About MichaelS

When working with previous versions of BVMS, remote connectivity was cumbersome due to the amount of port mapping that needed to be configured. BVMS 7.5 provides a new method of remote connectivity utilizing Secure Shell (SSH) Tunnelling. SSH Tunnelling constructs an encrypted tunnel established by an SSH protocol/socket connection. This encrypted tunnel can provide transport to both encrypted and un-encrypted traffic. The Bosch SSH implementation also utilizes Omni-Path protocol, which is a high performance low latency communications protocol developed by Intel. Key management The BVMS SSH service generates a private and public key when it is started for the first time. Both keys are saved in an encrypted file. When the BVMS SSH service restarts this file is detected and the private key is read.   Step-by-step guide   1.Configuration   A. Installation There is little to no configuration required for this feature to function. The SSH Service must be installed and running. If deploying a BVMS Pro system, insure the SSH Service is part of the installation process. Recording Appliances that ship with BVMS 7.5 should have the service pre-installed. Check your “Services”. If the service has not been installed, the install package can be run from the BVMS 7.5 downloadable install package. If working with a DIVAR IP Recording Appliance, the appliance “Installer Package” must be used.   B. Port mapping entry The primary configuration step is to configure one (1) port forwarding for the BVMS Central Server to utilize port 5322 for both internal and external connections. This is the only port mapping entry that needs to be made for the entire system. The image below shows a sample configuration.   2. Operation   A. Login with the Operator Client After the basic configuration is done, logging in via Operator Client is very intuitive: From the log menu, select the “Connection” drop down menu, then Select <New…> You will be prompted to enter an IP address or DNS host name. You will also notice a cheat guide below the entry menu that will assist with address entry. Addressing must be in the following format: ssh://IP or servername:5322. In the example we used: ssh://49.49.49.49:5322. After entering a properly formatted address, enter a valid user name and password. SSH users MUST have a password associated with their BVMS account. User accounts without a password cannot log in utilizing an SSH Connection.   B. Verification After connection is established via an SSH Tunnel, all communications between the BVMS Server (192.168.1.19) and a remote client (49.49.49.48) are encrypted. Below is a Wireshark Capture taken from the BVMS Server after a connection is established. C. Changing the SSH port Locate the SSH service configuration file in "C:\Program Files\Bosch\BVMS\bin" Open the configuration file and find the section below. Edit the value of the BvmsSshServicePort (the port should be unused) and restart the system. ... View more

Time is everything: meetings, public transportation, religion, transactions: the whole world is working because the concept of “time” exists. Within a security (or any other) system this is not different: recording schedules, logging, authorizations, encryption keys, timelines, all of these concepts can exist because of time. As a result, time can either make or break a system: problems can appear only due to a time difference of a couple of seconds between two system components. This article describes how time services can be configured in a BVMS version ≤ 10.1 environment. For BVMS  version ≥ 11.0 please refer to the following article:  Where can you configure NTP server for cameras/encoders in BVMS≥11? Time: what is the challenge? Each device has its own internal clock, which is based on a hardware mechanism. This mechanism acts like a watch: try to put two watches together and synchronize them on the millisecond. A security system consists out of more than two devices, it can consist of thousands of devices. Synchronizing the time of all these devices by hand is a very time consuming task. Additionally, due to small differences in electronic components, devices can have deviations from one another. These deviations cannot be detected by the human eye, but can result in considerable time differences when a device is running for months. Synchronizing time The Network Time Protocol (NTP) was created to solve these challenges. The Network Time Protocol is a network-based protocol for clock synchronization between system components. The protocol utilizes a standard IP network to communicate and can maintain a time difference (considering a local area network) of less than one millisecond between components. The Network Time Protocol is a standard protocol and documented in RFC 5905. The operation and configuration of the Network Time Protocol are complex: a hierarchical architecture needs to be set-up including several layers of systems which are able to run the Network Time Protocol. To reduce complexity the Simple Network Time Protocol (SNTP) was  created. The Simple Network Time Protocol is mainly used when less accuracy (deviations of 1-2 seconds are acceptable). Windows Time Service The Bosch Video Management System is running on Microsoft Windows Server operating systems. Windows includes an internal time service, which is explained on Microsoft Technet: “The Windows Time service, also known as W32Time, synchronizes the date and time for all computers running in an AD DS domain. Time synchronization is critical for the proper operation of many Windows services and line-of-business applications. The Windows Time service uses the Network Time Protocol (NTP) to synchronize computer clocks on the network so that an accurate clock value, or time stamp, can be assigned to network validation and resource access requests. The service integrates NTP and time providers, making it a reliable and scalable time service for enterprise administrators. The W32Time service is not a full-featured NTP solution that meets time-sensitive application needs and is not supported by Microsoft as such. For more information, see Microsoft Knowledge Base article 939322,Support boundary to configure the Windows Time service for high-accuracy environments (http://go.microsoft.com/fwlink/?LinkID=179459).” Source: Windows Time Service Technical Reference - Microsoft Technet The Windows Time service is based on the Simple Network Time Protocol. Summary The Network Time Protocol requires a very complex infrastructure, which impacts the total installation and configuration effort of the system. The Simple Network Time Protocol (also used for the Windows Time Service) reduces the complexity, but at the same time also reduces the accuracy. For most security applications the Simple Network Time Protocol provides sufficient accuracy. Bosch recommends to use the Windows Time service, based on the Simple Network Time Protocol, as basis for time synchronization in a security network. This article provides best-practices on how to configure the Bosch Video Management System and related components in a time synchronization environment based the Windows Time service. Alternatively, the Network Time Protocol can be used whenever it is already existing inside an infrastructure or when event accuracy with a deviation less than one second is required. Due to the complexity of the infrastructure Bosch does not make any recommendations related to the Network Time Protocol.     Step-by-step guide   Management server configuration   A. Operating system configuration This section also applies for the Video Recording Manager and Mobile Video Service when these are not running on the management server. Microsoft has prepared a lot of documentation related to time configuration Go to the Microsoft Support: How to configure an authoritative time server in Windows Server page and scroll down to the section “Configuring the Windows Time service to use an external time source”. Click the download button under the “Here’s an easy fix” section. Figure: Download the Microsoft Windows Time service configuration utility   The utility will configure external time servers. To select these, browse to http://pool.ntp.org and select two servers which are related to the geographical location of the system, for example “de.pool.ntp.org” and “nl.pool.ntp.org”, referring to Germany and the Netherlands. Another (local or external) (S)NTP server can also be chosen.   Start the Microsoft configuration utility and configure it as indicated and shown in the figure below. Administrative access is required to run the utility. Figure: Pool.ntp.org locations   Figure: Windows Time service configuration   Alternatively the configuration can be done from the command-line, using the command shown below. net stop w32time w32tm  /config   /syncfromflags :manual  /manualpeerlist : "nl.pool.ntp.org, de.pool.ntp.org" net start w32time The configuration can be verified by starting the Windows Command prompt and issuing the command “w32tm /query / status”, as shown in the figure below. Notice the time source, this should point towards the configured servers. Figure: verifying configuration   It can take up to one minute before the correct time source is displayed. When there is a problem, the configured (S)NTP server can be tested by issuing the “w32tm /stripchart /computer:de.pool.ntp.org”, which should result in the output displayed in the figure below. Figure: test the (S)NTP service   When an unexpected result is returned, it is recommended to check access to the specific (S)NTP server. A firewall might prevent the communication between the (S)NTP server and the management server.   B. BVMS Management Server configuration BVMS automatically points devices to its own time-server. This can be changed by editing the BvmsCenterlServer.exe.config file, located in C:\Program Files\Bosch\VMS\bin\. Find the key "TimeServerIPAddress" and adjust the value, as shown in the example below (192.168.0.1). <!-- Ip address of the time server for VRM/NVR encoders(defaults to the Central-Server IP if not set). --> < add   key = "TimeServerIPAddress"   value = "192.168.0.1"   />     C. Workstation configuration The Bosch Video Management System Operator client runs on a Windows workstation. When the workstation and server are part of the same Microsoft Active Directory service domain, no manual time synchronization needs to be configured. Figure: workstation configuration, "192.168.0.200" needs to be replaced by the IP address or Fully Qualified Domain Name of the management server.   When the Bosch Video Management System workstation and management Server are not joined in a domain, or into the same domain, the workstation(s) need to be manually configured to use the management server as a time server. To achieve this, the description above can be used. Instead of using the pool.ntp.org as a server, the management server is now entered.   D. Camera configuration If a camera is connected to a BVMS system the time server will be automatically configured. ... View more

BVMS uses streamlining to reduce the amount performance that is needed by a workstation to display a high resolution video stream.  Opening many high resolution cameras results in a substantial increase of CPU and/or GPU load on the Operator Client workstation. We reduce the load on the workstation by configuring the (Bosch) camera with a high resolution and low resolution stream. The stream selection depends on the size of the video and the monitor resolution. For example: You have a camera that delivers a 1280 x 720 stream. You are running your Operator Client with 16 image panes (4x4). On a 21" display, one image pane has an on-screen resolution size of roughly 554 x 306 pixels. There is no benefit of opening a 1280 x 720 stream in a 554 x 306 image pane. In this case it would be sufficient to display, for example, a 4CIF stream (704 x 480). This 4CIF stream would still provide more pixels than technically fit into the selected image pane.   Step-by-step guide   Every time you open a camera or change the number of image panes the Operator Client calculates which stream it should display. The selection of the stream is based on the exact resolution of the video streams and the dots per inch (DPI) on the screen. The frames in stream 1 are 1280 pixels wide, which results in a dpi value of 1280 pixels / 5,7" (1/4th of the 21" screen) = 224 dpi The frames in stream 2 are 704 pixels wide, which results in a dpi value of 704 pixels / 5,7" (1/4th of the 21" screen) = 123 dpi For a good "visual fidelity", a video should have at least 64 dpi when being viewed from a distance of 50 cm. The "Automatic Stream Selection" feature makes sure that the video resolution never falls below these 64 dpi. For this example, the choice is clear: displaying stream 2 is sufficient, since the 123 dpi of stream 2 are clearly above the lower limit of 64 dpi. Suppose we maximize the image pane. A maximized image pane has a width of roughly 1146 pixels and the width of the cameo on the screen is around 11,9". Stream 1: 1280 pixels / 11,9" = 107 dpi Stream 2: 704 pixel / 11,9" = 59 dpi The 59 dpi of stream 2 falls below the visual fidelity limit of 64 dpi. The Operator Client decides to use the high resolution stream instead. These two examples show how the Operator Client dynamically switches between high resolution and low resolution streams. 🛈 Maintenance hint: The default dpi value can be changed by editing file: ...\Program Files (x86)\Bosch\Vms\bin\OperatorClient.exe.config The default dpi value can be found in line: < add   key = "MinDpiForAutomaticStreamSwitch"   value   =  "64" />   To get a different automatic stream switching behavior, simply change the default value of 64 to a different value. When increasing the dpi value, the switch to the higher resolution stream will already happen for cameos of smaller size. When decreasing the dpi value, the switch to the higher resolution stream will happen only for very big cameos. When setting the dpi value to a very high value, the higher resolution stream will always be active. This is equivalent to disabling the stream switching automatism.   The stream selection depends on several factors, for example, monitor resolution, monitor dpi, and image pane size. The automatic use of a lower resolution stream has a second positive effect. Display stamping texts can be read much easier in a low resolution video stream, compared to the tiny texts of a high resolution stream.   Automatic Stream Selection:   Q1: I have maximized a cameo of an UHD camera, but I still see the low resolution stream - why? A: For your specific setup (Operator Client layout, monitor resolution/dpi), the low resolution stream might still be still sufficient to provide good image quality. If you want to get a high resolution stream, you need to zoom in or enlarge the image pane, for example, by entering full screen mode or by moving the splitter bars of the logical tree or the alarm list. Please note that the maximize cameo operation does not mean "display the high resolution stream". Q2: I use 4:3 cameos. When I maximize a cameo, I still see the low resolution stream - why? A: Note that for 4:3 cameos, only the width of the video is taken into account. The "black borders" around the video are not taken into consideration during the calculation of the video stream dpi. See also answer of Q1. ... View more

This article describes how to configure a generic Microsoft Windows Server (2012 R2, 2016 or 2019) based server to serve as an iSCSI target for a Bosch video surveillance environment. SCSI (Small Computer System Interface) is most commonly used for the communication between computers and peripheral devices, such as hard drives. iSCSI enables devices to use SCSI over a network interface, therefore it makes a lot of sense for cameras to use iSCSI to record video. The camera is a small computer that needs a (network) connection to a "hard drive" to store video footage. In other systems this job is performed by the network video recorder (NVR). Image: Network Video Recorder versus Bosch iSCSI based storage. The Storage Area Network (SAN) could also be iSCSI based.   A network video recorder introduces a single point of failure: all video streams are being processed by a single software process. When this process fails (hardware failure, software crash) a standby network video recorder can connect to those cameras and take over the recording process. This process consumes some time and will result in a small recording gap. A network video recorder does not exist in a Bosch environment. However, there is one exception: when non-Bosch cameras are used a network video recorder called Video Streaming Gateway is used to record streams from these cameras onto the iSCSI environment. 🛈 Microsoft Server Windows 2016 This guide is based on Microsoft Windows Server 2012 R2. Microsoft did not make major changes in the transition to Windows Server 2016 or Windows Server 2019. This guide could therefore also be used as a guide for Windows Server 2016 or Windows Server 2019.     Step-by-step guide   Microsoft iSCSI Target The Microsoft iSCSI target is part of all Windows Server editions. It will pick-up the iSCSI traffic coming from the camera and will write it the storage device. This storage device can be connected to a storage area network, but can also reside within the same system as local hard drives.   Since Windows Server 2012 R2 the iSCSI target support up to 544 iSCSI sessions (source: Microsoft Technet - iSCSI Target Server Scalability Limits). For fail-over purposes and, depending on the configuration, a camera connects to an active iSCSI target and a passive iSCSI target simultaneously. Bosch recommends to allocate up to 256 cameras to a single Microsoft iSCSI target based on Windows Server 2012 R2.   Configuration   🛈 Windows Advanced Firewall Before starting the configuration, the Windows Advanced Firewall needs to allows iSCSI traffic to pass. Microsoft Technet - Configuring Windows Firewall for iSCSI Software Target describes how to achieve this.   Install the iSCSI target Check if the Role "File and Storage Service iSCSI Target Server" is installed. Start the "Server Manager". This will start the "Add Roles and Features Wizard". Click "Next".   Choose the "Role-based or feature-based installation" option.   Select the system on which the iSCSI target needs to be installed (normally this would be the local system on which the wizard is started).   Check of iSCSI target Server is installed. If not installed, select iSCSI Target server and install the role.   Configure the iSCSI target 🛈 Configure storage device Before continuing with this guide, the (optional) storage arrays need to be configured and connected to the Windows operating system. This means the arrays should have a drive letter assigned to them. As this process is different for each and every storage vendor, Bosch recommends to contact the storage vendor for documentation regarding this process.   The iSCSI target server uses virtual disks, which are assigned to an iSCSI target. The virtual disks are used for recordings of cameras. The size of the virtual hard disks represent the size of LUN’s assigned to the VRM. Bosch recommends to use a maximum LUN size of 2 Terabyte. A single Video Recording Manager can handle up to 2 Petabyte. If more storage is required, another Video Recording Manager needs to be added. To start the configuration, open the Windows 2012 Server Manager, select "File and Storage Services" and click "iSCSI". Start the wizard: “To create an iSCSI virtual disk, start the New iSCSI Virtual Disk Wizard”. Select the volume to create new virtual hard disks.   On this server the F drive is used to create the virtual disks. In the next step, the disk name needs to be specified.   Define the size of the virtual hard disk, minimum 200 GB and maximum 2048 GB and make sure “clear the virtual hard disk on allocation” is checked. Multiple disks need to be created if the storage capacity of the system exceeds 2048 GB. One iSCSI target can contain multiple disks. Each disk will be represented as a LUN.   When a new system is created: create a new iSCSI target and define the name of the target. When a new virtual disk is added to an existing system: select the iSCSI target to which the disk needs to be added.   In the "Target name and Access" window the access to the target is specified. We recommend you to configure an IQN or IP based filter that ensures only the whitelisted devices have access to the iSCSI target. For demonstration purposes the "*" can be used in the IQN filter to whitelist all devices.   CHAP authentication is supported and can be enabled as required. The Video Recording Manager and cameras (described in their respective manuals) need to have a matching configuration.   Finish the wizard.   Configuration using Powershell #create target New-IscsiServerTarget TG0 -InitiatorID Iqn:* $disk = Get-WmiObject Win32_LogicalDisk -Filter "DeviceID='D:'" | Select-Object Size,FreeSpace #calculate how many vhdx files to create and then do it in a loop Write-Host "total space on volume in bytes " $disk.Size Write-Host "free space on volume in bytes " $disk.FreeSpace $freeSpaceInMB = [int]($disk.FreeSpace / (1024*1024)) Write-Host "free in MB " $freeSpaceInMB $lunSizeInMB = 1950 * 1024 $lunCount = [int]($freeSpaceInMB / $lunSizeInMB) For($i=0; $i -lt $lunCount; $i++) { $currentFileName = ("d:\" + "vhd_" + $i + ".vhdx") New-IscsiVirtualDisk -DevicePath $currentFileName -Size 1950GB -fixed -DoNotClearData Add-IscsiVirtualDiskTargetMapping -TargetName TG0 -DevicePath $currentFileName } BVMS configuration When adding a new storage device to the BVMS (as described in the BVMS configuration manual) some parameters are required.   Specify the values as required, and use a Windows user-name and password which has administrative access on the iSCSI server. Activate the configuration before making further changes. The target needs to be scanned once the target configuration is activated. 🛈 WARNING When the BVMS Config Client is not able to scan the iSCSI target, it is most likely the selected user account does not have the rights to provide the BVMS with the correct information. Ensure that the Windows user is part of the "administrators" group. A description on how to do this can be found on Microsoft Technet - Add a member to a local group.   After adding the iSCSI device an error message could pop up. This message indicates the current file format on the LUN is not recognized and it needs to be formatted. Click "OK". Select the LUN(s), and click "Format LUN".   As this will be a new system no data is currently stored on the LUNs, the warning message can be accepted. Right click on the iSCSI device, and click "Load balancing". Set the upper limits for the permitted bit rate and the number of simultaneous iSCSI connections for each iSCSI system. If these limits are exceeded, data is no longer being written to the iSCSI system and is lost. 🛈 Performance The load balancing limits are very important: If the storage device cannot offer the performance which is configured, recording gaps might appear and cameras might loose connections to the storage device.   Storage system As storage systems from different vendors differ in configuration, the specific configuration details are not in the scope of this article. Some general recommendations regarding the configuration of a storage system are given.   Cache There are three main caching techniques that can be deployed: Write-through cache: directs write I/O onto cache and through to underlying permanent storage before confirming I/ O completion to the host. Write-around cache: write I/O is written directly to permanent storage, bypassing the cache. Write-back cache: write I/O is directed to cache and completion is immediately confirmed to the host: this is the recommended way of writing for video footage.   Troubleshooting Recording gaps and camera disconnect messages can appear if the storage system experiences problems, or is overloaded.   1 Video Recording Manager The Bosch Video Recording Manager included a lot of tools to evaluate the performance of the system and analyze problems. The Video Recording Manager dashboard can be opened by browsing to the IP address on which the Video Recording Manager is installed. Alternatively the Video Recording Manager dashboard can be opened by right-clicking on the Video Recording Manager in the BVMS Config client, and clicking "VRM monitor". The Targets page (under Storage), shows the individual targets and their status.   The Storage Overview page shows the total consumes bandwidth and system capacity.   The System Logbook shows current system events. If cameras are disconnected from specific target, messages will show up in the logbook.   2 Windows Resource Monitor The Windows operating system also has a lot of tools on-board which can help analyze performance issues. The Resource Manager can be used to look at read/write rates, active time and response time.   Microsoft Technet - Using performance monitor describes how to use the performance- and resource monitor.   3 Hardware specific tools Storage vendors may have hardware specific tools to monitor the status of the storage devices. These can give additional insights into the status of a device. Most of these tools also allow system monitoring, and can alert when (for example) a hard-drive fails. The BVMS supports receiving SMTP messages from these devices, and can present these to the operator for follow-up. The configuration of SMTP is outside of the scope of this article, but can be found in the BVMS configuration manual.   After-sales support When using Bosch storage devices, an end-to-end Bosch engineered system is delivered. As a result, components are well known and expertise is available to analyze and solve the most difficult issues. Using non-Bosch storage devices is therefore a challenge: it is not possible to have in-depth knowledge on all storage brand and devices. This section will give clear insights in what Bosch technical support can and cannot do. 🛈 WARNING Storage devices are complex and require specific knowledge. Ensure the engineers who are designing and configuring the storage system are properly trained by the storage manufacturer and are able to troubleshoot together with Bosch technical support whenever problems arise. Knowledge on how to operate Wireshark, Windows Server and basic networking is required.   Whenever problems arise, Bosch technical support will help with: Verifying the camera can reach the iSCSI target, based on the configuration guide in this article. Verify the video footage arrives on the network interface of the iSCSI target (using Wireshark). Analyze camera logfiles. Analyze VRM logfiles. Bosch technical support will help to ensure that the data coming from the camera arrives at the storage server. Bosch technical support will not help with: Performance analysis of the storage. Hardware configuration of the storage (includes configuration of LUN's).   External information The use of non-Bosch storage devices is based on the usage of IT standard equipment. The information linked below can be used as a reference for further information. For specific configuration manuals the storage vendor should be contacted. Configuration guide for the Microsoft iSCSI target on Microsoft Technet (can be used to configure the Microsoft iSCSI target, which is part of all Microsoft Windows Server editions) Explanation of the iSCSI protocol on Wikipedia (readable description of the iSCSI protocol) Recommended RAID settings for DIVAR IP 6000 (these can also be applied for other storage systems) DIVAR IP & RAID articles ... View more

This article provides an overview of Operator Client (BVMS 10.0.1) for most used functionality for security operators and incidental users.   Step-by-step guide   1. Show live video from a selected camera   The left side of the screen shows a list of folders / cameras. Drag and drop the camera you want to view to the video window, as indicated in the figure below.   2. Show multiple cameras at the same time   Change the screen layout by using the slidebar on the top-right of the screen, as indicated in the figure below. Moving the arrow to the right will increase the number of video windows. Drag and drop the camera you want to view in the video window you want it to appear, as explained in the previous section.   3. Show recorded video   First, you have to change from “ live” mode to “playback”  mode. Use the button on the top left of the screen, indicated in Figure 3. The video windows will be empty again. Drag and drop the camera(s) you want to show for playback to the video window(s), as shown in the first section. The selected cameras will also appear in the list below the date and time selection, shown in the figure above (“Dinion HD 720p starlight Roof”). If the display is configured to show multiple cameras you can view the recorded video of multiple cameras simultaneously. The layout of the bottom of the screen will change and will allow you to browse to a date and time, shown in the figure below. Browse to the date and time. You can set the zoom-level using the drop-down-list or use the scroll-wheel of your mouse. You can swipe, using your mouse, from left to right to navigate backwards or forward in time. Use the buttons left to the date and time selection to play, pause, forward or backward the video. Use the slide-bar left to the control buttons to adjust the speed of playback.   4. Forensic (motion) search   First, open the Forensic Search mode by clicking the bottom tab on the left side of the screen (marked in blue in the image below). You can edit the fields in the video image pane by moving them around. The time range for the search can be selected by grabbing the blue handles on the bottom of the screen. Create a new field or filter and adjust it as required by following the wizard that is started when clicking the "+" button. Other parameters can be adjusted in the next step of the Forensic Search to further filter in the search results. A longer search time will increase the time that is needed to conduct the search. Click "Search" to start the search. The system will list the results on the bottom of the Operator Client window. Click on a search result to display the related video.   5. Export video   Once you have found the video footage you want to export (select the right area using the blue handles on the bottom of the time-line), you can right-click to open the context-menu, and click "Export Video". The “Export video” window will appear. Adjust the time range of the video you want to export. Change the format to ASF if you want to be able to play the video on other computers. Choose if you want to export the video to disk (or USB stick) or want to burn it directly to DVD or CD. Click “Export” when you adjusted the options to your needs.   6. Panoramic Cameras   Panoramic cameras can be dragged and dropped into a cameo, just as any other camera. The cameo size can be increased and decreased by selecting the cameo (the edge-color will change), and dragging and dropping the edge of the cameo, as shown in the image below. Additionally, a specific part of the panoramic camera can be copied to another cameo. For this, hover over the panoramic cameo, press and hold the "CTRL" button of the keyboard, and drop it in another cameo. ... View more