Siemens WinCC Alarm: Viewing Logged Alarms Beyond 1000 Limit

Problem Overview

When configuring alarm logging in Siemens WinCC (Comfort Panels, Advanced Panels, WinCC Professional PC Runtime, or WinCC Unified) engineers routinely expect the on-screen Alarm Control to surface every event recorded over weeks or months of production. The actual runtime behavior is different: the Alarm Control window shows only the most recent 1000 entries, even when the long-term archive has been collecting alarms continuously for two months or longer. Both the long-term and short-term archive views appear to deliver identical 1000-line results, which leads operators to suspect that logging has stopped or that segments have been overwritten.

This article documents the architectural reason for the 1000-line behavior, then provides four field-proven resolution paths: the Selection Dialog toolbar button, the MsgFilterSQL control property, the WinCC Unified "Show logged alarms" toolbar button, and direct SQL query against the underlying archive database. The procedures apply to TIA Portal V16 through V20 engineering, WinCC V7.x classic engineering, and WinCC Unified RT on PC and Panels.

Root Cause Analysis

The Alarm Control is a bound C/S control. In classic WinCC it is an OCX hosted in the Graphics Designer; in TIA Portal it is a WinCC Control based on the same ActiveX architecture; in WinCC Unified it is an HTML5-based Web control. Regardless of platform, the Alarm Control queries the configured message server (alarm logging service) and renders the result set into a fixed display buffer.

Three independent limits are at play, and confusing them is the root cause of the 1000-line symptom:

• Short-term archive (circular buffer): Configured under "Alarm Logging > Short-term archive." Default size 500 to 1000 messages. Oldest entries are discarded as new ones arrive.
• Long-term archive (segmented file or SQL Server database): Configured under "Alarm Logging > Long-term archive." Default segment size 500 to 1000 entries with daily/weekly/monthly rollover. Stores months or years of data.
• Alarm Control display buffer: The visible row count in the Message List pane of the Alarm Control. Default is 1000 lines regardless of archive configuration. This is controlled by the MaxLines property in classic WinCC and by the page size setting in Unified.

The user-visible symptom is that the Alarm Control renders only the last 1000 events from the short-term archive because that is the default data source for the Message List pane. The long-term archive is being filled correctly; the control is simply not paging through it without explicit operator action.

This behavior is by design. The 1000-line cap protects panel-based HMIs from memory exhaustion and flash wear when scrolling large datasets. For PC Runtime it is a usability default that engineers must consciously override.

Solution 1: Selection Dialog Toolbar Button

The classic Alarm Control exposes a built-in Selection Dialog accessible via a configurable toolbar button. This dialog allows the operator in runtime to specify a precise time range and additional filter criteria without writing any script.

1. In the TIA Portal project tree, open the screen that hosts the Alarm Control.
2. Right-click the Alarm Control and select "Properties."
3. In the Properties pane, locate the toolbar configuration (varies by WinCC version: "Toolbar," "Control Properties > Toolbar," or the Alarm Control configuration dialog).
4. Enable the "Selection" button. The icon is typically a funnel or filter symbol. In some versions it is the third icon from the left in the default toolbar set.
5. Compile the project and download to the runtime.
6. In runtime, click the Selection button in the Alarm Control toolbar.
7. In the dialog, set the start datetime and end datetime to span the period of interest.
8. Optionally set state filter (came in / went out / acknowledged), priority range, class, and area filters.
9. Confirm. The Alarm Control re-queries the archive and re-renders the matching records, still capped by the per-page display buffer of 1000.

The Selection Dialog is the recommended approach for operator-driven retrieval because it requires no scripting and the active filter string is visible in the status bar of the Alarm Control, providing audit traceability.

Solution 2: MsgFilterSQL Control Property

For scripted or automated filtering, the Alarm Control exposes a MsgFilterSQL property through its Control Properties interface. The property accepts a SQL WHERE-clause fragment that is appended to the runtime message query against the configured archive. This works on WinCC Comfort Panels, Advanced Panels, WinCC Professional PC Runtime, and classic WinCC V7.x.

Sample VBScript (single-day filter):

' Filter to the last 24 hours Dim fromTime, toTime fromTime = Format(DateAdd("d", -1, Now), "yyyy-mm-dd hh:nn:ss") toTime = Format(Now, "yyyy-mm-dd hh:nn:ss") Dim filter filter = "DATETIME >= '" & fromTime & "' AND DATETIME <= '" & toTime & "'" ScreenItems("AlarmControl1").MsgFilterSQL = filter

Multi-month retrieval (user-defined range):

Dim startDate, endDate, filter startDate = "2024-01-01 00:00:00" endDate = "2024-03-01 00:00:00" filter = "DATETIME >= '" & startDate & "' AND DATETIME <= '" & endDate & "' AND CLASS = 1" ScreenItems("AlarmControl1").MsgFilterSQL = filter

Filter column names mirror the message block column identifiers exposed in the Alarm Control configuration: DATETIME, MSGNR, CLASS, TYPE, STATE, PRIO, AGNR, USER, TEXT1, TEXT2, and so on. Wildcards follow SQL LIKE syntax (for example TEXT1 LIKE '%Pump%').

After applying MsgFilterSQL, call the Alarm Control's Update method or trigger a screen refresh to force the re-query if the runtime does not redraw automatically.

Solution 3: WinCC Unified Show Logged Alarms Button

WinCC Unified (TIA Portal V17 and later) handles logged alarms through a dedicated runtime mechanism that is separate from the live alarm stream. Per Siemens support entry ID 109813308 ("SIMATIC HMI WinCC Unified Engineering V18"), the Alarm Control toolbar exposes two history-specific buttons:

• Show logged alarms: displays the persisted snapshot from the configured alarm log without further updates.
• Show and update logged alarms: displays the persisted snapshot and continues updating the visible rows as new alarms are logged.

Each rendered page still shows a maximum of 1000 alarms; pagination/scrolling is required to view additional records. This matches the documented behavior in the official WinCC Unified operating manual for "Display logged alarms (RT Unified)" at the TIA Portal documentation portal.

Engineering steps for WinCC Unified:

1. Open the screen containing the Unified Alarm Control.
2. In the Properties pane, navigate to the toolbar configuration.
3. Enable the "Show logged alarms" and "Show and update logged alarms" buttons.
4. Under "Alarms > Logs" of the HMI device, configure the alarm log destination path (SQLite file on the panel or PC runtime file system).
5. Configure segment size and segment count to define the retention period.
6. Compile and download.

In runtime, click "Show logged alarms" to query the on-disk log snapshot. Use the navigation buttons in the Alarm Control toolbar to page through subsequent 1000-line blocks until the desired period is reached.

Solution 4: Direct SQL Query Against the Archive Database

For users of WinCC Professional (TIA Portal) or classic WinCC V7.x with the SQL Server option, alarm archives are written into a Microsoft SQL Server database. This provides unlimited historical retrieval independent of the Alarm Control UI limits.

The default database naming follows the convention CC_Alarms_<ProjectName>_<DateRange> or similar. Long-term segments are stored as separate databases per segment. Connect to the SQL Server instance configured for the WinCC project and inspect the database list under the configured instance.

Example query against an alarm archive segment:

SELECT MsgTime, MsgNr, Class, State, Priority, ComputerName, UserName, Text FROM dbo.UDT_ALG_ WHERE MsgTime BETWEEN '2024-01-01 00:00:00' AND '2024-03-01 23:59:59' ORDER BY MsgTime DESC;

For combined retrieval across multiple segment databases, build a UNION ALL across the relevant segment tables, or use a SQL Server view that aggregates them. Export the result to CSV or connect Microsoft Excel / Power BI directly to the SQL Server for analyst workflows.

Required SQL Server permissions: db_datareader on each archive database, granted to the Windows account used for the query tool.

Archive Configuration Reference

Before any of the four solutions can return historical data, the archive must actually contain the data. Verify the configuration per platform:

Parameter	WinCC Comfort/Advanced	WinCC Professional	WinCC Unified
Archive type	Segmented file on storage media	SQL Server segmented database	SQLite file-based log
Default segment size	500 entries	Configurable per segment	Configurable, default 1000
Long-term retention	Daily / Weekly / Monthly segments	SQL Server retention rules	Number of segments times segment size
Storage location	\Storage Card\Logs\ (panel) or local path (PC RT)	SQL Server instance, configurable database path	HMI project storage path
Display buffer	Alarm Control MaxLines property, default 1000	Alarm Control DisplayFilter / MaxLines, default 1000	Alarm Control page size, default 1000
Config editor	"Alarm Logging" editor in project tree	"Alarm Logging" editor with SQL connector	"Alarms > Logs" device property

To verify archives are being written, navigate to the panel file system (FTP/SMB access on supported panels) or open SQL Server Management Studio and inspect the segment files/databases. Each segment is a dated file or a separate SQL database table set.

Performance and Memory Considerations

Increasing the Alarm Control display buffer beyond 1000 directly impacts runtime memory and redraw performance:

Display Buffer Size	Approx. Resident Memory (Panel)	Redraw Lag (Comfort Panel)	Recommended Platform
1000 rows	2 to 5 MB	Negligible	All panels, PC RT
10000 rows	20 to 50 MB	Noticeable during scroll	PC Runtime only
100000 rows	200 to 500 MB	Severe without filtering	PC Runtime with SQL backend only

For panel-based HMIs, the 1000-line cap exists to keep the panel responsive during scroll operations and to bound flash wear from constant redraws. For PC-based runtime the cap can be raised by editing the Alarm Control's MaxLines property, but historical retrieval tooling (SQL queries, CSV export, SSRS reporting) is the recommended path for true multi-month retrieval.

Classic WinCC V7.x Specific Notes

For projects engineered in SIMATIC WinCC V7.x (not TIA Portal), the procedures are functionally identical with these differences:

• The Alarm Control is inserted from the Graphics Designer palette under "Controls."
• The MsgFilterSQL property is exposed via the control's VBA or C-script interface rather than the modern ScreenItems object model. Example VBS: HMIRuntime.Screens("Screen_1").ScreenItems("Control_1").MsgFilterSQL = filter.
• The Selection Dialog is configured under the control properties dialog, "Toolbar" tab. Enable the "Selection" button (button ID 6 in classic WinCC toolbar configuration).
• Long-term archives are written to a configured path on the WinCC server file system by default; SQL option is a separately licensed add-on.

Verification Steps

After applying the Selection Dialog, MsgFilterSQL, or Unified button approach, validate the configuration systematically:

1. Confirm the toolbar button or script is bound to the correct Alarm Control instance name (case-sensitive on Unified).
2. Trigger the filter in runtime and observe the message list re-populate.
3. Check the status bar of the Alarm Control for the active filter string and the resulting row count.
4. Use the Alarm Control "Export" toolbar function to export the visible messages to CSV. Verify the datetime range matches the requested period.
5. For SQL backend, run the direct SQL query (Solution 4) and cross-check the row count and time distribution against the Alarm Control output.

If the filter returns zero rows but the archive contains data, check the following:

• Verify the DATETIME format matches the archive locale. German locale typically uses dd.mm.yyyy hh:mm:ss; English locale uses yyyy-mm-dd hh:mm:ss or mm/dd/yyyy hh:mm:ss.
• Confirm the archive segment is closed before querying. Segments being actively written may be locked.
• Check the Alarm Control's data source configuration. Some installations have the control bound to short-term archive only; switch to "Long-term archive" in the control properties.

Troubleshooting Matrix

Symptom	Likely Cause	Resolution
Only last 1000 alarms visible in Alarm Control	Default 1000-line display buffer; control bound to short-term archive	Use Selection Dialog, MsgFilterSQL, or switch control to long-term archive data source
Selection Dialog button missing from toolbar	Toolbar button not enabled in engineering	Enable "Selection" toolbar button in Alarm Control properties and re-download
MsgFilterSQL filter returns zero rows for known data	DATETIME format mismatch or wrong column name	Match SQL filter datetime format to archive locale; verify column names against message block
Script error on MsgFilterSQL assignment	Incorrect object name, runtime security, or unsupported version	Verify ScreenItems name spelling; check WinCC User Management (UMAC) script permissions; confirm WinCC version supports the property
Long-term archive file not created	Path permission denied or segment configuration missing	Configure archive path with write permission for runtime user; set segment size and count
WinCC Unified: Show logged alarms button greyed out	Alarm logging not configured or empty	Configure alarm log destination under "Alarms > Logs"; confirm logging is active in runtime
SQL backend: cannot see archive tables	Database not deployed or wrong SQL instance	Re-deploy via WinCC Archive Configuration tool; verify SQL instance name matches WinCC project settings
Archive segments not visible in file system	Backup/archive service interference	Disable antivirus on archive path; check WinCC Backup/Restore settings
Filter works but row count still 1000	Display buffer MaxLines still at default	Increase MaxLines property or use pagination through result set

Migration Notes: From Comfort/Advanced to Unified

Projects migrated from TIA Portal WinCC Comfort or Advanced to WinCC Unified should review the following differences that affect historical alarm viewing:

• MsgFilterSQL property is not directly supported on Unified Alarm Control in V17/V18. Use the "Show logged alarms" button or filter columns configured at engineering time.
• Unified alarm logs are SQLite-based by default. Migrating SQL archives from Professional to Unified requires explicit data export and re-import.
• Toolbar configuration in Unified is exposed via the Properties pane rather than the legacy configuration dialog.
• Page size in Unified is fixed at 1000 in V18; the "MaxLines" property from classic WinCC does not have a direct equivalent.

Frequently Asked Questions