message Queuing followed by Process Historian Ready Component.

Configuring Log Verbosity, Trace Levels, and Automatic Rotation

To ensure PH-Ready maintains a minimal footprint:

Open the configuration file PHReady.exe.config located in the PH-Ready installation directory (<Path>\Siemens\Process Historian\bin).
Locate the logging configuration XML block under <system.diagnostics> or <logging>.
Set the logging switch value to Error (do not leave as Verbose, Information, or All):

<switches>
    <add name="TraceLevelSwitch" value="Error" />
</switches>

Verify that maxFileSize is limited to 10 MB and maxNumberOfFiles is set to 5, ensuring Windows automatically rotates and caps total diagnostic disk consumption.

Comparison of PH-Ready Diagnostic Log Levels

The following table compares the operational impact of various PH-Ready trace logging settings:

Logging LevelDetail CapturedLog Growth RateRecommended ApplicationDisk Exhaustion RiskError (Production Standard)System failures and rejected connectionsMinimal (< 10 MB / week)Mandated for all production OS ServersZeroWarningMinor retries and transient network timeoutsModerate (50 MB / week)Post-commissioning observationLowInformationRoutine heartbeats and batch completionsHigh (500 MB / week)Temporary troubleshooting onlyModerateVerbose / DebugFull WCF packet dumps and internal queuesExtreme (1 to 5 GB / day)Siemens R&D lab diagnostics onlySevere (Critical Risk)

Verification

Verify that PH-Ready logging has normalized and archiving is restored:
1. Monitor C:\ProgramData\Siemens\Logs over a 30-minute interval; verify that the active log file size increases by less than 100 KB.
2. Open the Process Historian Management Console (PHMC) on the PH Server; verify that the OS Server data source status displays 'Connected' with a green checkmark.
3. Confirm that WinCC Tag Logging continues to stream process records without raising 'PH connection lost' alarms.
4. Verify that Windows free disk space on drive C: remains stable.

Limitations and Operational Precautions

Never redirect the ProgramData\Siemens directory to a dynamic network drive or compressed NTFS folder; high-speed SQL and MSMQ file locks will fail, crashing the server. Always establish automated Windows Task Scheduler disk-monitoring scripts or configure an SNMP disk space threshold alarm on the PCS 7 Maintenance Station to alert engineers if free space on drive C: drops below 15%.

Engineer FAQ

Why did PH-Ready create gigabytes of logs in one day?

Because the service encountered an unresolved, repeating error (such as a blocked MSMQ queue or broken certificate handshake) while running with high trace verbosity, triggering continuous exception logging.

Is it safe to delete the log files in C:\ProgramData\Siemens\Logs?

Yes. The .log and .txt files in this directory are purely diagnostic text records; deleting them does not delete actual WinCC process archives or database records.

How do I prevent the C: drive from filling up completely?

Ensure PH-Ready trace levels are set to 'Error' only in PHReady.exe.config, resolve the root cause in the log, and purge clogged private message queues.

Technical References

Related Tags

Process Historian
PH-Ready
Disk Space
Log Files
MSMQ

6 respuestas

Diagnosing Process Historian PH-Ready Rapid Disk Exhaustion (4GB/Day Logs in C:\ProgramData\Siemens\Logs)