The symptom: an Easy Chart in a Vision client shows an error overlay with a database icon in its top-left corner. No pens plot. The database connection reports healthy and tag diagnostics are clean. The number that matters is not latency, connection count, or row count. It is a single project-level permission bit. This is authorization, not connectivity.
Fixes That Fail Against the Database Icon
The database icon points engineers at the SQL layer, and the usual responses all return clean results that change nothing.
| Attempted fix | What it proves | Why the chart still fails |
|---|---|---|
| Re-test the database connection in the Gateway | The Gateway can open a session to the SQL server | The query is rejected at the project security layer before it is sent to the connection |
| Run the tag diagnostic tool | Tags, OPC paths, and quality are valid | DB pens read tables directly. Tag health does not affect them. |
| Rebuild pens, re-select table and columns | Pen configuration syntax | A correctly built DB pen gets the same rejection |
| Delete and recreate the Easy Chart | Component instance is not corrupt | The permission is set on the project, not on the component |
| Change JDBC driver or database user rights | SQL-side grants | The request never reaches the database |
Every one of these checks passes, and that pattern is diagnostic in itself. A healthy connection plus a failed DB-pen query almost always means the Gateway refused the query on security grounds.
Legacy Database Access: The Actual Block
Vision clients do not open their own database sockets. Each query from a client travels to the Gateway, and the Gateway runs it on the named database connection. Before running it, the Gateway checks the project's Vision security properties. Those properties separate two kinds of client-originated SQL:
- Named Queries: the SQL is defined in the project and runs server-side with parameters. The client sends only the query name and parameter values.
- Everything else: ad-hoc SQL built or sent by the client. This covers Easy Chart DB pens, SQL query bindings, and client-side scripted queries that are not Named Queries.
The second category requires Legacy Database Access. When that permission is off, the Gateway rejects the query and the Easy Chart shows the database error overlay. The connection itself is fine, so connection tests and tag tools stay green.
Tag History pens use the historian query path, not client-issued SQL. A chart that plots tag-history pens but fails on DB pens isolates the fault to this permission.
Diagnostic Checks Before Changing Anything
| Check | Where to read it | Result that points to the permission |
|---|---|---|
| Database connection status | Gateway web interface, database connections status page | Connection valid |
| Pen type on the failing chart | Easy Chart Customizer, pen tables | Failing pens are DB pens |
| Error detail on the chart | Click or hover the error icon in the client | Message refers to permission or security, not timeout or SQL syntax |
| Gateway logs | Gateway web interface, Status > Logs | Security or permission denial logged when the chart loads |
| Project Vision permissions | Designer, Project > Properties, Vision section, permissions | Legacy Database Access not granted |
If the error detail shows an SQL syntax error, a missing table, or a timeout, the permission is not the cause. Work the query and table configuration instead.
Enabling and Scoping the Permission
- Open the project in the Designer.
- Go to Project > Properties and select the Vision section's permissions page.
- Find Legacy Database Access and enable it.
- Decide the scope. The permission can be limited by role or security zone. Grant it broadly only for a trial or an isolated network. In production, limit it to the roles that actually need DB-pen charts.
- Save and publish the project.
- Accept the project update in running Vision clients, or restart them, so they pick up the new security properties.
Understand the trade-off. Legacy Database Access lets a client send arbitrary SQL to any connection the project can reach. A client with this right can run any query the Gateway's database user is allowed to run. Two ways to limit that exposure:
- Point the connection at a database user with read-only grants on the trend tables.
- For new designs, use Tag History pens or Named-Query-driven datasets where possible, so the permission can stay off.
Verification After the Change
- Open a fresh client session and load the chart window. The database icon should be gone and DB pens should plot across the configured time range.
- Log in as a user outside the granted role, if you scoped by role. The error should come back for that user. This proves the scope works.
- Check the Gateway logs while the chart loads. There should be no new denial entries.
- Pan or zoom the chart into history. The Easy Chart re-queries on range changes, so a successful pan confirms repeated queries are allowed, not just the first load.
Recurring Pitfalls on Vision Projects
- Same cause, other components. SQL query bindings on tables and labels, and scripted queries that are not Named Queries, fail the same way. If several database-driven components break at once, check this permission first.
- Designer versus client. A chart that previews in the Designer can still fail in a launched client. Always test in a real client session under the target user's role.
- Stale clients. A client that has not accepted the project update keeps the old security properties. It keeps failing after the fix is published.
- Project copies and imports. Security properties belong to each project. A project cloned from a hardened template inherits the permission turned off.
- Role mismatch. A permission scoped to a role name that does not match the user source's role spelling grants nothing. The chart fails exactly as if the permission were off.
FAQ
How do I fix the database error icon on an Ignition Easy Chart?
In the Designer, open Project > Properties, go to the Vision permissions, and enable Legacy Database Access. Save and publish, then update or restart the Vision clients. DB pens need this permission because they send ad-hoc SQL from the client.
How do I use Easy Chart without enabling Legacy Database Access?
Use Tag History pens instead of DB pens. They go through the historian query path. For custom table data, build the dataset with a Named Query, which runs server-side and does not need the legacy permission.
How do I restrict Legacy Database Access to certain users?
Scope the permission to specific roles or security zones in the Vision permissions instead of granting it to everyone. Then test with a user outside those roles to confirm the chart is denied for them.
Why does the database connection show valid while the Easy Chart fails?
The connection test only proves the Gateway can reach the SQL server. The Easy Chart's DB-pen query is rejected by project security before it reaches that connection, so connection and tag diagnostics both stay clean.
When should I contact Inductive Automation support?
Escalate if the chart still shows the database icon after Legacy Database Access is enabled, published, and confirmed in a restarted client, and the Gateway logs show no permission denial. At that point, send support the Gateway logs, the exact error text from the chart, and the Ignition version from the About dialog.