IoT Device Operation Management

User Manual
English v-1.0.18

Revision History
Date

VersionAuthorReviewer

Description

2019-12-16

1.0.5

Sephiroth.Wang

2019-12-23

1.0.5

Alex.Shao

Sephiroth.Wang

Section 4.1, 4.2, 4.3, 4.5

2019-12-27

1.0.5

Terry.Lu

Sephiroth.Wang

Section 5.1

2020-01-10

1.0.5

Wunhuei.Liou

Sephiroth.Wang

Section 5.3

2020-02-03

1.0.6

Sephiroth.Wang

2020-02-10

1.0.6

MingWei.Tasi

2020-02-12

1.0.6

Sephiroth.Wang

2020-03-11

1.0.6

Scott.ChangFirst version released
Section 1, 2, 3, 4.4, 6, 7

Section 6.7, 6.8, 6.9
Sephiroth.Wang

Section 4.6
Section 6.10

Sephiroth.Wang

Section 6.3
Add Section 6.8, and move 6.8-> 6.9, 6.9-

2020-03-25

1.0.7

Sephiroth.Wang>6.10
Add Section 7.2
Change wallpaper on first page2020-04-01

1.0.8

Sephiroth.Wang

Add new log mechanism on Section 6.6
Add Section 4.7 for device provisioning.

2020-04-06

1.0.9

Alex.Shao

Sephiroth.Wang

2020-04-10

1.0.10Daniel.Hung

Sephiroth.Wang

Section 2.1.4
Add plugin development on RISC (Section
5.1.4)
Add plugin development on Android

2020-04-21

1.0.11

Listzt.Kao

Sephiroth.Wang(Section 5.1.5)
Modify WISE-DeviceOn -> WISE-DeviceOn
Review all document and update new user

2020-09-02

1.0.12

Sephiroth.Wang

2020-09-09

1.0.13

Sephiroth.Wang

2020-09-22

1.0.14Sephiroth.Wang

2020-10-27

1.0.15

Sephiroth.Wang

2021-01-26

1.0.16

Sephiroth.Wang

Refactor document for v-4.3.3 released

2021-10-13

1.0.17

Sephiroth.Wang

Refactor document for v-4.4.2 released

2022-01-24

1.0.18Sephiroth.Wang

Refactor document for v-4.5.2 released

Purchase Information & Product Page

interface for v-4.2.3
Add Telegram, Teams, Slack Notification
Service (4.3.5 ~ 4.3.7)
Add Linux Agent Onboarding and Re-adjust
catalog.
Remove data flow on FAQ and Update HTTPs
for WebSocket.

1

Table of Contents
Revision History .............................................................................................1
Table of Contents ...........................................................................................2
1. Introduction ...............................................................................................7
1.1

Feature Highlights ........................................................................................................................9

1.2

DeviceOn Server Versions ....................................................................................................... 13

1.2.1

Standalone, VM (Cloud) .............................................................................................. 14

1.2.2

Azure PaaS, Kubernetes (Cloud) ................................................................................ 15

1.2.3

Data Service Server for Private Cloud......................................................................... 15

1.2.4

WISE-PaaS/EnSaaS (Cloud) ...................................................................................... 17

1.3

DeviceOn Agent Version .......................................................................................................... 17

1.3.1

WISE-Agent Architecture ............................................................................................ 18

1.3.2

WISE-Agent (Client) .................................................................................................... 19

1.4

Security ...................................................................................................................................... 20

1.4.1

Role-Based Access Control (RBAC) ........................................................................... 22

1.4.2

SSL Encryption ........................................................................................................... 22

1.4.3

Vulnerability Scanning Tools ....................................................................................... 23

1.4.4

Third-Party Vulnerability Fixed and Updates ............................................................... 25

1.4.5

Scanned Report .......................................................................................................... 25

2. Getting Started ........................................................................................ 26
2.1

DeviceOn Cloud Installation ..................................................................................................... 26

2.1.1

Setup Standalone Version (On-premise) ..................................................................... 26

2.1.2

Setup Standalone Version for Ubuntu Linux (On-premise) .......................................... 35

2.1.3

Redeem AKS Version from WISE-PaaS Marketplace ................................................. 37

2.2

2.2.1

DeviceOn Client Installation ..................................................................................................... 45

Setup Device Onboarding (Windows) ......................................................................... 45

Purchase Information & Product Page2

2.2.2

Setup Device Onboarding (Linux) ............................................................................... 54

3. DeviceOn User Interface & Functions ...................................................56
3.1

DeviceOn Server (Standalone) ................................................................................................. 56

3.1.1

Standalone Server Control .......................................................................................... 56

3.1.2

Background Watchdog Service ................................................................................... 60

3.2

DeviceOn WISE-Agent .............................................................................................................. 60

3.2.1

WISE-Agent Connection ............................................................................................. 61

3.2.2

WISE-Agent Services.................................................................................................. 66

3.3

DeviceOn User Interface ........................................................................................................... 67

3.3.1

DeviceOn Overview .................................................................................................. 154

3.3.2

Device Management ................................................................................................... 70

3.3.3

Account Management ............................................................................................... 104

3.3.4

Event Logs ................................................................................................................ 106

3.3.5

App Management (Enhancement OTA) .................................................................... 108

3.3.6

System Configuration ................................................................................................ 117

3.3.7

Dashboard ................................................................................................................ 140

4. Hands-On LABs .................................................................................... 143
4.1

How to Create a Real-time Action into Overview ................................................................. 144

4.1.1

Prerequisite............................................................................................................... 144

4.1.2

Step-by-Step ............................................................................................................. 144

4.2

How to Upload an App to Your App Store ............................................................................ 147

4.2.1

Prerequisite............................................................................................................... 147

4.2.2

Step-by-Step ............................................................................................................. 147

4.3

How to Remote Software Provisioning via OTA .................................................................. 154

4.3.1

Prerequisite............................................................................................................... 161

4.3.2

Step-by-Step ............................................................................................................. 161

4.4

How to Set a Device Threshold and Event Notify Services ................................................ 167

Purchase Information & Product Page3

4.4.1

Prerequisite............................................................................................................... 167

4.4.2

Steps to Set Event Notification Service – Email ........................................................ 167

4.4.3

Steps to Set Event Notification Service – LINE ......................................................... 169

4.4.4

Steps to Set Event Notification Service – WeChat .................................................... 172

4.4.5

Steps to Set Event Notification Service – Telegram .................................................. 176

4.4.6

Steps to Set Event Notification Service – Microsoft Teams ....................................... 179

4.4.7

Steps to Set Event Notification Service – Slack ........................................................ 181

4.4.8

Steps to Set Thresholds to a Device ......................................................................... 185

4.5

How to Visualize Device Data via Grafana Dashboard ........................................................ 188

4.5.1

Prerequisite............................................................................................................... 188

4.5.2

Step-by-Step ............................................................................................................. 188

4.6

How to Enable/Disable Windows Lockdown Features ........................................................ 191

4.6.1

Prerequisite............................................................................................................... 192

4.6.2

Step-by-Step ............................................................................................................. 192

4.7

How to Deploy & Manage DeviceOn on AKS ........................................................................ 194

4.7.1

Prerequisite............................................................................................................... 195

4.7.2

Steps to Deploy DeviceOn to AKS by Manual ........................................................... 195

4.7.3

Steps to Upgrade DeviceOn...................................................................................... 203

4.8

How to Batch Provision to Your Devices .............................................................................. 205

4.8.1

Prerequisite............................................................................................................... 205

4.8.2

Steps to Local Provisioning ....................................................................................... 205

4.8.1

Troubleshooting ........................................................................................................ 209

4.9

How to Secure Connect to DeviceOn though X.509 ............................................................ 210

4.9.1

Prerequisite............................................................................................................... 210

4.9.2

Steps to Generate the Credential Files ..................................................................... 211

4.9.3

Steps to Download the Credential Files from DeviceOn Server................................. 211

4.9.4

Steps to Configure the Setting of WISE-Agent .......................................................... 213

Purchase Information & Product Page

4

5. DeviceOn Development Guide ............................................................. 216
5.1

WISE-Agent Plugin Development .......................................................................................... 216

5.1.1

WISE-Agent Architecture .......................................................................................... 216

5.1.2

Prerequisite............................................................................................................... 218

5.1.3

Develop a Plugin on Windows Environment .............................................................. 218

5.1.4

Develop a Plugin on Linux Environment .................................................................... 223

5.1.5

Develop a Plugin on Android Environment ................................................................ 225

5.2

DeviceOn UI Plugin Development.......................................................................................... 225

5.2.1

Prerequisite............................................................................................................... 225

5.2.2

Environment Setup ................................................................................................... 226

5.2.3

Develop a Sample Add-in ......................................................................................... 227

5.2.4

Develop an Add-in to Access DeviceOn API ............................................................. 231

6. FAQ ........................................................................................................ 234
6.1

General ..................................................................................................................................... 234

6.1.1

How to Get DeviceOn Product Information & News? ................................................ 234

6.1.2

How to Get WISE-Agent Installer? ............................................................................ 234

6.1.3

How to Monitor Device Hardware Information? ......................................................... 234

6.1.4

What is a License Key?................................................................ 錯誤! 尚未定義書籤。

6.1.5

How to Purchase a License Key for Non-Advantech Device? ................................... 235

6.1.6

How Do I Find My DevieOn License Key?................................................................. 235

6.1.7

How Many Devices Could be Managed on DeviceOn? ............................................. 235

6.1.8

Does DeviceOn Support on Cloud? .......................................................................... 235

6.1.9

How to Deploy DeviceOn on Azure? ......................................................................... 235

6.1.10What Operating System Are Supported on WISE-Agent? .................................. 235

6.1.11Can DeviceOn Perform Bulk Operations on Devices Remotely? ........................ 235

6.1.12

Does DeviceOn Provide Integration Document for Customization? .................... 236

6.1.13

How to Upgrade Software, Firmware via DeviceOn? .......................................... 236

Purchase Information & Product Page

5

6.1.14

Does Azure Provide the Similar Service Compare with DeviceOn? .................... 236

6.1.15Which Tier (Size) of Azure VM Should I Select and Cost Estimate? ................... 236

6.1.16How Can I Get Support? .................................................................................... 237

6.2

Technical .................................................................................................................................. 237

6.2.1

Why the WISE-Agent Cannot Install? With error code 12007? .................................. 237

6.2.2

Why does the installation UI not appear after I execute the WISE-Agent? ................ 238

6.2.3

Why the WISE-Agent Cannot Download from Device Onboarding? .......................... 239

6.2.4

Why the Acronis and McAfee failed to Install? .......................................................... 240

6.2.5

Why Your SMTP Server Cannot Send a Mail? .......................................................... 240

6.2.6

Why Some of Devices Cannot Power On .................................................................. 241

6.2.7

Why Cannot Remote Control via KVM (Remote Desktop) ......................................... 245

6.2.8

How to Enable and Adjust WISE-Agent Log Levels .................................................. 245

6.2.9

Why the Dashboard Cannot Display All the Data within the Interval? ........................ 248

6.2.10Why Cannot Screenshot and Always Show Device “No Login” .......................... 248

6.2.11

How to Enable/Disable Plugins on WISE-Agent ................................................. 254

6.2.12

How to Adjust DeviceOn Server Address (Standalone) ...................................... 255

6.2.13

How to Migrate EdgeSense Database to DeviceOn (WISE-PaaS/EnSaaS) ....... 257

6.2.14

How to Enable Data Retention on DeviceOn ...................................................... 262

6.2.15

How to Enable HTTPS on DeviceOn Web Service ............................................. 264

6.2.16

How to Enable Passive Mode on DeviceOn FTP Server .................................... 269

7. Reference .............................................................................................. 273
7.1

User Permission ...................................................................................................................... 273

7.2

Retrieve My Azure Account Information ............................................................................... 277

7.2.1

Method 1 – Create & Get Information on Azure Portal .............................................. 277

7.2.2

Method 2 – Create via Azure CLI (Command-line Tool) ............................................ 283

Purchase Information & Product Page

6

1. Introduction
A surge in market demand for Industrial IoT products has rapidly increased the number ofconnected devices that are currently deployed and managed across different locations. It is essential
to effectively manage, monitor, and control thousands of connected devices while ensuring
uninterrupted service. Devices must work properly and securely after they have been deployed without requiring frequent visits from service technicians. Customers require secure access to theirdevices in order to detect, troubleshoot, and undertake time-critical actions.

With Advantech’s WISE-DeviceOn, users can swiftly utilize onboard devices, efficiently monitor
device health status, and securely send software and firmware updates over-the-air (OTA) on-site andremotely at scale.
Advantech’s brand-new designed IoT device operations and management App solution gives
users a transformational plug-and-play experience. Beginning with onboarding devices, WISEDeviceOn’s zero-touch IoT tech seamlessly registers Advantech hardware systems with identity
security and field site settings. A fast and simple setup helps provide instant intelligent edge
onboarding, data acquisition, and status visualization at the device operations center. Power on/off,
Purchase Information & Product Page

7

troubleshooting, and mission-critical actions are available at the tap of a button for quick and easy
access. OTA software updates itself securely by sending software patch, firmware, software, andconfiguration updates through batch provisioning. The App is designed to ensure maximum efficiency
in IoT device operations and management.

Power up your IoT devices with this hardware and software integrated solution. Get the mostout of the WISE-DeviceOn’s features with predictive device maintenance like IPC HDD lifecycle
prediction, analytics-based dashboard and automated event alerts. In bringing artificial intelligence
to your IoT needs, Advantech delivers improved risk management, faster daily operations, and better
device performance while improving business value and intelligence through the extraction of big
data.
WISE-DeviceOn is compatible with all Advantech hardware systems and works on popular
platforms and services like the WISE-PaaS public/private cloud, Microsoft Azure, VM on-premise, andKubernetes. Get your WISE-DeviceOn version on the WISE-PaaS Marketplace and kick-start your new
and improved device operations and management experience.

Purchase Information & Product Page8

1.1 Feature Highlights•

Device Connectivity & Monitoring
With more and more IoT devices in the field and the need for remote management andmonitoring of those devices, the most important thing is how to achieve secure and fast
onboarding to WISE-DeviceOn. There are two mechanisms provided, one is Zero-touch, where
the user does not need to configure any of their devices. Just power-on the devices and they
will connect to DeviceOn automatically. However, there is the limitation that the device’s
network must have the ability to directly connect to the public cloud. The second mechanism
is called “One-time configuration, automated onboarding”. Based on this mechanism, theuser only sets up one device to connect to the cloud and uses this device to search and bringothers to the cloud. Furthermore, this scenario supports public/private provisioning if there isno public cloud connection due to environmental limitations.
DeviceOn supports general real-time monitoring of device health that includes hard disk, CPU,
memory, network load and provides various alerting mechanisms. Additional proprietary
sensors such as CO2, battery monitoring or various proprietary protocols can be supported
through design-in services.

•

Bulk Management & Maintenance
For management and real-time control of a group of devices, DeviceOn offers a default
overview with one-click actions, such as “One-Click Power On”, “One-Click Protection”, “OneClick Recovery”, “One-Click Turn off backlight” and so on. Operators do not need to spend lotsof effort to setup devices one by one, but can simply “One-Click” maintain their field devices.

Purchase Information & Product Page

9

The following actions are supported by DeviceOn:
Power Savingo▪

Power On/Off, Reboot▪

*Backlight On/Off

Securityo▪

Protection On/Off▪

System Backup/Recovery▪

**USB Lock/Unlock
Block USB drives and removable disks (Not supported on “Administrator” user)▪

**Keyboard Lock/Unlock
Block function key, such as “ALT”, “CTRL”, and windows key.

▪

**Touch Gesture Lock/Unlock (supported with capacitive touch panel only)▪

**Touch Lock/Unlock

Systemo▪

Screenshot▪

Audio Mute/Unmute▪

*Watchdog Enable/Disable (Default reset time is 60s)
Reboots the system if it becomes unresponsive, to avoid hanging at “BSoD”(Blue Screen of Death) or similar situations▪

**Notification Block/Unblock
Disable windows notification from applications and other sources▪

**UWF Enable/Disable
Helps to protect your drives by intercepting and redirecting any writes to thedrive (app installation, settings changes, saved data) to a virtual overlay

Above actions prefixed with ‘*’ require the respective Advantech SUSI Driver and actions
prefixed with ‘**’ require following operating systems:••

Windows 10 Enterprise LTSC 2019 (LTSC)•

Windows 10 Enterprise 2016 LTSB (LTSB)

Device Remote ControloDevice Diagnostics
Provides remote control mechanism, such as KVM (Remote Keyboard-Video-Mouse)
for real-time remote desktop access to the devices. The screenshot functionality allows
to capture the device’s current screen output for potential troubleshooting. Anotherfeature is access to Windows or Linux shells, for example in order to quickly retrieve
network status via ipconfig/ifconfig, netstat to dump socket/TCP/UDP information,
without having to use the full graphical user interface.

Purchase Information & Product Page

10oOTA (Over the Air)OTA supports an open framework, which can easily integrate 3rd party storage, suchas FTP and cloud solutions (Azure Blob, AWS S3, AliYun, Openstack Swift). It does not
only support remote update and deployment, but supports automatic update fromserver side as well as scheduled updates that get triggered from the agent side.
Scheduling helps to avoid peak network traffic times and allows implementation of
download and deployment schemes that reduce potential impact to a minimum.
The framework supports upgrade package backups as well as rollback to the previous
version when required.
Scripting support (shell/batch) allows to implement flexible update mechanisms.

oPower Management
Sets the power on/off schedule for remotely located devices; the schedule can be set
on a daily, weekly, monthly, or yearly basis. Supports Agent mode enable powering on
across networks.

oProtection Management
DeviceOn system protection is powered by McAfee, providing white list protection
against unauthorized application execution, and also sending warnings of any
unauthorized activities.

oBackup & Recovery
DeviceOn system recovery is powered by Acronis, providing hot backup and scheduled
backup, and also one-click recovery.

•

Simplified Operation & Support
In general, the utmost goal of system integrators or IoT device operation managers is meeting
service level KPIs without having to spend huge efforts or daily maintenance. Once hardware
fails, it results in a serious increase in operation cost. DeviceOn provides rule-based
management and implements HDD failure prediction. If a managed device shows any anomaly
on a specific component or sensor, DeviceOn can send alert messages through email or SMS,
or can optionally integrate with social media services such as LINE, WeChat. The DeviceOn
overview shows overall status, upcoming schedule, top 5 potential risk devices as well as
device location at a glance.

Purchase Information & Product Page

11

There is a summary for these feature highlights on different operation system and hardware
requirement.
Windows Windows 10

UbuntuLinux on RISC Android on

7, 8, 10

LTSC, LTSB

16.04 x64

(Yocto)RISC

Role-Based Access Control

●

●

●

●

●

Two-Factor Authentication (2FA)

●

●

●

●

●

LDAP & Azure AD Domain Service

●

●

●

●

●

Device Zero-touch Onboarding

●

●

●

●

●

Device & Device Group Management

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

◐

◐

Backup/Recovery, Protection

●

●

●

Device Data with Zero-Downtime

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

Audio Volume Control●●

1-Click to Data Visualization

●

●

●

●

●

Statics System Report

●

●

●

●

●

DeviceOn Feature Highlight

Device Threshold Detection (Rule-based
Engine)Notification & Alert Service(Mail, SMS, LINE, WeChat, WhatsApp,
Telegram, Teams, Slack)
Device Real-time & Historical Data
Monitoring
App Store (OTA), Software, Firmware

Standard
Offering

Provisioning
Power Control, Terminal, Screenshot,
Remote Desktop

Process Monitoring & Control (Terminate,
Restart, Launch)Container Management (Start, Stop,
Monitoring)Operation Management(Batch Control & Statistical Analysis)

Purchase Information & Product Page

12

Intel AMT Remote Control and

●

●

●

●

●

●

Device Map (Open street, Google, Baidu)

●

●

●

Hardware Watchdog Monitoring

●

●

●

Hardware GPIO Control & Customized●●

Brightness & Backlight Control●

Hardware Sensor Monitoring

Hardware

BIOS Update

SupportAdvantech Industrial SQ Flash/RAM

Management
Intel IPMI Remote Control andManagement
●

●

●

●

●

●

●

●

●

●

●

●

◐

◐

●

●

●

●

●

●

●

●

●

●

●

Advantech

Remote Management & Monitoring
Advantech iBMC, Out-of-Band Remote
Management (Cross-network)
Advantech Industrial Display, On-Screen
Display (OSD) Management

Windows

USB Drive Block●

Keyboard Lock & Filter●

Touch Screen & Gesture Lock●

Windows Notification Block●UWF Protection●

10
Lockdown
Features

1.2 DeviceOn Server Versions
DeviceOn is based on a microservice design, each component is stateless and supports multiple
instances for scale up. This results in heavily simplified deployment to WISE-PaaS (Cloud Foundry),Azure PaaS, standalone virtual machines or Kubernetes. Both public cloud and private cloud (onpremise) deployments are supported. This chapter provides an introduction and provides a summaryof requirements for those scenarios. The container version of DeviceOn starts from version number
v-1.1.x (WISE-PaaS/Azure Kubernetes), while the standalone version starts from v-4.2.x. The
standalone version comprises of IoTHub, database (PostgreSQL and MongoDB), Dashboard (Grafana),
Webservices (Tomcat) and DeviceOn core applications.
Purchase Information & Product Page

13

1.2.1 Standalone, VM (Cloud)The standalone version provides all packages of the DeviceOn software in one installer package,
including RabbitMQ as a message broker, MongoDB, PostgreSQL as databases, Grafana forvisualization, Tomcat for web services, and a watchdog service that protects DeviceOn corecomponents from crashing or becoming unresponsive.
This section specifies the minimum hardware requirements for DeviceOn Cloud (Standalone) and theoperating systems on which DeviceOn is supported. In general, the better the hardware configurationof your computer, the better your experience with DeviceOn will be. To achieve a more satisfying
experience with DeviceOn, particularly in terms of the client software, it is highly recommended thatyour system be substantially better than the minimum requirements specified in the following
sections. This is particularly true if running server software locally on the same system as the client
software.
Attention to the following areas can make a significant improvement to your overall user experienceand enjoyment of the software:•

Memory - the more RAM your computer has, the better.

•

CPU speed - the faster, the better.

•

Hard Drive - the larger, the better.

General Operation Systems and Recommendations:✓ Windows Server 2008 R2 64-bit (KB2999226 Required)✓ Windows Server 2012 R2 Standard 64-bit (KB2919442, KB2919355, KB2999226 Required)✓ Windows Server 2012 R2 Datacenter 64-bit (KB2999226 Required)✓ Windows Server 2016/2019 64-bits
Reserve Port for DeviceOn Server Used
Name & Description

Inbound Port1

DeviceOn HTTP, HTTPs Web Services

80, 443 [Depends on Installation]2

DeviceOn Dashboard (Grafana)3000 [Depends on Installation]

3

Message Broker (RabbitMQ) MQTT, MQTTs

1883, 8883

4

Message Broker (RabbitMQ) AMQP, AMQPs

5671, 5672

5

Message Broker (RabbitMQ) Management Console

15672

6

Repeater for Remote Desktop

5501

7

Websockify for Remote Desktop

Purchase Information & Product Page

6083 ~ 6102 (v-4.3)
6083 ~ 6183 (v-4.2)
14

8

Database for MongoDB

27017

9

Database for PostgreSQL

5432

10

FTP Service

2121 [Depends on Installation](v-4.3)

Hardware Minimum Requirements:✓ Intel® Core™ i5 2.3 GHz CPU and at least 8GB of RAM✓ 25 GB root partition for the system✓ 100 GB data storage partition (for documents and indexing)
1.2.2 Azure PaaS, Kubernetes (Cloud)The Azure Kubernetes Service (AKS) makes it easy to deploy a managed Kubernetes cluster to Azure.
AKS reduces the complexity and operational overhead of managing Kubernetes by offloading muchof that responsibility to Azure. Azure handles critical tasks like health monitoring and maintenance forthose Kubernetes services.
Deploying DeviceOn on the Azure Kubernetes Service is easy and with just a few steps, containers or
nodes can be scaled up to manage thousands of devices. Moreover, DeviceOn can leverage the Azure
IoTHub and Cosmos DB for Azure native security and performance. Since the data is already stored on
the Azure cloud, it is much easier to leverage the Azure ecosystem – for example using the provided
data for Azure Machine Learning. DeviceOn can be deployed to Azure Kubernetes directly from the
WISE-PaaS/Marketplace.

1.2.3 Data Service Server for Private Cloud

For accelerated IoT application deployment, Advantech offers the Data Service Server EIS-S230 as a
Purchase Information & Product Page

15

stable and reliable all-in-one solution for your back-end data service or light private cloud. It is built
around an Intel Xeon or Core i7 CPU to offer best in class computing performance for data services.
Moreover, EIS-S230 comes preinstalled with Kubernetes to support micro-services, as well ascomplete back-end software components including RabbitMQ as IoT Hub, MongoDB and PostgreSQL
as database, Grafana for data visualization and Prometheus for back-end management. EIS-S230 also
provides a dynamic scale out function that allows extension of resources as necessary. It is a perfecttool to create IoT applications more easily and flexibly and to speed up time to market.

Features:⚫

Integrated solution (HW+SW bundle) for back-end data service and light private cloud⚫

Pre-configured system: Intel Xeon platform with 32GB RAM, 512GB mSATA SSD including
Ubuntu Linux OS⚫

Open and flexible infrastructure: Kubernetes support, multiple database options, on-demand
microservices⚫

Integrated IoT Software: Private Cloud Deployment, Platform Management, Application
Integration⚫

Integrated Applications: WISE-DeviceOn, Grafana, Prometheus, Kubeapps, Kubernetes
Dashboard⚫

Sustainable Management: Condition Monitor, Load Balance, Advanced Recovery

Purchase Information & Product Page

16

⚫

WISE-DeviceOn inside for feature-rich IoT Device Management

1.2.4 WISE-PaaS/EnSaaS (Cloud)The WISE-PaaS/EnSaaS version consists of three containers as listed below. In this scenario DeviceOn
requires 1408 MB of RAM at least.
Application Name

VersionMemory Used

PurposeWorker that processes device

deviceon-worker-1.1.x

v-1.1.x384MB

messages, status, notification,scheduling etc.
Provides the DeviceOn web

portal-deviceon-1.1.x

v-1.1.x

768MB

interface for remote control andmonitoring.
Worker that provisions devices

provisioning-worker-1.1.x

v-1.1.x

256MB

with configuration, software,
firmware etc.

1.3 DeviceOn Agent Version
Advantech provides a device client that is used to communicate and exchange information between
IoT (Internet of Things) devices and the DeviceOn cloud services, called WISE-Agent. WISE-Agent
provides a rich set of user-friendly features that are intelligent, standardized and scalable.
•

Standardization
The communication protocol between client and cloud is based on the industry standard MQTT
protocol. The IoT sensor data format is following the IPSO Alliance definition, implemented in

Purchase Information & Product Page

17

JSON.
•

Portability
The whole framework is written in C language and follows the ANSI C Standard. C compilers arewidely available for most platforms and allow easy porting to different architectures or operating
systems.

•

Scalability
The WISE-Agent has a modular design and provides a plugin concept that allows flexible additionof new data sources or extra functionality.

1.3.1 WISE-Agent Architecture

WISE-Agent includes two parts, one is the Core Framework and Plugins.
•Core Framework is the main library used to communicate with WISE-PaaS IoTHub or standard
MQTT broker and include below components
1. Platform Profiler: describes the target platform (e.g., OS version, SN, Device name, MAC
address)
2. Configuration: describes how to connect to MQTT broker (e.g., Credential URL, IoTKey,
TLS/SSL settings)
3. Core Manager: integrates and manages the resources and keeps them alive.
4. Core Command: responsible for handling commands that interact with internal components(e.g., rename, update, get capability, auto report start/stop)
5. Plugin SDK: A plugin framework that makes plugin implement more easily.
6. Keep Alive: A component to detect the connection between WISE-Agent and DeviceOn Server.
7. Data Synchronization: kernel plugin that caches and restores data to ensure zero downtime.
8. Rule Engine: kernel plugin that supports the threshold rule check and then sends event or
trigger actions
9. Plugin Loader: responsible for loading and managing plugins indicated in module_config.xml•

The plugins include IPC monitoring (Advantech Hardware, HDD/SSD, Networks, Process…etc.),
control function (Backup/Recovery, Protection, Remote Desktop, Terminal …), and sensor
protocol collection.
Agent Plugin

Description

SUSI Control

Monitoring and Control Advantech Hardware Platform

HDD Monitoring

Monitoring Hard Drives (HDD, SSD) Usage, Healthy and S.M.A.R.T
Information, especially for Advantech SQFlash.

Purchase Information & Product Page

18

Agent Plugin
Network
Monitoring
Process
Monitoring
Power
Management

Description
Monitoring Network Interface Usage, Throughput…

Monitoring System Process Status, CPU, Memory Usage.

Remote Control Power On, Off, Reboot, Sleep, Hibernate.

Backup/Recovery

Remote Backup/Recovery System via AcronisProtection

Remote System Protection via McAfee

Remote Desktop

Remote Desktop via VNC Viewer

Remote Terminal

Remote Terminal Command

RemoteScreenshot
OTA (Over-theAir)

Remote Screenshot on Current Screen

Remote Software, Firmware Update

System Program

Monitoring System Program Information

Embedded

Advanced Control (UWF, USB Lock, Keyboard Filter, … etc.) for

Control

Windows 10 Embedded, LTSC, LTSBHDD Prediction

Build-in Hard Drives (HDD, SSD) Failure Prediction Model

ModbusModbus Device Data Gathering

Service Plugin

Bridge Southbound Device Service

Local Provision

Similar to UPnP mechanism, provides device fast onboarding on local

Pluginnetwork.

1.3.2 WISE-Agent (Client)

WISE-Agent is support on different platforms running Windows 7 (or newer) or Ubuntu 16.04 x64 (ornewer). Please contact us for others architectures (e.g. RISC) or operating systems (e.g. Yocto based
Linux/Android).
Purchase Information & Product Page

19

General Operation Systems and Recommendations:✓ Windows 7 SP1/8/10 32-bit/64-bit✓ Ubuntu 16.04, 18.04, 20.04 x64✓ CentOS 7.6, 8.2 x64✓ Other Linux flavours (e.g. Yocto) on x86 or RISC (on a per project basis)✓ Android on RISC (on a per project basis)
Assigned Ports for Device Communication
Name & Description

Outbound Port1

MQTT, MQTTs Message Client

1883, 8883

2

Remote Desktop VNC Client

5501

Hardware Minimum Requirements:✓ Intel® Celeron™ 1.10 GHz CPU and at least 2GB of RAM✓ 500 MB root partition for the system✓ Advantech HW with respective SUSI driver 3.02/4.0 support is required for the HWM(Hardware Monitoring Management) feature to be available
1.4 Security

System security is about not only installing and onboarding devices and networks securely but also
managing their ongoing operations throughout their lifecycle and identifying and isolating any threats.
Industries everywhere are digitizing, which is creating a multitude of new security requirements for
the Internet of Things (IoT). End-to-end (E2E) security management will be essential to ensuring
security and privacy in the IoT, while simultaneously building strong identities and maintaining trust.
As the diversity of IoT services and the number of connected devices continue to increase, the threats
to IoT systems are changing and growing even faster.
A comprehensive model of IoT device security, as shown in below structure, the comprehensive IoT
module security in an IoT system has three main parts:
A.

Device Security
DeviceOn leverage McAfee Embedded Security software to prevents unauthorized changes
and will lock a system down to a known application is an industry, that’s an industrial firstsolution to secure embedded devices.
For disaster recovery, Acronis provides users a quick and easy-operated solution to protect
data and recover the entire system even when OS crash, effectively reduces down-time costand lowers the risk of data loss.

B.

Secure Transport

Purchase Information & Product Page

20

The server distributed SSL certificates to use SSL/TLS (v-1.3) as an encrypted and secure datatransmission channel, and device default enable MQTT-SSL for communication.
•

Topics Isolation & Unique Device IoT Key
Topics are specially handled in RabbitMQ. Topics are not public. Access control isolates anactivated device to publishing/subscribing only to that device ’ s topics even thoughmultiple devices will have subscriptions to identically named topics. A device is not allowed
to subscribe/publish to another device’s topics.
Second, in IoT applications, command topics are used to control a device remotely and toacknowledge successful command executions. Unlike telemetry, command topics are notread-only. Commands are a back and forth workflow that can occur between the cloud anddevices. Because commands are actionable messages, isolate the MQTT topic forcommand messages from telemetry topics.

•

Use x.509 Certificates to Authenticate Edge Device
DeviceOn supports x.509 certificate authentication for use with a secure TLS/SSL connection.
The x.509 edge device authentication allows device to authenticate to servers withcertificates rather than with a username and password.

•

Use TPM + x.509 Certificates to Provide Higher Security
The solution that we integrate on DeviceOn for Azure (Enterprise Edition), leverage Azure
IoT Edge and TPM 2.0 to offer secure authentication and private key protected.
TPM, also known as ISO/IEC 11889, is a standard for securely generating and storing
cryptographic keys. TPM also refers to a virtual or physical I/O device that interacts withmodules that implement the standard. A TPM device can exist as discrete hardware,
integrated hardware, a firmware-based module, or a software-based module.
C.

Secure Cloud Service
The cloud service components include Tomcat as a web server that provide an HTTPS
protocol and backend APIs services, each connection between backend and database adopt
SSL encryption, and enforce password policies, refer to Section 1.4.2 for details. Second, foradvanced attack, such as SQL injection, XXC, local and remote file vulnerabilities, theNginx+Naxsi to achieve Web Application firewall (WAF) protection.
All DeviceOn services pass through famous vulnerability tools (refer to Section 1.4.3) toensure security for your it IoT solutions, and the binary uses ProGuard code obfuscation
protection.
The APIs authentication not only uses JWT (JSON Web Tokens) to hide/encrypt sensitive

Purchase Information & Product Page

21

data, but, integrate LDAP & Azure AD Domain Service for secure.

1.4.1 Role-Based Access Control (RBAC)

DeviceOn supports three different user roles - “Root” (perpetual version only), “System Admin” and“Device Admin”. There is only one single “Root” account per system, which has the highest permission
level and can create “System Admin” or “Device Admin” accounts. The intermediate user level“System Admin” can be used to create “Device Admin” accounts. “Device Admin” accounts have thelowest permission level. Please refer to Section 7.1 for details on access permission levels.
1.4.2 SSL Encryption⚫

HTTPS on DeviceOn Web Server

The principal motivations for HTTPS are authentication of the accessed website, protection of
the privacy and integrity of the exchanged data while in transit. It protects against man-in-themiddle attacks. The bidirectional encryption of communications between a client and server
protects against eavesdropping and tampering of the communication.
⚫

SSL Connection on Database (PostgreSQL, MongoDB)

PostgreSQL and MongoDB have native support for using SSL connections to encrypt client/server
communications for increased security.
Purchase Information & Product Page

22⚫

Create Security Credentials on Database

Databases are by default protected by secure credentials and require explicit authentication forconnections. This avoids accidentally deploying platforms with unprotected access.
⚫

Device Connectivity via MQTT SSL/TLS 1.3

RabbitMQ supports multiple protocols including MQTT, which the most popular IoT (Internet ofThings) protocol. By default, SSL is used to encrypt all MQTT traffic for device connectivity.
⚫

Enforce Password Policies

While DeviceOn allows you to set some of your own passwords, please make sure those meetthe minimum complexity requirements established by your specific organization.
1.4.3 Vulnerability Scanning Tools

The DeviceOn server pass through below famous vulnerability tools to ensure security for your AIoT
solutions. Furthermore, all the testing including anti-malware (Trend Micro and Kaspersky)⚫

Web Application Assessment Report (Micro Focus)

WebInspect is an automated dynamic testing tool that mimics real-world hacking techniques andattacks and provides comprehensive dynamic analysis of complex web applications and services.
⚫

OpenVAS (Open Vulnerability Assessment System)

OpenVAS is a full-featured vulnerability scanner. Its capabilities include unauthenticated testing,authenticated testing, various high level and low-level Internet and industrial protocols,
performance tuning for large-scale scans and a powerful internal programming language toimplement any type of vulnerability test.
The scanner is accompanied by a vulnerability tests feed with a long history and daily updates.
This Greenbone Community Feed includes more than 50,000 vulnerability tests.
⚫

NessusNessus is the de-facto industry standard vulnerability assessment solution for security
practitioners. The latest intelligence, rapid updates, an easy-to-use interface.

⚫

✓

Covers an industry-leading 47,000+ vulnerabilities✓

Unlimited scans at no extra cost✓Compliant with PCI, HIPPA, GLBA, CIS, NIST, and more

OWASP ZAPThe OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and isactively maintained by hundreds of international volunteers*. It can help you automatically findPurchase Information & Product Page

23

security vulnerabilities in your web applications while you are developing and testing yourapplications. It’s also a great tool for experienced pen testers to use for manual security testing.
⚫

Skipfish

Skipfish is an active web application security reconnaissance tool. It prepares an interactive
sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The
resulting map is then annotated with the output from a number of active (but hopefully nondisruptive) security checks. The final report generated by the tool is meant to serve as afoundation for professional web application security assessments.
Key features:✓High speed: pure C code, highly optimized HTTP handling, minimal CPU footprint – easily
achieving 2000 requests per second with responsive targets.

✓

Ease of use: heuristics to support a variety of quirky web frameworks and mixed-technology
sites, with automatic learning capabilities, on-the-fly wordlist creation, and form autocompletion.

✓

Cutting-edge security logic: high quality, low false positive, differential security checks,
capable of spotting a range of subtle flaws, including blind injection vectors.

⚫

Nikto

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against
web servers for multiple items, including over 6700 potentially dangerous files/programs, checks
for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It
also checks for server configuration items such as the presence of multiple index files, HTTP
server options, and will attempt to identify installed web servers and software. Scan items andplugins are frequently updated and can be automatically updated.
⚫

W3af

w3af is a Web Application Attack and Audit Framework. The project’s goal is to create aframework to help you secure your web applications by finding and exploiting all web application
vulnerabilities.
⚫

Arachni

Arachni is a fully featured web security scanning tool, it is based on ruby framework. It is an open
source, modular and high-performance tool. It comes with both command line interface as wellas web based gui interface, it is highly versatile tool for security scanning purpose. It supports
almost all of the popular web application such as HTML5, Java Script and AJAX etc, additionally
it is enables with multi user-multi platform collaboration. It allows you to generate reports indesired format (.txt, XML, HTML).
Purchase Information & Product Page24

1.4.4 Third-Party Vulnerability Fixed and Updates•

OpenJRE (v-1.8.0_292-1)
CVE-2021-2161, CVE-2021-2163•

Tomcat (v-9.0.50)
CVE-2021-33037, CVE-2021-30640, CVE-2021-30639, CVE-2020-9484, CVE-2021-25329, CVE2021-25122•

RabbitMQ (v-3.8.19), Erlang 24
CVE-2021-32719, CVE-2021-32718, CVE-2021-22116, CVE-2021-22117•

PostgreSQL (v-10.17)
CVE-2021-32027, CVE-2021-32028, CVE-2021-32029•

MongoDB (v-4.2.15)•

Grafana (v-7.3.10)
CVE-2021-28146, CVE-2021-28147, CVE-2021-28148

1.4.5 Scanned Report

Purchase Information & Product Page25

2. Getting Started
2.1 DeviceOn Cloud Installation
2.1.1 Setup Standalone Version (On-premise)
Step 1: Install the DeviceOn package on your system
Purchase Information & Product Page

26

Copy the installation file (DeviceOn_Server_Setup_4.5.x.exe) to your target system and run it asadministrator.

Click “Next” to start the installation process.

Select “I Accept the terms in the License Agreement” and click “Next”

Purchase Information & Product Page

27

Select the “Installation Folder” for DeviceOn Server and click “Next”

Enter “Public IP” or “Domain Name” for this physical/virtual machine and click “Next”. This
information is required for “Edge Device” connectivity, please make sure your device is reachable
under this IP or Domain Name.

Purchase Information & Product Page

28

Note: You can start a Windows command prompt and type “ipconfig” to retrieve your IP address(es)on this physical/virtual machine.

You will need to configure the HTTP port number that is used for web browser-based access theDeviceOn management portal. The default port is 8080, but you can select any other port as long as
it does not conflict with any other application or service. Click “Next”.

Purchase Information & Product Page

29

Configure the password of the relational database (PostgreSQL) that DeviceOn uses to manage
account, device, permission, and relation data. The default account name is “postgres” and thepassword should follow below guideline.
Strong Password Rules:
Minimum eight characters, at least one number, one lowercase letter, one uppercase letter, and one
special character (Blank character, Backslash(\), Double quotes(") are prohibited)

Configure the password of the NoSQL database (MongoDB) that stores device sensor data. The default
account and database is “wisepaas/WISE-PaaS”. This password should also follow strong password
rules as outlined above.
Purchase Information & Product Page

30

Select the database installation path and cache size of MongoDB and click “Next”. A larger cache size
will result in better performance. For more information on this parameter, please referend to theofficial documentation.

In order to avoid the hard disk space being used up by device data, the MongoDB provide a cappedmechanism, that similar to circular buffers: once a collection fills its allocated space, it makes roomfor new documents by overwriting the oldest documents in the collection. Please note, thecharacteristic of capped cannot be disable, if you enable the collection at first.

Purchase Information & Product Page

31

Configure the password and suffix domain of the root account (dummy name “root@”) and click“Next”. This root account has the highest permission level and is used to log in to the DeviceOn web
service and create other user accounts.

Set up the HTTP service port for Grafana dashboard. The default account and password isadmin/admin. You will be able to modify this at the first login.

Purchase Information & Product Page

32

Set up the FTP service port for OTA default storage, the default port is 2121, but you can select anyother port as long as it does not conflict with any other application or service. Click “Next”.

Click “Install” to begin the installation.

Purchase Information & Product Page

33

Click “Finish” to exit the program.

Step 2: Launch DeviceOn Web Service Shortcut on Desktop

Two shortcuts will be generated on the desktop - one is for the DeviceOn web portal and the otherone is for the Grafana dashboard.

Click the “DeviceOn Server” shortcut in order to launch a browser and to start device operation andmanagement. It is recommended to use Chrome for the best user experience.
Purchase Information & Product Page34

2.1.2 Setup Standalone Version for Ubuntu Linux (On-premise)

If you are interested in DeviceOn and used to Linux platform, On-Premise, we also provide an installer
for Ubuntu Linux (one of the most popular Linux distribution). This section will guide you how to install
DeviceOn on Ubuntu Linux.
Note here that:⚫

The DeviceOn Ubuntu Linux installer is named something like "DeviceOn_Server_Ubuntu
18.04_x64_4.5.x.run". To acquire the installer and ensure having the latest version, pleasecontact us.

⚫

If you are running the installer with an account other than "root", you should use "sudo"command to obtain higher privileges, or the installation may fail at any step.

Step 1: Open a terminal
The installer runs in CLI (Command Line Interface) mode. As such, open a terminal preferable for you.
Step 2: Copy the installer to target hostUse the way you like to copy the installer to the target host.

Purchase Information & Product Page

35

Step 3: Set the installer as executable
In the terminal, run "chmod 0755 DeviceOn_Server_Ubuntu 18.04_x64_4.5.x.run" so that the
installer as an executable file under Ubuntu Linux.
Step 4: Running the installer
Change your working directory to where the installer is and run "./ DeviceOn_Server_Ubuntu
18.04_x64_4.5.x.run ". You may need to run "sudo ./ DeviceOn_Server_Ubuntu 18.04_x64_4.5.x.run" to acquire higher privileges if you were logged in as a normal user.
Step 5: Answering some questions
Throughout installation process, it's necessary to answer some questions to complete the installation:A.

The password of user “postgres” to login PostgreSQL database.

When you run into this step the question shows like above. Just input the password you would like to
use to login PostgreSQL database for “postgres” account.
B.

The password of user “wisepaas” to login MongoDB database.

When you run into this step the question shows like above. Just input the password you would like to
use to login MongoDB database for “wisepaas” account.
C.

The valid IP or host name of the target host.

When you run into this step the question shows like above. Just input the IP address of the target host.
A hostname (even a FQDN) is also acceptable if you are sure that agents can connect to via the nameyou provide.
D.

If turn MongoDB capped functionality on or not.

Purchase Information & Product Page

36

When you run into this step the question shows like above. Just input “yes” or “no” to enable ordisable “capped” functionality. If you answer “yes”, a subsequent question followed to ask you “howmuch capped size, in MB, to be used? “. Just input the size, in MB, you want to use in “capped”
functionality in MongoDB database.
Capped collections are fixed-size collections that support high-throughput operations that insert andretrieve documents based on insertion order. Capped collections work in a way similar to circularbuffers: once a collection fills its allocated space, it makes room for new documents by overwriting
the oldest documents in the collection.
E.

The password of user “root@advantech.com.tw” to login DeviceOn portal, and the rule should
follow below guideline.

Strong Password Rules:
Minimum eight characters, at least one number, one lowercase letter, one uppercase letter, and one
special character (Blank character, Backslash(\), Double quotes(") are prohibited)

When you run into this step the question shows like above. Just input the password you would like to
use to login DeviceOn portal for “root@advantech.com.tw” account.
Finally, a workable DeviceOn server should be there the target host. Open a browser and input
http://{IP-USED-IN-QUESTION-C}, you should see the DeviceOn login page.

2.1.3 Deploy DeviceOn for Azure (Enterprise Edition)

Prerequisites
To achieve the goal to deploy WISE-DeviceOn, some resources must be acquired and preconditions
must be met as well.
•An active Azure subscription.

•

An Azure CLI installed on your laptop, please refer to Azure documentation to download andPurchase Information & Product Page37

setup. The Azure CLI is available to install in Windows, macOS and Linux environments. It canalso be run in a Docker container and Azure Cloud Shell.
Second option, if you don’t want to install Azure CLI, you can also adopt Azure Cloud Shell, pleaserefer to Microsoft documentation.
Step 1: Obtain the following three parameters for deployment•

Application ID•

Password (Client Secrets)•

Tenant ID

A. Sign into your Azure account through Azure CLI
Use any way you prefer to open a Command Prompt and enteraz login

Note: If the CLI can open your default browser, it will do so and load a sign-in page. Otherwise,
you need to open a browser page and follow the instructions on the command line to enter anauthorization code after navigating to https://aka.ms/devicelogin in your browser. Sign in withyour account credentials in the browser.
B. Select your Subscription
After you login, the terminal console will list all subscriptions, please select thesubscription that you would like to deploy.
az account set --subscription <SUBSCRIPTION_NAME>
If you don’t know which subscriptions you have, you can use below command to list all
the subscriptions and determine whether the subscription has been selected according
to isDefault.
az account list --output table

Purchase Information & Product Page

38

C. Select your Subscription
The last step to create a service principal and generate these parameters. (1. Application
ID, 2. Password and 3. Tenant ID)
az ad sp create-for-rbac --name <SERVICE_PRINCIPAL_NAME> --role "owner"

If you want to further limit the scope of service principle to resource group, please try to create
the resource group, and then use the following command to limit.
az ad sp create-for-rbac --name <SERVICE_PRINCIPAL_NAME> --role "owner" --scopes/subscriptions/{SubID}/resourceGroups/{ResourceGroup1}

Step 2: Deploy WISE-DeviceOn via Custom Template

A. This will open the Azure Portal (portal.azure.com) in your subscription and create therequired resources.

Purchase Information & Product Page

39

B. Enter the following values:
Name
Resource
Group
RegionApplication Id

Value
Select the resource group name you created in the last section.
Select a location for the resource group. For example, Southeast
Asia.
The application Id is obtained from Step 1.

Purchase Information & Product Page

40

Name

Value

Password

The password is obtained from Step 1.

Tenant Id

The tenant Id is obtained from Step 1.

Email

After deployment, the result/progress will be sent to this email
Enter the location name according to the data center. for examle,

Location

Asia East(eastasia), Asia Southeast(southeastasia), Japan
East(japaneast), US East(eastus), Europe North(northeurope)

IoTHub Sku
IoTHub Unit

S1/S2/S3, the default is S1, you could adjust the tier from Azure
Portal, if need.
default is 1
Advantech hardware connection, enter N/A (free support for 1000

Activate Key

Advantech devices), or please contact us to purchase license key for
Non-Advantech devices.

AKS Max
Node CountUTC Value

Maximum number of Kubernetes nodes to auto-scaling
Fix value for generating unique string

C. Select Review + create
D. Validation and start to create.

Purchase Information & Product Page

41

E. The entire deployment process takes about 30 minutes. After completion, you will
receive a mail notification. The content of the mail includes the DeviceOn web Service
IP and login Account password.

Purchase Information & Product Page

42

Assuming that your mail is intercepted/block or not received due to mail server filters,
we will synchronously write this information to the Azure Blob Log container. Go toyour resource group (you entered at the stage of deployment) storage account ->container -> Log -> ServerInformation.log. If the container has not been created, pleasewait a few minutes for initialization.

Purchase Information & Product Page

43

F. There are two resource group generated on your subscription, one is you entered at thestage of deployment, which include the services such as: AKS, IoT Hub, EventHub, Stream
Analytics, Cosmos DB, PostgreSQL…etc. Another resource group name prefix name starts
with MC_, that contains AKS VM node.
Purchase Information & Product Page44

2.2 DeviceOn Client Installation
2.2.1 Setup Device Onboarding (Windows)

Step 1: Log in to the DeviceOn Cloud Service with Your Account and Password

Step 2: Download WISE-Agent and Connection Configuration (Agent.config)

At the first login, the “Device Onboarding” dialog will pop up automatically. Please click “Download”
to get the latest version of WISE-AgentSetup.exe and the respective connection configuration.
(Agent.config)

Purchase Information & Product Page

45

Click “Next” to wait for connecting devices.

Step 3: Set up Your Local Device

Copy those two files (WISE-AgentSetup_1.x.x.exe and Agent.config) to the target device and launch“WISE-AgentSetup_1.x.x.exe” as administrator.
Purchase Information & Product Page

46

Click “Next” to set up the WISE-Agent program.

Select “I Accept the terms in the License Agreement” and click “Next”

Purchase Information & Product Page

47

When the “WISE-AgentSetup_1.x.x.exe” program detects a cloud connection configuration file
(Agent.config) in the same folder, “Quick Mode” as shown in this dialog will be available. For “Quick
Mode”, the installation path is fixed to “C:\Program Files (x86)\Advantech\WISE-Agent”. If you would
like to adjust the installation location, please select “Advanced Mode”.
Quick Mode:

Advanced Mode:
Select the Installation folder for WISE-Agent

Set up the cloud connection configuration (Credential URL & IoTKey). This information can be
retrieved from the DeviceOn web portal as shown in Step2, and click “Next”.

Purchase Information & Product Page

48

⚫

“Zero-touch onboarding”: Only supported on Advantech platforms with SUSI Driver and preconfiguration on the provisioning server⚫

“Assign to User Account”: Each account has its own connection IoTKey. If checked, the device
will be assigned to this account automatically.

⚫

“Enable SSL”: The communication between WISE-Agent and DeviceOn Cloud is MQTT. Ifchecked (default setting), all the messages and content are SSL encrypted (MQTT SSL port:
8883). Otherwise, port 1883 is used for MQTT without SSL.

WISE-Agent supports remote desktop through built-in UltraVNC. You can manually specific thelocation of your own UltraVNC installation if preferred. If you do not want the remote desktop
feature to be available, please select “Disable KVM Connection”.

Purchase Information & Product Page

49

WISE-Agent integrates Intel AMT (Intel Active Management Technology) for remote power
management (Power Up, Down, Cycle and Reset) as well as remote desktop access, even in casethe operating system has crashed. However, this feature requires hardware support (Intel Corei5, i7) and the target device needs to be on the same local network as the DeviceOn server. Pleasepre-configure iAMT, enable it in the device’s BIOS and provide the account and password
information in this dialog if you would like to enable iAMT based remote control features.

Click “Install” to begin the installation.

WISE-Agent requires the Microsoft Visual C++ Redistributable 2008, 2013, 2015 x86 packages,
which will be downloaded from the Internet and set up during the installation process. If you are
in an environment with limited or no Internet access, please download the “Agent Dependency
Package” through an Internet connected device and install this package first.
Purchase Information & Product Page

50

Click “Finish” to exit the program.

Step 4: Launch the WISE-Agent

Click on the “WISE-Agent” icon on the Windows Desktop to open the WISE-Agent user interface.

If the status shows “Disconnected”, please make sure your network settings are configured correctly
and that you have access to the DeviceOn server-side application, either located in a public cloud(WISE-PaaS, Microsoft Azure) or on premise (standalone server version) depending on deployment
scenario. Then, please click the “Connect” button to try to reconnect.
Purchase Information & Product Page

51

Step 5: Grouping Your Devices

Once the device connects, to device grouping page, where the device group for these devices can beselected.

There is a “Default” group that can be used, or other groups for this device can be created after
checking “Advanced options”. Click “Confirm” to start device management.

Purchase Information & Product Page

52

Step 6: Start Device Management

By default, two “Real-time Actions” are created for a group, one is “Screenshot” and the other one is“Reboot”. The overview page further shows the online status of registered.

Purchase Information & Product Page53

2.2.2 Setup Device Onboarding (Linux)

We also provide an installer for Ubuntu Linux (one of the most popular Linux distribution). This section
will guide you how to install WISE-Agent on Ubuntu Linux. Note here that:
The WISE-Agent Ubuntu Linux installer is named something like “wise-agent-Ubuntu 18.04 x86_641.x.x.0.run”. To acquire the installer and ensure having the latest version, please contact us. If you arerunning the installer with an account other than “root”, you should use “sudo” command to obtainhigher privileges, or the installation may fail at any step.
Step 1: Open a terminal
The installer runs in CLI (Command Line Interface) mode. As such, open a terminal preferable for you.
Step 2: Copy the installer to target hostUse the way you like to copy the installer to the target host.
Step 3: Set the installer as executable
In the terminal, run ”chmod 0755 wise-agent-Ubuntu 18.04 x86_64-1.x.x.0.run” so that the installer
as an executable file under Ubuntu Linux.

Step 4: Running the installer
Change your working directory to where the installer is and run "./wise-agent-Ubuntu 18.04 x86_641.x.x.0.run ". You may need to run "sudo ./wise-agent-Ubuntu 18.04 x86_64-1.x.x.0.run" to acquire
higher privileges if you were logged in as a normal user.

Step 5: Start WISE-Agent and Connect to DeviceOn
Change your directory to /usr/local/AgentService and run sudo ./setup.sh to answer connection
information, such as credential URL, IoTKey, Device Name and etc.

Purchase Information & Product Page

54

1. Zero-touch onboard is a zero-configuration and quick connection mode for a special purpose.
The default is disabled (n).
2. Enter Credential URL and IoT Key that information could retrieve from the DeviceOn portal.

Purchase Information & Product Page

55

3. Assign device to User Account: You can bind the target device into a “Default” group in
your account on the portal automatically
4. Enable TLS: Turn ON/OFF the TLS/SSL mode.
5. Input Device Name: Give your device name and show it on the portal.
6. Input AMT ID and password: If your device support Intel AMT, please enter AMT ID and
Password to enable these functions.
7. Select KVM Mode [0:default, 1:Custom VNC, 2:disable]: User can use our default VNC tosupport the Remote Desktop function by entering 0 and give a listen port if you don’t want to
use the default port. Second, select Custom Mode, if they already have a VNC server byentering 1 and provide the listen port and password. To disable the KVM function by entering
2.
When you run into this step the question shows like above, device is connected and under youraccount.

3. DeviceOn User Interface & Functions
3.1 DeviceOn Server (Standalone)
The standalone version provides all packages of the DeviceOn software in one installer package,
including RabbitMQ as a message broker, MongoDB, PostgreSQL as databases, Grafana forvisualization, Tomcat for web services, and a watchdog service that protects DeviceOn corecomponents from crashing or becoming unresponsive.
The following section (3.1.1) introduces the “Standalone Server Control” tool that allows to monitor
and enable/disable DeviceOn core components. The watchdog service is explained in section 3.1.2.
3.1.1 Standalone Server Control

After the DeviceOn standalone version has been installed, a “Server Control” icon should show up in
the system tray.

If it does not show up for some reason, please go to installation path and launch the program(ServerControl.exe) manually as shown here:

Purchase Information & Product Page

56

Right click on the tray icon to bring up an overview of each core component status. The green lightindicates normal status, and a red light means the respective service is stopped.

⚫

Management Service

The “Management” service includes the DeviceOn backend core function and consists of two Java
processes (DeviceOn and Provisioning Worker) that handle messages and process OTA traffic between
the client and server. Click “Stop” to stop the management service.

⚫

Tomcat Service

The DeviceOn web service uses Apache Tomcat to provide the user interface, APIs and WebSockets.
Click “Stop” to stop the Apache Tomcat service.

Purchase Information & Product Page

57

For advanced configuration (SSL, connection pool, etc.), you may modify “server.xml” located in the
installation folder.

⚫

PostgreSQL Service

The relational database (PostgreSQL) is used to store account, device, map, permission data etc. Click“Stop” to stop the PostgreSQL service.

A GUI tool called “pgAdmin3.exe” providing access to the PostgreSQL database comes with the
PostgreSQL installation and is located in the installation folder as shown below. The default accountis “postgres” and the password is the one you defined during the installation. We recommend you do
not delete/edit any schema, table or data, since DeviceOn might stop to work if data is corrupt or
missing.

Purchase Information & Product Page

58

⚫

MongoDB Service

To process sensor data from client devices, DeviceOn leverages MongoDB to provide better
performance and compression rates than relational databases. Click “Stop” to stop the MongoDB
service.

⚫

RabbitMQ Service

RabbitMQ is one of the most popular open-source message brokers, and is used as “IoT Hub” toexchange messages between the server and client devices. Click “Stop” to stop the RabbitMQ service.

⚫

Grafana Service

Grafana is a popular framework that allows you to query, visualize and alert on data from various data
sources. DeviceOn supports a simple JSON API that as can be used as data source in Grafana,
effectively making all DeviceOn data available to Grafana. Click “Stop” to stop the Grafana service.

Purchase Information & Product Page

59

⚫

FTP Service

To remote deploy the application to edge device via OTA, DeviceOn build-in a FTP service (Apache FTP)
as a default storage. The Apache FtpServer is a 100% pure Java FTP server. It’s designed to be acomplete and portable FTP server engine solution based on currently available open protocols.
FtpServer can be run standalone as a Windows service or Unix/Linux daemon or embedded into a
Java application.

3.1.2 Background Watchdog Service⚫

Watchdog Service

There is a Watchdog service (WP) that monitors the management service (DeviceOn and Provisioning
Worker) and ensures all the functions work as expected.

3.2 DeviceOn WISE-Agent
WISE-Agent runs as Windows service, so even without any user logged in, WISE-Agent will establish aconnection to the DeviceOn server and most of the features are supported. Section 3.2.1 explains
how to use the WISE-Agent user interface to verify the current connection status and retrieve basic
information of the client device. There is another Watchdog service monitoring the WISE-Agent client
Purchase Information & Product Page60

in order to avoid impact due to crashed or hanging processes.
3.2.1 WISE-Agent Connection

If you followed the instructions to set up WISE-Agent and connect to the DeviceOn server/cloud, there
should be a WISE-Agent shortcut on your desktop. If not, please refer to Section 2.2.1 to install WISEAgent. After launching the WISE-Agent user interface, it will provide an overview of the connection
status, device information (Agent ID, Device Name) as well as connection credentials (Credential URL,
IoTKey).

⚫

Agent ID: Device unique ID - the default is 32 characters, prefix (20 characters) and MAC
address (12 Characters)⚫

Device Name: Device name as shown on the DeviceOn server⚫

Credential URL: Connection URL, used to authenticate to DeviceOn Server⚫

IoTKey: Connection Key - each DeviceOn client has a unique key that will be used toestablish the MQTT session⚫

Disconnect: To stop the device connection and data transmission, you can click “Disconnect”
to stop the WISE-Agent service

If you would like to adjust the device name or connection parameters, please click the “Settings” iconon the top right and select “Options”.

Purchase Information & Product Page

61

⚫

Option -> General

This overview page provides information about “Device Name”, “Operating System” (Windows 7, 8,10), “MAC Address” of the client, “Memory Capacity” and version of the Advantech SUSI Driver (ifapplicable). The version of the “Operating System” represents the Windows kernel version. If theclient device is an Advantech platform that is supported by SUSI, we recommend to download thelatest SUSI driver from the Advantech Support site first. Please click here to obtain the latest driver
version.

Purchase Information & Product Page

62

⚫

Option -> Security

The communication protocol used for message exchange between the server and client is MQTT, an
industry standard lightweight messaging protocol for small sensors and mobile devices. WISE-Agent
provides the option to use MQTT with SSL encryption on port 8883, or MQTT without SSL on port
1883.

⚫

Option -> Account

You can register on the DeviceOn trial site (https://deviceonapp.wise-paas.com) for a six-month trial
account and use it with your device. Before you can create a trial account or enter trial accountinformation, please got to the “Advanced” tab and select “Trial Account”.

Purchase Information & Product Page

63

⚫

Option -> Advanced

Under the “Advanced” tab, you can select whether to connect to a DeviceOn server/cloud service, orwhether to connect to the DeviceOn trial site (https://deviceonapp.wise-paas.com/). In case of trial
site, you need to enter account information under the “Account” tab (see previous step) while for aregular DeviceOn server or cloud service, you need to enter the “Credential URL” and “IoT Key” here.
Refer to “Step 2” in Section 2.2.1 on information how to obtain those.

⚫

Option -> Intel AMT

Purchase Information & Product Page

64

WISE-Agent integrates Intel AMT (Intel Active Management Technology) for remote power
management (Power Up, Down, Cycle and Reset) as well as remote desktop access, even in case theoperating system has crashed. However, this feature requires hardware support (Intel Core i5, i7) andthe target device needs to be on the same local network as the DeviceOn server. Please pre-configure
iAMT, enable it in the device’s BIOS and provide the account and password information in this dialog
if you would like to enable iAMT based remote control features.

⚫

Option -> VNC

WISE-Agent supports remote desktop through built-in UltraVNC. You can manually specific thelocation of your own UltraVNC installation if preferred (Custom installed VNC server). If you do notwant the remote desktop feature to be available, please select “Disable KVM Connection”.

Purchase Information & Product Page65

3.2.2 WISE-Agent Services⚫

Main Service“WISEAgentService” is the main services that connects to the DeviceOn server/cloud service. The
service is set to start automatically by default.

⚫

Watchdog Service

The “SAWatchdog” service is a basic watchdog governing “WISEAgentService” in order to ensureservice quality.

Purchase Information & Product Page66

3.3 DeviceOn User Interface
The DeviceOn web interface is based on the VUE framework and leverages the Vuestic Admin
template. The user interface is divided into three main parts - the navigation bar at the top, the menu
bar at the left and the main content in the center with.

Purchase Information & Product Page

67

Navigation Bar:⚫

Account Information

Click the account icon to show the currently logged in account and respective role. For more
information, click “My Profile” to open the account page. (Menu Bar -> Account). Click “Logout” tolog out from DeviceOn and remove personal information like cookies or tokens.

⚫

Languages

DeviceOn supports multiple languages that can be changed by clicking the globe icon in the navigation
bar. Currently there are three languages to choose from: English, Traditional Chinese and Simplified
Chinese.

⚫

Document (FAQ & API Reference)

There are two documents on DeviceOn user interface, one is Restful APIs, and another is FAQ that
including technical and general questions.

Purchase Information & Product Page

68

DeviceOn provide hundreds of API for App engineer to build up their AIoT solution, through the APIs
to get account, map, device data, and remote diagnostic on devices. The API document is generated
by APIDoc, includes API method, request, response, header and testing.

The developer could design a plugin on WISE-Agent to aggregate edge data (Reference Section 5.1),
and get these data via Restful APIs, visualize on Grafana Dashboard (Reference Section 4.4) or develop
a UI plugin to customize. (Reference 5.2)⚫

Notification

If there are any active notifications, the number of event log messages is shown on the notification
icon. Click the notification icon to see the event message summary. Three levels of events aresupported: “Information”, “Warning” and “Error”, and the user can select which type of events should
be shown on the user interface. For example, clicking the “Unsubscribe Notification” would disable
Purchase Information & Product Page

69

any events in the screenshot shown below. Please note that after disabling events, the UI will notrefresh automatically but needs to be refreshed manually. Click “More” to open the event log page
(Menu Bar -> Event Log)⚫

Device Onboarding

To onboard devices, click the onboarding icon in order to download the WISE-Agent installer and inorder to look up the required connection credentials. For more details on onboarding, please refer to
Section 2.2.

3.3.1 Device Management

After your device onboarding, you could view, edit device basic information, remote control, andretrieve sensor data on your devices. Eight sub items under Device, Device List contain device name,upgrade status, power management and etc. Device Monitoring to give device loading at present. To
remote diagnostic and debug through Remote Control. Next, all of plugin sensor data from Device
Data. To grouping your device through the Device Group. Rule Engine to set a threshold rule for yourdevices data in real-time. For advanced configuration, such as WoL, System Backup/Recovery andProtection via Device Provisioning. The last, one of AI solution to detect device screen status on
Anomaly Detection.

Purchase Information & Product Page70⚫

Device List

The device could be assigned to multiple accounts and device groups; therefore, you could leveragefilter to find your device through Account, Device Group, Status or Keyword.

Here is action bar for add, remove, export and search for below table devices.
Purchase Information & Product Page

71

Click the icon to add devices, that’s similar to device onboarding, download WISE-Agent, setup to yourlocal device and grouping.

Click the more icon to display “Edit” options on each device list.

You could edit device name, assign to different accounts, device groups in “Edit Device”

Purchase Information & Product Page

72

Click the delete icon to display “Delete” options on each device list, pick up the checkbox and confirm
to delete these devices.

Click on export icon to export devices that in the table as CSV file.

Purchase Information & Product Page73

If you would like to know a device be assigned to which account and device group, click search icon
to enter Agent ID (from your WISE-Agent UI) to understand.

You cloud do lots of remote action on the device.

Status: Green light represent device connected, gray for disconnected and orange fordevice abnormal, due to device over threshold.



Device Name: Device name, click More to get more deice information, such as
platform, operation system, MAC, memory, etc.

Purchase Information & Product Page

74

Group: Number of groups for the devices, for example, the device could belong tomultiple groups.



Quick Functions: Including Power Management, System Protection, Upgrade WISEAgent and System Backup/Recovery.
The power management supports On/Off, Restart, Sleep and hibernate, the actions
depend on your device supported. These functions adopt software mechanism, andmost of the industrial PC, personal laptop supported.
Moreover, DeviceOn integrate Intel AMT (Intel Active Management Technology) for
power device up, reboot and hardware reset. Please make sure you enable the AMT
function and configured on your WISE-Agent with AMT credential.

Next advanced power option is Advantech developed a mini-Baseboard Management
Purchase Information & Product Page

75

Controller named iBMC to provide out of band management. When the main system
is abnormal or powered down, it can be powered on remotely and executed acrossnetworks, whether in public cloud or private.

Second, protection is power-by McAfee white-list protection mechanism to solidify
device system. After enable, 3rd execution file, bat, DLL cannot be launch. Please go to
Setting -> Provision-> Protection to install first. Next, for the WISE-Agent upgrade, if
there is new version released by Advantech, it will check and show the icon
automatically.

Fourth, System Backup/Recovery is power-by Acronis to backup/recovery device
runtime system partition. Please go to Setting -> Provision-> Backup/Recovery to
install first.


Wake-On-LAN: Wake-On-LAN mode for device, three modes to power your device up,“Direct Mode”, “Agent Mode” and “Repeater Mode”. The magic package sent by
DeviceOn Server call “Direct Mode” but cannot through different network. Therefore,

Purchase Information & Product Page76

to overcome this limitation, through another Agent or Router to send, forward magic
packet. Please go to Setting -> Provision-> Power On to configure.
⚫

Message: Device current status

Device Monitoring

On this page, you could get real-time information about the device that you selected. The information
includes general PC status, such as network speed, software process, disk healthy, CPU and memory
usage. If the device is Advantech industrial PC and SUSI driver supported, the RPM (Revolution(s) Per
Minute) of CPU FAN, system, board level voltage, temperature is displayed on the page.

Some of devices support multiple network cards, especial industrial PC. Click on the network button
to retrieve others.

Purchase Information & Product Page77

Name: Name of network cardDescription: network descriptionState: Network connected or disconnected, for example, ethernet cable plugin or not.

Link Speed (MBPS): Network maximum link speed

Purchase Information & Product Page

78



Usage: Network current usage, Speed/Link Speed.

Speed (MBPS): Send plus receive data rate.

Click on Software Process to show current user process list, if your device system not login, the result
might be zero. Also, click on “Installed Programs” to check the programs on the device.

Purchase Information & Product Page

79

Click on the more option to restart or terminal your specific process.

For hard drive status, not only include current Used Storage, but Healthy and Power on Time. The
healthy is based on Acronis healthy model, that calculate on edge side, if you are interested, refer tothe official page.

Purchase Information & Product Page

80

For Advantech industrial SQ Flash, we provide advanced information, such as SSD performance, per
day host & NAND Data Volume, Estimate life End, self-check and so on.

Purchase Information & Product Page

81⚫

Remote Control

If you need to debug, diagnostic to your devices, actually, do not need go to field side. ThroughDeviceOn remote control to manage to reduce your operation effort. Basically, there are threefunctions (Screenshot, Terminal and Remote Desktop) for most devices.

Purchase Information & Product Page82

[Screenshot]
Through the Screenshot to get device real-time screen, there is a limitation, your device must login
to operation system, otherwise, cannot capture screen and shown “The OS of device is not loggedin”

Purchase Information & Product Page

83

[Terminal]
To terminal support any command to your devices, for instance, realize your device IP, traceroutethe network or copy/view file on the device.

Purchase Information & Product Page

84

[Remote Desktop]
DeviceOn leverage VNC (Virtual Network Computing) technology to achieve remote desktop, tobridge different network between public and private. User do not need to install any program, Appon their laptop or mobile devices. Through DeviceOn website to remote desktop to debug anddiagnostic. Please make sure your web client port (outbound) is allow within (6083~6102), and target
device outbound port, 5501.

Purchase Information & Product Page

85

[Advanced Control]
For others features depend on your device operation system and hardware. DeviceOn integrate
Windows Lockdown features on LTSC (Long Time Service Channel) and LTSB (Long Time Service Branch)
to provide advanced control, such as “Block USB Drives”, “Keyboard Filter”, “Block Windows
Notification”, “Block Touch, Gesture” and “UWF (Unified Write Filter)”.
[USB Drive]: Prevent threats from outside USB drives, not include keyboard, mouse.
[Function Key]: Disables Ctrl, Alt, and WinKey.
[Windows Notification]: Block application notification.

Purchase Information & Product Page86

[Touch Screen]: Disable touch control[Tough Gesture]: Disable gesture control[UWF Protection]: To protect your drives by intercepting and redirecting any writes to the drive(app installations, settings changes, saved data) to a virtual overlay. The virtual overlay is a temporary
location that is usually cleared during a reboot or when a guest user logs off.
Benefits:•

Provides a clean experience for thin clients and workspaces that have frequent guests, likeschool, library or hotel computers. Guests can work, change settings, and install software.
After the device reboots, the next guest receives a clean experience.

•

Increases security and reliability for kiosks, IoT-embedded devices, or other devices where
new apps are not expected to be frequently added.

•

Can be used to reduce wear on solid-state drives and other write-sensitive media.

For backlight, brightness, GPIO and Watchdog only support on Advantech hardware platform withSUSI driver, please download from Advantech Support site.
[LVDS, Backlight and Brightness]: Turn on/off LVDS backlight for power saving.
[On Screen Display]: Adjust monitor (brightness, color temperature, resolution, …etc.), especially
support on Advantech Industrial Display.
[Watchdog Protection]: Hardware level watchdog to prevent BSoD (Blue Screen of Death) or
system hang without any response. If happened, watchdog will restart your device automatically.
There is an tool called NotMyFault that you can use to crash, hang, and cause kernel memory leaks
on your Windows system.
Benefits: Avoid embarrassing moment, if BSoD on your Signage devices over the airport,
Purchase Information & Product Page87

department store and public area.
⚫

Device Data

Raw data of each plugin on devices, user could get real-time and historical data on this page. To data
analysis and aggregation, user could adjust data report interval or reset to default (60s) for basic
sensors.

The default display is table mode, you could switch to JSON format through the icon.

Purchase Information & Product Page88⚫

Device Group

Every account could group their device into different groups to manage, for example, device overdifferent floor on the building. User could create 1F, 2F group to easy management.

Click on the icon to add “Device Group”. The option to configure the parent group, that’s means sharethe device group to parent group owner.

Purchase Information & Product Page

89

Click on the icon to “Edit” or “Delete” account.

⚫

Task

The real-time actions on the overview that are defined, created on here, you could add a new task
and pin to overview. These tasks are binding to personal account, cannot view, edit, and delete others.

Click on the icon to add action.

Enter your description and select a “Task” from three categories, Power Saving, Security and System.

Purchase Information & Product Page

90

Select “Device Groups” for the action that you picked up.

To confirm information, action, group and devices, and enable pin on overview, please click on“Confirm” to complete the wizard.

Purchase Information & Product Page

91

After created, you could find a new action on below actions list, click the PIN icon to determine theaction shown on overview or not.

The actions support scheduling, click on the icon to define a schedule, daily, weekly, monthly, yearlyor once.

Enter to schedule list for all actions and click on add icon to create new schedule.

Purchase Information & Product Page

92

Given your schedule name, time zone, period and time and click Save.


Schedule Name: Name of scheduleTime Zone: Time zones tend to follow the boundaries of countries and their subdivisons insteadof longitude, because it is convenient for areas in close commercial or other communication tokeep the same time.



Period: Repeat interval for Daily, Weekly, Monthly, Yearly or once at a time.



Time: Execution time.

Click on the edit icon to adjust schedule item.

Click on the delete icon to delete schedule item.

Purchase Information & Product Page

93

⚫

Rule Engine

DeviceOn provides the rule engine. Users can acquire anomaly situations by means of setting
thresholds to those interested devices, and, once one or more thresholds meets, receive alerts via
event notification services, another one indispensable feature for users.

Click on the add icon to create a Rule.

Pick-up the sensor that you want to monitor, the steps are select Rule Type, Device Group and Device.

Purchase Information & Product Page

94

Define the threshold, provide 3 types, more than, less than and outside the range. Also, you could
realize current value on the page.


Lasting Time (Second): means the sensor over the threshold and continue for a period time,
avoid peak value to trigger.

Notice Interval (Second): If over the threshold, the WISE-Agent will send a notify event, toavoid lots of message, user could adjust notice interval.

Purchase Information & Product Page

95

Next, to define the action, if threshold reached. For example, you could power your device off, if thehard drive unhealthy.

Confirm the rule setting and click confirm.

Purchase Information & Product Page

96

The rule list shown as below, user could edit or disable through the switch.

⚫

Provision

For device provision, 3 types of need be pre-configured. One is “Power On”, select which mode toenable device wake up. The others are 3rd party tool integration, Acronis to backup/recovery yourdevice system and McAfee for white-list security protection. To install 3rd tools, you must purchasethe license and activate the product.
Purchase Information & Product Page

97

Power On

To power your device up, you might to configure the mode for your device. The mechanism is basedon Wake-on-LAN to send magic packet to your device. There is a limitation on “Direct Mode”, theDeviceOn server and edge device must be on the same network.

Purchase Information & Product Page

98

However, through the “Agent Mode” or “Repeater” could overcome the limitation. You need to pickup a device that always on and on the same network with other devices.

For Repeater mode, not only enter your repeater IP, but set your repeater to allow port forwarding(uses UDP port 7 and 9) and permit the packet to be broadcast to the entire LAN.



System Backup/Recovery

Select the free space size to create Acronis Secure Zone (Hidden Partition) to backup system partition.
The free space size must larger than system used.

Purchase Information & Product Page

99



System Protection

Select the device group to install.

⚫

Anomaly Detection

DeviceOn ADS is one of the services that combines anomaly detection algorithm and DeviceOnfunction. It not only gives customers the high accuracy identification of the error message whenadvertising is getting interruption but also provides the IoT device remote monitoring andmanagement. Leverage with Azure Custom Vision to continually train the algorithm in order toovercome various errors pop-up under real field.
Before to detect your anomaly screen, please make sure your device is logged in to capture screen
status.

Purchase Information & Product Page

100

Click on the configuration icon to enter API URL and Key.

Purchase Information & Product Page

101



API URL & Key: Please contact us for AI machine URL and Key, otherwise, deploy total
package from Azure Marketplace.

Maximum Retention Days: Maximum retention days for the warning images.

Interval: Minimal interval to detect devices screen.

Window Popup: Enable to detect popup window on the devices.



Freezing Wanted: Enable to detect freezing window on the devices.

Click on the rule icon to enable detection rules.

Purchase Information & Product Page

102

Click on the “+” icon to create anomaly rule, select to your device or device group

Set the detection interval of the rule, the interval cannot be less than the configuration.

Confirm the rule and enable it.

Purchase Information & Product Page103

3.3.2 Account Management

The first step to manage device is login to DeviceOn, therefore, you could start to invite, edit otheraccounts on this page. The user profile shows your account information and person alert service, suchas Email, SMS, WeChat, LINE, Telegram, Slack and Teams status.

To change your password, please click on the “Change Password” on the profile.

Purchase Information & Product Page

104

Every account belongs to a role, you could switch the tab to invite/view and edit account. There are 3
roles in the DeviceOn system. One is “Super Admin”, only one account in the system belongs to “Super
Admin”. The other role is “Admin” and “Device Admin”. For detail role permission, please reference
Section 7.1.

Click on the icon to “Add Account”

Purchase Information & Product Page

105

Enter your account, role, password, etc. to create an account. If the user would receive notify fromdevice, system alert, please enable these alert services on “Mail”, “SMS”, “WeChat”, “LINE”,“Telegram”, “Teams” and “Slack”. These alert services are personal setting, please make sure the“Setting -> Notification” is configured, enabled on DeviceOn System.
Click on the icon to “Edit” or “Disable” account.

3.3.3 Event Logs

Purchase Information & Product Page

106

Device management is complex with device log and user behaver. Logging data can provide insights
about your devices and help you:⚫

Troubleshoot past problems or prevent potential ones⚫

Improve device healthy or maintainability⚫

Real-time alert through 3rd notification

DeviceOn logs are categorized into the following types:⚫

Operation logs provide information about DeviceOn resource CREATE, UPDATE and DELETE
operation, like set device power off, update device name or delete account.

⚫

Device logs provide information about events raised as device side resources, like connected,
disconnected, over the threshold,⚫

System logs provide information about analyzed; scheduling event/alert that have beenprocess on DeviceOn server. Example of this type are queue buffer alerts where server has
processed and measured IoTHub queue and provides concise alerts.

There are three types of Event Logs as mentioned above and each event log with different severity,
Information, Warning and Error. Through the filter to find your device log.

Click on the icon to refresh event log by manual.

Purchase Information & Product Page

107

Click on export icon to export devices that in the table as CSV file.

3.3.4 App Management (Enhancement OTA)App Store is an enhanced OTA software update feature which presented in a familiar mobile
management user interface to provide users with the ability to manage their own exclusive
applications and deploy them to remote devices in a simple way. App Store is divided into two modesof operation. IT administrators could use WISE-DeviceOn portal to customize, upload, manage apps
and schedule installation to designated devices, which we call the manager mode. Second, in theclient mode, the App Store application is built-in the device side, and the device can instantly update
the applications.
⚫

App Store

1.

Keyword Search: Input keyword to search apps.

2.

App List: View all apps, grouping by category. Click to open a window to present App
Information.

Purchase Information & Product Page

108

[Application Information]

1.

Information: Including all information about the app.
A.

Description: Description text of app. Hidden in default, click [More] to show all.

B.

Last Update: Last update date of app.

C.

Operating System: The app’s support operating system. It is relevant to version, might havedifferent platforms between versions.

D.

Offered by: The provider company of app. Click on it to show more information of thecompany, and all apps belongs to the company.

2.

E.

Contact Support: Contact person of the app.

F.

Keyword: Keyword list of the app. Manager can search app by these keywords.

Repository: The file holder of the app. Select one of repositories to decide where app downloads
from and getting app’s Version list.

3.

Version: The version number of the app.

4.

Install: After select Repository and Version, click Install button to open the Install dialog, wheremanager can select Devices/Groups to run installation.

[Install]Purchase Information & Product Page

109

1.

Search account or group: Input keyword to search account or group. It is useful when there area lot of accounts below.

2.

Accounts and Device Groups: List accounts, and Device Groups under each account. Check theDevice Group will add all installable devices of the Device Group to Selected Device.

3.

Filter devices: Turn On/Off the filter.
◼

If switch-on: Device List shows devices which does not install the version of the app.

◼

If switch-off: Device List shows devices which does not install the version of the app, anddevices have installed app’s version is the same or beyond manager selected version.
Default is “On” to prevent manager duplicating installing app with the same version.

4.

Device List: Devices can install the app will list in this area. Click the plus sign + will add the device
to Selected Device.

5.

Selected Device: Devices list here will install the app.

6.

CONFIRM: Execute installation of the app to selected devices.

7.

CANCEL: Cancel this operation, back to previous step.
⚫

My Devices

Specify a device to control app upgrade, install, uninstall, and set schedule of certain app maintenance.
Also, schedule can be added to Device Group, control multiple devices by pre-defined group.
[Device List]

Purchase Information & Product Page

110

1.

Select Account: Select an account which owns device, manager want to control.

2.

Select Type: Select Device to retrieve device list or select Device Group to retrieve device grouplist. Changing this option will affect result of list below.

3.

Select Device Group: Select a device group to retrieve device under the group.

4.

Select Status: Select device connect status.

5.

Keyword Search: Input keyword to search match device.

6.

Device List: Match conditions’ device list here.

7.

Open Menu: Click to open menu.

[Device Details]

Purchase Information & Product Page

111

1.

Device Information: Information of the device, click More to view full content

2.

Installed: Show installed app of the device.

3.

Installed App: Installed apps list.

4.

Suggested for the device: Not installed apps list, or installed app has newer version.

5.

App Control Button: Enabled button is colorful, otherwise button is fade-out.
5.1. Upgrade: The app can upgrade to newer version.
5.2. Uninstall: The app support uninstall ability; manager can uninstall the app online.

[Device Schedule]

1.

Add Schedule: Open a dialog to add schedule setting.

1.1. App Name: Select an application and OS to upgrade.
1.2. Upgrade Mode: Decide how to upgrade when there are multiple versions beyond the app
installed in the device currently. Maximum mode will upgrade to the latest version directly.
Increment mode will upgrade from next version to the latest version by ascending sorted version.
1.3. Execute Frequency: Schedule executing frequency. By changing frequency option to set
Purchase Information & Product Page112

relevant setting. DeviceOn provide Daily, Weekly, Monthly, and Once to fit variable scheduleneeding.
1.4. Save: Click to save schedule setting.
1.5. Cancel: Discard changes and close this dialog.
2.

Remove Schedule: Switch to remove mode, select schedules which manager want to remove,then click this button again to remove selected schedule.

3.

Schedule List: List schedules of the device. And the setting detail of schedule.

4.

Edit Schedule: Open a dialog to change schedule upgrade mode, executing frequency and timing.

[Device Group List]

1.

Select Type: Select Device Group to retrieve device group list or select Device to retrieve device
list. Changing this option will affect result of list below.

2.

Device Group List: Device groups are managed by Select Account will list here.

3.

Open Menu: Click to open menu.
3.1. Group Details: Open a dialog shows device group relevant information. e.g. group
description, list of devices under the device group.
3.2. Group Schedule: Setting schedule to the device group. UI and setting are all the same with
Device Schedule. And, the schedule setting will apply to devices in the group, which are able toinstall/upgrade app.
⚫

Repository

Repository management, and app management. Repository is where apps package file upload to.
Repository support several protocols, e.g., Azure Blob, Amazon S3, and FTP. Manager can create
preferred repository or using built-in Default-FTP provided by DeviceOn. Upload app package file,maintaining versions of app, or modify app’s description data, icon. Also, manager can wrap your own
app via online tool.
[Repository Overview]
Purchase Information & Product Page

113

1.

Repository List: All repository’s list here. Select an option to show apps in the repository.

2.

Edit Repository List: Open a dialog to manage repository.

3.

Add App: Open Online Wrap Tool to build an app.

4.

Upload App: Upload app package files which are created by Online Wrap Tool.

5.

Remove App: Switch to remove mode, select app which manager want to remove, then click thisbutton again to remove selected app.

6.

App: The app brief information. E.g. latest version number, update date, and support OS.

7.

Menu: Open a menu shows Add New Version, Version History, Edit App Information.

[Repository Management]1.

Add New Repository: Open a dialog to add a repository, depending on selected repository type

Purchase Information & Product Page114

to enter relevant parameters.

2.

Remove Repository: Switch to remove mode, select repository which manager want toremove, then click this button again to remove selected repository.

3.

Edit Repository: Open a dialog to edit selected repository setting.

[App Management]1.

Add New Version

1.1. Operating System: Select OS of the version can install.
1.2. Version: Version number. 3 or 4 digits and separated by dot(.). For example: 1.0.0 or
1.2.3.4
1.3. Select Directory: Select a directory to upload, which contains files are necessary for
installing the app.
1.4. Install Script: Select a runnable script file for executing installation.
1.5. Uninstall Option: Switch On/Off to determine this version’s app can uninstall or not.
Purchase Information & Product Page

115

1.6. Uninstall Script: Select a runnable script file for executing uninstallation.
1.7. Advanced Option: Switch On/Off to show/hide more option.
1.8. Reboot Option: Switch On/Off to determine this version’s app need reboot after
installation or not.
1.9. Check Script: Select a runnable script file for executing checking result of installation is
successful or failed. The script file must return "0", that means success, and all other value will
be took as fail.
1.10. CONFIRM: After reviewing settings above, then click this button to start upload
1.11. CANCEL: Discard changes and close this dialog.
2.

Version History

2.1. Operating System: Show all support operating system in list. By selecting different item inthe list to show versions it owns.
2.2. Remove Version: Switch to remove mode, select version which manager want to remove,then click this button again to remove selected version.
3.

Edit App Information

Purchase Information & Product Page

116

Manager can edit the app’s descripting data, changing icon, provider, and contact information. Click
CONFIRM to apply setting. Or, click CANCEL to discard change and close dialog.
[Wrap Your Application]
Refer to Hand-On Labs, Section 4.2.
3.3.5 System Configuration

A System Configuration define advanced setting include “Notification & Event Alert”, “System UI” and“Product Activation. These setting are usually changed less often or only need to be modified once.
Some functions require root, admin to modify or be visible, and product activation only shown on
prefecture license, such as Standalone, Azure Kubernetes version.

⚫

Notification & Event Alert

Purchase Information & Product Page

117

Here are seven notification services, include tradition service (SMS, Email) and popular social media(LINE, WeChat, Telegram, Microsoft Teams, Slack), if you select the event log type on “Notification
Item”, the notify message will through these services. These notification services are global setting, if
your account does not receive, please check the personal setting on Account.

To configure these notification service, please reference Section 4.3.2 ~ Section 4.3.5.
⚫

System User Interface

DeviceOn provide an option to customize menu item, theme, logo and user could by setting up theuser interface to meet their needs.

Purchase Information & Product Page

118



System Menu: To show/hide the items on the menu bar

The default setting does not include “IPMI”, “OTA” (Replaced by App Management), “Addins” and“System Report”, the “AddIns” is used to customized UI page or embed specific website page tointegrate with DeviceOn.

➢ [IPMI]The Intelligent Platform Management Interface (IPMI) is a standardized message-based hardware
management interface. At the core of the IPMI is a hardware chip that is known as the Baseboard
Management Controller (BMC), or Management Controller (MC). DeviceOn integrate standard
functions as below to retrieve device status and power management.
⚫

Sensors (“sensor” and “sdr” related commands) --- practically using all the IPMI sensors asdata source in DeviceOn⚫

SEL (System Event Log)⚫

power on/off/graceful shutdown/cycle as well as reset commands

Purchase Information & Product Page

119

Click on more option to view the device sensor, event log and power control.

➢[OTA] Deprecated, Replaced by App Store

Purchase Information & Product Page

120

OTA (Over-The-Air) is one of powerful feature DeviceOn provides. Users can deploy software packages,
configuration, Windows QFE (Quick Fix Engineering), Advantech BIOS update onto a device remotely,or even many devices broadly.
⚫

Storage

There is a default Azure blob storage called “wiseagent-upgrade”, host by Advantech DeviceOn team.
If there is a new version of WISE-Agent released, all of user could get the update and upgrade theirdevices. The storage is read only cannot upload user’s OTA package.

Click on add icon to add new storage.

For cloud storage, DeviceOn provide “Amazon S3”, “S3 Compatible”, “Azure Blob” and traditional
FTP services.
[Amazon S3]
You could create and get Access Key, Secret Key from Amazon Web service.

Purchase Information & Product Page

121



Storage Name: Your storage name, define by yourself.

Region: Region of AWS S3

Access Key: Access Key for AWS S3



Secret Key: Secret Key for AWS S3

Purchase Information & Product Page122

[S3 Compatible]
The setting similar to Amazon, only endpoint must be configured to yourself.

[Azure Blob]
For Azure Blob, supports two mechanisms to access, one is “Storage Account” and “Access Key” withfull access permission of container. The other is “container” SAS token generated via Microsoft Azure
Storage Explorer.

Purchase Information & Product Page

123

Through Azure portal to get your Storage Account and Access Key.

Get container’s SAS token via Azure Storage Explore, please make sure your permission (Read,
Write, Delete, List) and valid period (Start and Expiry time)

Purchase Information & Product Page

124

[FTP]For FTP, you might setup another FTP server with security and account, password.

Purchase Information & Product Page

125



Security: Leave it as “NONE”, the default value. If your FTP server running on FTPS protocol,
pick “FTPS”.

SOTRAGE NAME: Enter “MyFTP”.



DOMAIN: Enter the FQDN of your FTP server, or its IP address.



PORT: Should be 21 if the FTP server runs on a standard port number.



ACCOUNT NAME: A valid username that can connect to the FTP server, and upload files onto
the server as well.



PASSWORD: The password to login.



CMC/SMC: Maximum Client & Server Connection.



ROOT PATH: FTP server access path (root folder)

DESCRIPTION: It’s optional information.

Click on edit icon to adjust a storage.

You could edit yourself storage, but the default storage cannot.

Purchase Information & Product Page

126

⚫

Package

View and edit OTA package on select storage, user could edit, delete upload their package to selectedstorage, but default storage (wiseagent-upgrade) cannot. To ensure the security and data format on
OTA package, user should wrap their software, firmware via DeviceOn toolkit. The toolkit not only
command-line tool but support online UI mechanism.

Select to your storage and click on the toolkit icon to start to warp your OTA package.

Purchase Information & Product Page

127

Prepare your software, configuration and installation script first, gives below information. The
operation system and architecture might be different. Therefore, to determine the OTA package be
deployed on which devices, please pick-up the “Tag Name” on “Supported Arch”. All “Tags” mustmatch with devices, the OTA package will be executed. For example, there is two devices (ARK-1123,
UTC-520) with different tag attribute. The ARK-1123 device is Windows based and support x64 andx86 OTA package. The UTC-520 is Ubuntu system also support x64, x86.
◼

ARK-1123 (Tags): win, x64, x86◼

UTC-520 (Tag): ubuntu, x64, x86

If your OTA package tags are “win”, “x64”, “x86”, the package only support and executed on “ARK1123”. Otherwise, if the tag is “x64”, both devices could be affected.
Package Type: Name of package

Package Version: Version of PackageSupported Arch: Select “Tag Name” from of device (Account -> Device Group -> Device)

Deploy File: Installation script (batch file or shell script)



Storage: Upload to storage or downloadAdvanced options: Reboot or run the script after deployed.

Purchase Information & Product Page

128

Click on the delete icon to delete your OTA package.

Click on the upload icon to upload your OTA package.

Purchase Information & Product Page

129

⚫

UpgradeOn the upgrade tab, start to select your device or device group and pick-up your OTA package thatyou upload before. On the device list to configure schedule, check the result status and program listthat installed.

Click on upgrade icon to select OTA package.

Select your package to “Upgrade”, “Download” or “Deploy”. The “Upgrade” represents download OTA
Purchase Information & Product Page

130

package from storage and execute (Deploy) immediately. Every package would be kept on device side
as “Upgrade” or “Download”.

To check the deploy status, please click on process icon.

To avoid burst download on large number of devices upgrade at the same time, user could addschedule to check and upgrade by schedule.

Click on add icon to create a schedule.

Purchase Information & Product Page

131



Package Type: Select your OTA package from storage.



Action Type: Download or Deploy the package.

Upgrade Mode: If the mode is Max, the action would download/deploy the latest version
on the package. Otherwise, if the mode “Increment”, The deploy, or download behavior will
gradually increase from the lower version to the latest version.

Frequency: Daily, Weekly, Monthly or Once to check.

Action Start Time: Check time on start.



Action End Time: End time for download, if download exceeds the end time, the action will
be terminated.

Click on edit icon to modify, delete OTA schedule.

To check deployed software, configure status on device, please click on the numbers.

Purchase Information & Product Page

132

Furthermore, user could view the program list on the device. (Windows Only)

This program information retrieves from device operation system, same as below figure.

Purchase Information & Product Page

133

⚫

Configuration

There are three options for OTA to deploy your package, one is “Rollback” that means if a new version
deploys failed, and the WISE-Agent would try the best to rollback to previous version that successfully.
But there is a perquisite, the previous version of the package exists on the device side. The remaining
two options are the retry times. Due to network instability or other factors causing the download fail,OTA provide the retry times to ensure successfully deployment as possible.

[System Report]
Second, if the System Report be enabled will appears to the menu item. The system report takes week
as the unit (Sunday to Saturday), and the generation time is every Sunday 00:00 (server time zone).
Purchase Information & Product Page

134

The report retention time can be set up to 365 days.

After enabling the system report function, you could search and download PDF reports within theinterval.

From the system report, you may realize the whole status, including server uptime, downtime andmanaged devices healthy for the pass week.

Purchase Information & Product Page

135

Purchase Information & Product Page

136



System Theme: Select the theme style of the system

System Logo: Product logo customized, supported formats: GIF, PNG, JPEG/JPG. We
recommend the image with a height is less than 55 pixels.



System Login Page: Login page customized, supported formats: PNG, JPEG/JPG. We
recommend the image with a resolution is less than 860x840 pixels.

Overview Setting: To show/hide the functions on the overview

Language Setting: Set display language, (English, Traditional Chinese and Simplified Chinese)Server Time Zone: Set the server time zone, which only affects the event log time of thenotification message.



Account Registration: Enable account registration, users can sign up an account in the login
page, the default role is the device administrator.



Two-Factor Authentication: Two-factor authentication (2FA) is an extra layer of security
used when logging into websites or apps. With 2FA, you must log in with your username
and password and provide another form of authentication that only you know or haveaccess to. If you prefer to use an authenticator app for two-step verification, here are a few
common authenticator apps that can be found in your mobile device app store:◼

Google Authenticator◼

Microsoft Authenticator

◼

Authy

◼

LastPass Authenticator

Purchase Information & Product Page

137



LDAP: Configure LDAP Server Setting

X.509 Certificate: DeviceOn supports x.509 certificate authentication for use with a secure
TLS/SSL connection. The x.509 edge device authentication allows device to authenticate toservers with certificates rather than with a username and password.

Remote Storage (SMB/CIFS): Support for remote device system backup to SMB/CIFS insteadof a local drive, and recovery from SMB. For instance, a user could generate a golden
operation system image, then restore to hundry of device in a factory, if needed. You also
can leverage Azure file to mount a SMB on your remote system to achieve cloud backup.

Data Export: The data export help to dump your sensor data as CSV or JSON format andupload to your cold storage, such as Azure Blob, AWS S3 and FTP for advance data ingestion
and learning through third-party. The generation time is every Sunday.



Webhook: In addition to the existing event notification via social media services (LINE,
WeChat, Teams, Slack, Telegram), it also supports the integration of third-party APIs via
Webhook. Such as Microsoft Dynamics 365 Field services.



Syslog: Syslog is a standard for message logging. It allows separation of the software thatgenerates messages, the system that stores them, and the software that reports andanalyzes them. Each message is labeled with a facility code, indicating the type of systemgenerating the message, and is assigned a severity level. DeviceOn may use syslog for systemmanagement and security auditing as well as general informational, analysis, and debugging
messages.

App Management -> Offered by: App developer or company.



App Management -> Contact Support: App developer and contact mail.

⚫

Product Activation

Starting from Version 4.5, we have adjusted the license mechanism, DeviceOn provides two methods
to activate the license, you can directly go to WISE-Marketplace to purchase or go to the Request
Form to apply for a trial license. After you apply, the product team will review your request then sendback the license file.

Purchase Information & Product Page

138

When you log in for the first time, you will be prompted that you do not have any license to manage
the device, please purchase or apply for a license first.

After obtaining the License key or File, the license status and record of the server will be displayed
after import. Note that the License Key is the old mechanism. After converting to the new mechanism(License File), we no longer support the old.
•

New License Flow•

Purchase a License from WISE-Marketplace

Purchase Information & Product Page

139

3.3.6 Dashboard

The DeviceOn not only native support and build-in Grafana for data visualize, but fully integrate andsimplified procedure to 1-Click to generate a dashboard. Grafana is an open-source software formonitoring and analysis. One of its major characteristics is it supports many different data sources,from popular CloudWatch, Elasticsearch, Graphite, and influxDB, to OpenStack Gnocchi or Google
Calendar. Its range is very extensive. However, for others data source require to implement SimpleJson
to access your data.

Click on the “+” icon to create dashboard item.

Purchase Information & Product Page

140

Here, DeviceOn support 4 types of board, select one of method to generate your dashboard. Device,device group, mode or select our default template to generate. Last, embed an arbitrary external web
page.
Enter your board name, Grafana URL, account and password. (Default account and password is“admin”)

Select target sensor from the device and click next.

Purchase Information & Product Page141

(Device Method)(Template Method)
Confirm the result and information and start to generate.

Purchase Information & Product Page

142

After that, the board be generated on the menu item.

4. Hands-On LABs
Purchase Information & Product Page143

4.1 How to Create a Real-time Action into Overview
The real-time action is a handy way to execute a specific command to a bunch of devices. This lab
guides you how to create a real-time action. And, after this lab, you should:•

Learn how to create a real-time action on demand.

•

Know of what actions DeviceOn provides.

•

Have an action named “MyTask” and pinned into your “Overview” page, that can reboot
devices belong to group “Default”.

4.1.1 Prerequisite•

A running DeviceOn server.

•

A device that installed WISE-Agent connects to DeviceOn server.

4.1.2 Step-by-Step

Step 1: To create a real-time action, click the “New” icon in “Overview”. Alternate, click “Setting”
from the menu populated in left hand side.

Step 2: Either way you use in step 1, it leads you into the “Add Task” page. Click the “+” symbol.

Purchase Information & Product Page

144

Step 3: You now run into the first page “Select Task” to create a new real-time action. Enter the task
name “MyTask” as well as choose the action “Reboot” within this page. From this page you can see
all tasksDeviceOn provides. Then end this page up with clicking “Next” button.

Step 4: Choose the target group “Default” to execute the real-time action in “Select Device Groups”
page.

Purchase Information & Product Page

145

Step 5: The last page “Confirm” provides you a summary like information and, more than those, lets
you decide whether this action “Pin” to your “Overview” page or not. DeviceOn turns this feature
on by default. Just toggle it if you don’t want this action pin to your home. Finally, click “Confirm”
button to finish.

If everything goes well, you should see there is a new item generated within “Task”. Meanwhile, if
you go to your home (page “Overview”), you can see a new one action icon is populated there.
Purchase Information & Product Page

146

What should, or can, you do now? Yes, one-click that icon you created from “Overview” page, andwatch the devices whether they execute reboot action.

4.2 How to Upload an App to Your App StoreApp Store is another powerful feature DeviceOn provides. Users can install software application onto
a device remotely, or even many devices broadly. This lab guides you how to accomplish upload andwrap your application to on-premise App Store. And, after this lab, you should:•

Learn how to wrap your software for remote provisioning.

•

Have the NotePad++, a popular and famous text editor, populated within the target device.

4.2.1 Prerequisite•

A running DeviceOn server.

•

A device which running on Windows operating system and installed WISE-Agent, that connects
to DeviceOn server.

•

A NotePad++ installer, 32-bit edition is recommended. Its name is “npp.7.8.2.Installer.exe”,
something like that. It can be downloaded from https://notepad-plus-plus.org/downloads/.

•

Automation skills to install target software package. It is because that user intervention is notpossible during provisioning via App Store. For Windows it can be batch file or power shell,
while for Ubuntu it may be shell scripts.

4.2.2 Step-by-Step

Step 1: Preparation
Purchase Information & Product Page

147

What should we prepare for an App:1.

Name: The public name of app that you want to present to users.

2.

App: App files for installing to device. There are two necessary files, installer and install
script file. In windows, installer may be MSI or EXE, and install script file may be BAT. If theapp need to run uninstallation, you need to prepare one more script file for uninstalling.

3.

Icon: A well-design icon image makes app looks more professional.

4.

Description: Detailed description text will help user knows the app more.

5.

Keywords: Accurate keyword can lead user to the app via searching tool, making higher
visibility.

6.

Category: The same with keywords, and more. Category will directly show in app store’s first
page.

7.

Provider: The provider is company, or organization who owns the app. The same provider’sapp will display together under provider’s page. Please prepare a logo image, website URL,
and description about provider.

8.

Contact: Providing contact information to users. Let user could send feedback to help app’s
growth. Please prepare name of contact, and e-mail address.

Note: Image specification: A squared image, in JPG, PNG, GIF formatted file. Recommendation size is
400 x 400 pixel. And smaller than 1 MB(Megabytes)
Step 1: Given an App Information

Purchase Information & Product Page

148

1.

Name: The public name of the app.

2.

Icon: Click to upload an image as app’s icon.

3.

Is Public: Switch to turn On/Off share property to the app. If turn On, other account can install
this app to their device. If turn Off, only the account who upload this app can retrieve the app.
Note: The property cannot be modified later.

4.

Description: Text information about the app.

5.

Add Keywords: Open a dialog to set keywords. At most 10 keywords are acceptable.

Purchase Information & Product Page149

5.1. Enter Keywords: Input keywords and it will display in keyword candidate list. Manager can
input a comma-separated string contains multiple keywords at once. For example: “Editor, Text”
will be two items in keyword candidate list “Editor”, “Text”.
5.2. Keyword Candidate List: Shows extant keywords or taking apart from string input above.
Click plus sign (+) in the keyword item to add to Keyword List.
5.3. Keyword List: Shows manager selected keywords. Click cross sign (x) in the keyword item toremove it from Keyword List.
5.4. Save: Save keywords in Keyword List.
5.5. Cancel: Discard change and close dialog.
6.

Category Name: Select fitting category in drop-down list.

6.1. Category List: Selected category list. Click cross sign (x) in the category item to remove itfrom Category List.
6.2. Open: Open Category Candidate List.
6.3. Search: Enter keyword to filter matching category in Category Candidate List.
6.4. Category Candidate List: All categories list, click on suitable category to add to Category List
7.

Add Provider: If provider not found in provider list, manager can add one here.

7.1. Logo: Upload an image as company’s logo.
Purchase Information & Product Page

150

7.2. Company Name: The name of company
7.3. Company Website: URL of website.
7.4. Company Bio: Text description of company.
7.5. CONFIRM: Save to database and can be found in Select Provider.
7.6. CANCEL: Discard change and close dialog.
8.

Select Provider: Select a provider in extant provider list.

9.

Add Contact: If contact not found in contact list, manager can add one here.

9.1. Contact Name: Name of contact.
9.2. Contact Email: Email of contact.
9.3. CONFIRM: Save to database and can be found in Select Contact.
9.4. CANCEL: Discard change and close dialog.
10. Contact Support: Select a contact in extant contact list.
11. Next: To next step.
The result similar as below sample of step 1.

Purchase Information & Product Page

151

Step 2: Upload your App

1.

Version: App’s version number. 3 or 4 digits and separated by dot(.). For example: 1.0.0 or 1.2.3.4

2.

Operating System: Select OS of the app can install. Multiple OS are acceptable.

3.

Save to: Select an option where app package file will save after Step 3. Confirm. [Local] means

Purchase Information & Product Page

152

there will be two zip files download to your local machine, please save it properly, and uploading
to specific repository by Upload App from [Repository Name] means Online Wrap Tool will
upload app package files to the repository directly.
4.

Select Directory: Select a directory to upload, which contains files are necessary for installing the
app.

5.

Install Script: Select a runnable script file for executing installation.

6.

Uninstall Option: Switch On/Off to determine this version’s app can uninstall or not.

7.

Uninstall Script: Select a runnable script file for executing uninstallation.

8.

Advanced Option: Switch On/Off to show/hide more option.

9.

Reboot Option: Switch On/Off to determine this version’s app need reboot after installation ornot.

10. Result Script: Select a runnable script file for executing checking result of installation is successful
or failed. The script file must return "0", that means success, and all other value will be took as
fail.
11. Back: Back to previous step.
12. Next: To next step.

Step 3: Confirm

Purchase Information & Product Page

153

1.

App Information/Content: Display all data entered in previous steps, please check again before
you click Confirm.

2.

Back: Back to previous step.

3.

Confirm: After checking App Information/Content, click Confirm to finish this tool.
Note: Depending on selected option of Step 2: Save To, you will save two zip files or waiting awhile for uploading app package files.

4.2.3 DeviceOn Overview

The overview provides quick access to real-time statistics for your managed devices. This information
helps to monitor overall status as well as identifying high risk devices. Currently the overview includes
Real-time Action, Scheduled Tasks, System Analysis, Device Ranking, and Device Map.
⚫

Real-time Actions

Real-time actions provide one-click access to certain actions defined for specific device groups,
providing a shortcut for efficient management. Examples for actions are batch reboot, batch
screenshot or batch updates.

Purchase Information & Product Page

154

For example, once you click “Reboot”, a confirmation dialog will pop up and will indicate which devices
will actually be affected. Click on the device group button to get more details (individual devices
names).

⚫

Scheduled Tasks

In addition to real-time action, actions can be scheduled. An example for this is powering off orrebooting devices at a certain time of day. A calendar view is used to visualize upcoming tasks.

Purchase Information & Product Page

155

⚫

Event Log Statistic

There are three levels of event log on DeviceOn system, such as Warning, Error, and Information.
Gives a summary and statistic result for current day. Click on the bar char to redirect Event Log tab tocheck detail log information.

For historical data, please click on “More” to compare the daily, weekly result.

⚫

SystemThe system is focus on DeviceOn server loading and usage, including storage, CPU and Memory. The
administrator could realize the real-time server uptime, downtime through the overview and based
Purchase Information & Product Page156

on the matrix to scale cloud performance.

⚫

Devices Status

Shows the total devices of current account and DeviceOn system managed.
Shows the number of currently online devices as well as total number of managed devices (assigned
to account).

Click on the more information on system managed to show the number of currently online devices
as well as total number of managed devices.

Clicking this overview will bring up a detailed device list including status as well as group membership
information.
Purchase Information & Product Page

157

⚫

Top 5 (High-Risk) Statistic

DeviceOn leverages six common sensor types to identify potential high-risk devices. Those sensors
are device disconnects, network traffic, disk usage, disk health, CPU usage and memory usage. This
“top 5” overview allows to quickly identify potential issues and fix or replace the systems to avoid
unexpected downtime.

⚫

Device Map (OpenStreetMap/Google Map/Baidu Map)

Purchase Information & Product Page

158

DeviceOn offers support for maps (latitude and longitude-based position) or floor plans to visualize
the location of managed devices. User could define their location on the map and place the device tothe area (floor plans).

For on-premises and without public network environment, you could try to download an offline
OpenStreet map and place into right place.
Step 1: Download OpenStreetMap data for your region (.osm.pbf)
Step 2: Convert and process OpenStreetMap file (.osm.pbf to .osm) via Osmconvert
osmconvert.exe <YOUR_REGION>.osm.pbf --out-osm -o=<YOUR_REGION>.osm_01.osm
Step 3: Adopt Maperitive for drawing maps based on OpenStreetMap⚫

Open the .osm file that generated from Step 2 through Mapertive.

⚫

Generates tiles from the zoom level 1 up to the zoom level 8. (REF)
generate-tiles minzoom=1 maxzoom=8

Purchase Information & Product Page

159

⚫

Copy the all folder and tiles.json that generated under “./Maperitive/Titles” to DeviceOn
Server path (/portal/static/offlineMap/OpenStreetMap/Tiles)

Note: Be careful when specifying zoom levels. Each zoom level needs about four times as many tiles
as the previous one, so you can very quickly reach pretty large numbers of tiles which can take a very
long time to generate and require a lot of disk space.

Purchase Information & Product Page160

4.3 How to Remote Software Provisioning via OTA
OTA (Over-The-Air) is another powerful feature DeviceOn provides. Users can deploy software
packages onto a device remotely, or even many devices broadly. This lab guides you how to accomplish
remote software provisioning via OTA. And, after this lab, you should:•

Learn how to remote provisioning your software via OTA on demand.

•

Learn how to package your software for remote provisioning.

•

Have the NotePad++, a popular and famous text editor, populated within the target device.

4.3.1 Prerequisite•

A running DeviceOn server.

•

A device which running on Windows operating system and installed WISE-Agent, that connects
to DeviceOn server.

•

A running, with well configured, FTP server as the storage.

•

A NotePad++ installer, 32-bit edition is recommended. Its name is “npp.7.8.2.Installer.exe”,
something like that. It can be downloaded from https://notepad-plus-plus.org/downloads/.

•

Automation skills to install target software package. It is because that user intervention is notpossible during provisioning via OTA. For Windows it can be batch file or power shell, while for
Ubuntu it may be shell scripts.

4.3.2 Step-by-Step

Purchase Information & Product Page

161

Step 1: Click “OTA” from the menu on left hand side. It leads you into the “Storage” page.

Step 2: In “Storage” page, click the plus (+) sign. This step leads you into the “Add New Storage”
page. You have to add a new storage to upload new packages.

Step 3: Fill all fields in with proper values like following:•

SOTRAGE: Pick “FTP” from the dropdown lists.

•

Security: Leave it as “NONE”, the default value. If your FTP server running on FTPS protocol,
pick “FTPS”.

•

SOTRAGE NAME: Enter “MyFTP”.

•

DOMAIN: Enter the FQDN of your FTP server, or its IP address.

•

PORT: Should be 21 if the FTP server runs on a standard port number.

•

ACCOUNT NAME: A valid username that can connect to the FTP server, and upload files onto
the server as well.

•

PASSWORD: The password to login.

•

CMC/SMC: Use defaults.

•

ROOT PATH: Simply uses “/”.

Purchase Information & Product Page

162

•

DESCRIPTION: Leave it empty. It’s optional information.

Finally, click “Save” button to finish this step. If it goes well, you should see a new table row regarding
this FTP storage populated in “Storage” page.

Step 4: An extra step we need to execute prior to next step: prepare a valid package for OTA.
DeviceOn provides users a toolkit to pack all stuff to be a valid OTA package.
1.

Create a new folder names “NPP” in, say, your desktop.

2.

Move the downloaded file “npp.7.8.2.Installer.exe” into.

3.

Create a new file “install.bat”, contains only start /wait npp.7.8.2.Installer.exe /S, inside.
This command, per its document in official web site, installs the downloaded NotePad++
software silently.

Purchase Information & Product Page

163

Step 5: Now click the “Package” item. And, then, choose “MyFTP” from “STORAGE” field. Last, click
the “Package Toolkit” icon to enter “Package Toolkit” page.

Step 6: In “Package Toolkit” page, fill all mandatory field up with proper values. At last, click“Generate” button to package “NPP” software, and upload onto “MyFTP” storage as well.
•

Package Type: Fill “NPP” up.

•

Package Version: Fill “1.0.0.0” up.

•

Device Group: Choose “Default”.

•

DEVICE: Choose the target device. “AA-Win” in this lab environment.

•

SOURCE DIR: Click “Browser” to point to the location of “NPP” folder we created in step 4.

•

DEPLOY FILE: DeviceOn chooses “install.bat” for you.

•

STORAGE: Choose “MyFTP” from dropdown list.

Purchase Information & Product Page

164

Step 7: Now, in “Package” page, a new one table row represents the “NPP” package has been
added.

Step 8: It is time to install NotePad++ onto the target device remotely. Based on previous step, click“Upgrade” tab next to “Package” tab. You should find the target device shows there within the tableview. Click the icon locates in target device row and “UPGRADE” column. It leads you into the“Upgrade Operation” page.

Purchase Information & Product Page

165

Step 9: In “Upgrade Operation” page, fill “NPP” up in “KEYWORD SEARCH” field so that the
package can be filtered out of all packages. Check the box accordingly and click “FONFIRM”
button.

Step 10: Now the NotePad++ should been be installing and, after a while, if everything went well, a
corresponding application item should be created in Windows menu.

Purchase Information & Product Page

166

4.4 How to Set a Device Threshold and Event Notify Services
For devices monitoring, DeviceOn provides the rule engine. Users can acquire anomaly situations bymeans of setting thresholds to those interested devices, and, once one or more thresholds meets,
receive alerts via event notification services, another one indispensable feature for users. This lab
guides you how to set thresholds to a device and how to set event notification services as well. As
such, after this lab, you should:•

Learn how to set thresholds to a device on demand.

•

Learn how to set event notification services, including email, LINE, and WeChat as well.

4.4.1 Prerequisite•

A running DeviceOn server.

•

A device that installed WISE-Agent connects to DeviceOn server.

•

A valid, send-able, email account to enable Email notification service.

•

A valid LINE account to enable LINE notification service.

•

A valid WeChat account, as well as a valid GitHub account, to enable WeChat notification
service.

4.4.2 Steps to Set Event Notification Service – EmailThe configuration of using email as one of event notification services is a system-wide setting. Thismeans DeviceOn uses the server, the one you set in this step, to send all emails. Therefore, uses email
settings from your organization is recommended, rather than uses your personal Gmail. If you reallywant to use Gmail, the situations you are running into may vary and depends on your google account

Purchase Information & Product Page

167

settings. So, in this lab, we assume that you have already a valid business email address from yourcompany.
Step 1: Click “Setting” menu on the left-hand side of DeviceOn portal and, then, “Notification”. Click“EMail” bar to open settings regarding email notification service.

Step 2: Toggle “On/Off” switch to enable this feature. Then fill fields up with proper values. And end
up this step by clicking “Test” button.
•

EMAIL SERVER: The email server host name.

•

PORT: The email server port. Normally this is 25.

•

SSL/TLS: Toggle to a proper setting.

•

EMAIL ACCOUNT: Your email account name. If takes the windows domain into account, a value
format like “DOMAIN\USER” should be used.

•

EMAIL PASSWORD: Your password to sign in to the email server.

•

SENDER EMAIL: Your email address.

•

EMAIL SUBJECT: Leave it the default.

Step 3: To assert all values are correct, click “Test” button, on the bottom right of the page, to open
the “Send Email for Testing” dialog for testing purpose. And fill a recipient email as well as email body.
Purchase Information & Product Page

168

Then click “Test” on this dialog. An email you should receive in a while later. Revise them until you got
a test email.

Step 4: Click “Save” on the bottom right of the page that shows in step 2 to keep all settings andenable email notification service.
4.4.3 Steps to Set Event Notification Service – LINE

Step 1: Go to https://notify-bot.line.me/ and sign in with your LINE account. Click “My Page” fromyour account’s dropdown menu in the upper right of the page.

Step 2: Click “Generate token” under “Generate access token (For developers)”. It pops up the“Generate token” dialog.

Purchase Information & Product Page

169

Step 3: Fill token field up with “DeviceOn” and click the “1-on-1 chat with LINE Notify” item. Thenclick the “Generate token” button in green at bottom.

Step 4: A new window pops up with token. Meanwhile, a LINE message about this token generation
received immediately. Click “Copy” to keep the token in memory, or any file you like.

Purchase Information & Product Page

170

Step 5: Now switch your browser to DeviceOn portal. Click “Setting” menu on the left-hand side, then“Notification”, and last “LINE” bar to open settings regarding LINE event notification service.

Step 6: Toggle “On/Off” switch to enable this feature. Click “Test” to show the test dialog up.

Step 7: Paste the copied token into the first field (LINE Token) and write something into the second
field (LINE Message Content). Click “Test”, you should receive the messages you wrote with
“DeviceOn” as the prefix.

Purchase Information & Product Page

171

Step 8: Click “Save” button that shows in Step 6 to keep your settings and enable LINE event
notification service.
4.4.4 Steps to Set Event Notification Service – WeChat

Step 1: Go to http://sc.ftqq.com/3.version. Click “登入网站” hyperlink.

Step 2: Sign in with your GitHub account.

Purchase Information & Product Page

172

Step 3: Click “微信推送” hyperlink.

Step 4: Click “开始绑定”. It opens a QR code image.

Purchase Information & Product Page

173

Step 5: Take your mobile up, swipe and open WeChat App to scan this generated QR code so that theservice can bind with your WeChat account.

Step 6: Once it is done. The page changes, like below.

Step 7: Click “SCKEY” hyperlink and copy, from the opened page, the SCKEY value.
Purchase Information & Product Page

174

Step 8: Now switch your browser to DeviceOn portal. Click “Setting” menu on the left-hand side, then“Notification”, and “WeChat” to open settings regarding WeChat event notification service.

Step 9: Toggle “On/Off” switch to enable this feature. Click “Test” to show the test dialog up. Paste
the copied SCKEY, copied in step 7, into the first field “WECHAT SC KEY”. Give a title to the second
field “WECHAT MESSAGE TITLE”. Write some message content to the last field “WECHAT MESSAGE
CONTENT”. And click “Test” to see if it works or not.

Purchase Information & Product Page

175

Step 10: Click “Save” button that shows in step 9 to keep your settings and enable WeChat event
notification service.
4.4.5 Steps to Set Event Notification Service – Telegram

Step 1: Search “BotFather” and start to chat on your Telegram App.

Step 2: Create a new bot and generate an authorization token.
Use the /newbot command to create a new bot. The BotFather will ask you for a name and username,then generate an authorization token for your new bot. The name of your bot is displayed in contact
details and elsewhere.
The Username is a short name, to be used in mentions and t.me links. Usernames are 5-32 characterslong and are case insensitive, but may only include Latin characters, numbers, and underscores. Your
bot's username must end in 'bot', e.g. 'tetris_bot' or 'TetrisBot'.
The token is a string along the lines of 110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw that isrequired to authorize the bot and send requests to the Bot API. Keep your token secure and store it
safely, it can be used by anyone to control your bot.

Purchase Information & Product Page

176

Step 2: Create your private channel on Telegram

Step 3: Invite your bot into the channel.

Step 4: Set your bot as “Administrators”

Purchase Information & Product Page

177

Step 5: Enter any txt message in the channel.

Step 6: Retrieve the chat id via below URL with your authorization token (Step 2).
 https://api.telegram.org/botTOKEN/getUpdates
The response that include your chat id as below example.

Step 7: Now switch your browser to DeviceOn portal. Click “Setting” menu on the left-hand side, then“Notification”, and “Telegram” to open settings regarding Telegram event notification service.
Purchase Information & Product Page

178

Step 8: Toggle “On/Off” switch to enable this feature. Click “Test” to show the test dialog up. Paste
the copied Token and chat id, copied in step 2 and step 6. Give a title to the second field “Telegram
Message Content”. Write some message content to the last field “Test”. And click “Test” to see if itworks or not.

Step 10: Click “Save” button that shows in step 8 to keep your settings and enable Telegram event
notification service.
4.4.6 Steps to Set Event Notification Service – Microsoft Teams

Step 1: In the function menu of the channel where you want to send the message, select...(Other),and select the connector in the menu.

Purchase Information & Product Page

179

Step 2: Select “Incoming Webhook”

Step 3: Give this connector a name, then press the create button

Step 4: At this time, a set of URLs will appear, which are used to transfer message. After copying,
Purchase Information & Product Page

180

press the “Done” button.

Step 5: Now switch your browser to DeviceOn portal. Click “Setting” menu on the left-hand side, then“Notification”, and “Microsoft Teams” to open settings regarding Teams event notification service.

Step 6: Toggle “On/Off” switch to enable this feature. Click “Test” to show the test dialog up. Paste
the URL, copied in step 4. Give a title to the second field “Microsoft Teams Message Content”. Write
some message content to the last field “Test”. And click “Test” to see if it works or not.

Step 7: Click “Save” button that shows in step 6 to keep your settings and enable Microsoft Teams
event notification service.
4.4.7 Steps to Set Event Notification Service – Slack
Purchase Information & Product Page

181

Step 1: Create your channel on your Slack.

Step 2: Give this channel name and set as private.

Step 3: Skip or add your member into channel.

Step 4: After logging in to slack, there will be a row of menus on the right, click "Apps" to expand the
sub-menu, and then click "Add Apps"

Purchase Information & Product Page

182

Step 5: A search box will appear, type "webhooks" and you will see the first result is "Incoming
WebHooks", then click to install and “Add to Slack”.

Step 6: Click "Add to Slack", and a menu will appear asking which channel to install on. After selecting
it, click "Incoming WebHooks integration".

Purchase Information & Product Page

183

Step 7: After installation, you will enter the setting page of incoming webhooks. The first line of thepage "Webhook URL" is the most important. We can send out automatic notification messages aslong as we post to this url.

Step 8: Now switch your browser to DeviceOn portal. Click “Setting” menu on the left-hand side, then“Notification”, and “Slack” to open settings regarding Slack event notification service.

Step 9: Toggle “On/Off” switch to enable this feature. Click “Test” to show the test dialog up. Paste
the URL, copied in step 4. Give a title to the second field “Slack Message Content”. Write somemessage content to the last field “Test”. And click “Test” to see if it works or not.
Purchase Information & Product Page

184

4.4.8 Steps to Set Thresholds to a Device

Step 1: Click “Setting” menu on the left-hand side of DeviceOn portal and, then, “Rule Engine”, click
the plus (+) sign to enter “Rule Engine” page.

Step 3: Choose each setting with a proper value within step 1 – Select Sensor.
•

SELECT RULE TYPE: Shows the new rule engine applies to a single device or a device group.
Please pick “Device” here.

•

SELECT DEVICE GROUP: Also, leave it the default, “Default”.

•

SELECT DEVICE: Which device the new rule engine will apply? We choose “AA-Win” in this lab
environment.

•

KEYWORD SEARCH: Please enter “hard drive” so that only hard drive relevant items available.

Purchase Information & Product Page

185

Here, to ease this lab, we pick “Hard Drive Free Space” as a threshold of the rule engine. In addition,
like the picture shows, it illustrates the disk C is the target hard drive in this lab. Click “Next” to go tonext step.

Step 4: Now we need to define a threshold for this rule engine in this step. Based on “Current Value”
shows on top right, check the “Less than” radio button and slide to a maximum value that just on lessthan “Current Value”.
Leave “Lasting Time” as well as “Notice Interval” the defaults. “Lasting Time” indicates that the target
device runs into the abnormal condition only when it reaches the set threshold and last the set time.
While “Notice Interval” tells the interval of users receive an event, until the condition back to normal.
Then click “Next” to go to next page.

Step 5: We are now in “Define Action” step. Pick “Power On/Off” from “TAKE A ACTION”, “System
Restart” from “TAKE A SUB ACTION”, and “Back to Normal” for “Trigger Frequency”. These
combination means that the target device will reboot once it backs to normal, after it enters thethreshold we set. Also, click “Next” to go to next page.
Purchase Information & Product Page

186

Step 7: Review all information within this page. Leave “Enable” the default and click “Confirm” button
to set this rule, and apply it to the target device as well.

Step 8: The new item should be populated as the image shows.

Step 9: Click “Device” menu item on left hand side of DeviceOn portal. You can see a green circle
represents the target device accordingly.
Purchase Information & Product Page

187

Step 10: We can do something so that the target device meets the threshold we set previous. Here
we download the newest Ubuntu ISO image to the target device. The green circle shows in step 9changes, a while later, to an orange one, of which indicates it runs into an abnormal condition.

Step 10: Interrupt the download action at any time, or wait until it finishes. Purge the downloaded
file so that the target device has free space more than the threshold we set previous. After a while,the target device should reboot due to the rule engine we set. Note here that it may necessary topurge the recycle bin to achieve our goal.

4.5 How to Visualize Device Data via Grafana Dashboard
Grafana is an open-source software for monitoring and analysis. One of its major characteristics is it
supports many different data sources, from popular CloudWatch, Elasticsearch, Graphite, andinfluxDB, to OpenStack Gnocchi or Google Calendar. Its range is very extensive. However, for others
data source require to implement SimpleJson to access your data. The DeviceOn native support
SimpleJson APIs and data source plugin on Grafana. This lab guides you how to visualize device data
via Grafana dashboard.
4.5.1 Prerequisite•

A running DeviceOn server.

•

A running Grafana service with DeviceOn data source plugin.

•

A device which installed WISE-Agent, that connects to DeviceOn server.

4.5.2 Step-by-Step

Step 1: Launch Grafana Web Service Shortcut on Desktop, or access the Grafana service endpoint.

Purchase Information & Product Page

188

Step 2: Login to Grafana portal with your account, password (Default: admin/admin)

Step 3: Create a data source to access DeviceOn SimpleJson API.

Click on “Add data source” and select “DeviceOn-SimpleJson”, (for previous version might be RMMSimpleJson)

Purchase Information & Product Page

189

Step 4: Given below parameters for data source plugin to retrieve device data from DeviceOn APIs.
URL: http://<DEVICEON_SERVER>:8080/rmm/v1/grafana/simplejson
Access: Browser
Auth: Basic Auth (Support on prefecture version)
Basic Auth: DeviceOn Account & Password

Step 5: Create a dashboard to visualize your device data.

Purchase Information & Product Page

190

Select “Add Query” for your device.

Select DeviceOn-SimpleJson from “Queries to”, and pick-up your device with AgentID, Plugin, Sensor
and Alias Name (Option).

4.6 How to Enable/Disable Windows Lockdown Features
For devices protection, Windows built many nice features in natively. For instance, function key
protection disables Ctrl, Alt, and WinKey. UWF protection guarantees your disk C (System Partition)
rollbacks to the original state after you reboot the Windows operating system. This lab guides you
Purchase Information & Product Page

191

how to enable Windows lockdown features, and how to active/inactive them via DeviceOn portal.
After this lab, you should:•

Learn how to enable “Keyboard Filter” and “Unified Write Filter” (a.k.a. UWF) in Windows
lockdown features.

•

Know what lockdown features can be controlled via DeviceOn portal.

4.6.1 Prerequisite•

A running DeviceOn server.

•

A device which running on Windows 10 operating system (LTSB, LTSC) and installed WISEAgent, that connects to DeviceOn server. Besides, this agent must install Advantech SUSI
driver, or lockdown feature should not work properly.

4.6.2 Step-by-Step

Step 1: Go to the target agent device and open the file explorer window. In address bar, key “Control
Panel\All Control Panel Items\Programs and Features” in and followed by pressing “ENTER”. It opens
the “Programs and Features” window.

Step 2: Click “Turn Windows features on or off” on left hand side to open “Windows Features”
window.

Step 3: Scroll down the window, find and open the “Device Lockdown” item. Make sure both
“Keyboard Filter” and “Unified Write Filter” are checked. Then click “OK”.

Purchase Information & Product Page

192

Step 4: Now back to DeviceOn portal. Click “Device” menu item, then “Remote Control” tab. And
choose proper account, group, and device from “SELECT ACCOUNT”, “SELECT DEVICE GROUPS”, and“SELECT DEVICE” fields accordingly. You can see “Function Key”, “UWF Protection” control buttons
there. Also, other than these two mentioned, “WatchDog Protection”, “Windows Notification” andmore relevant features are available as you can see.

Purchase Information & Product Page

193

Step 5: Click “Function Key” control button. You would find, after a while, the description of “Function
Key” changes from “Available” to “Ctrl, Alt, WinKey Lockdown”. If you try to press such keys on thetarget device, they should not work as expected. Okay, you learned how to enable, disable “Function
Key” lockdown. Let’s go ahead and learn something regarding UWF.
Step 6: Click “UWF Protection” control button. A dialog pops up and the message shows that thisaction will reboot the device. Click “CONFIRM”, its description changes from “Disabled” to “Enabled”.
Just wait for the reboot completed.
Step 7: Now, write some data into disk C. You can, for example, download files into disk C, copy files
into disk C. Or even generate by programmatically. Just do whatever you can do to mimic that you areworking on disk C.
Step 8: Once you finish your tasks, reboot the target device. You would find that all those data you
made at previous step disappear. The disk C rollbacks to the original state and just like you did nothingat all.

4.7 How to Deploy & Manage DeviceOn on AKS
With more and more IoT devices in the field and the need for remote management and monitoringof those devices, the most important thing is how to achieve secure and fast onboarding to WISEDeviceOn. Second, how to serve 1k, 10k, 100k or millions of devices in a system and ensure the data
is secure.
Today more than ever, privacy is of critical importance in the technology industry. Microsoft has an
enduring commitment to protect data privacy, not as an afterthought, but built into Microsoft Azure
from the ground up. Microsoft designed Azure with industry-leading security controls, compliancetools, and privacy policies to safeguard your data in the cloud, including the categories of personal
data identified by the GDPR. These also help you comply with other important global and regional
privacy standards such as ISO/IEC 27018, EU-U.S. Privacy Shield, EU Model Clauses, HIPAA/HITECH,
and HITRUST.
When you build on Azure’s secure foundation, you accelerate your move to the cloud by achieving
compliance more readily, allowing you to enable privacy-sensitive cloud scenarios.
Learn more on the Service Trust Portal about how Microsoft can help you meet GDPR requirements.
Read more about our steadfast commitment to privacy at Microsoft.

Purchase Information & Product Page

194

4.7.1 Prerequisite

To achieve the goal to deploy WISE-DeviceOn, some resources must be acquired, and preconditions
must be met as well.
•An active Azure subscription.

•

An Azure CLI installed on your laptop, please refer to Azure documentation to download andsetup. The Azure CLI is available to install in Windows, macOS and Linux environments. It canalso be run in a Docker container and Azure Cloud Shell.

•

Second option, if you don’t want to install Azure CLI, you can also adopt Azure Cloud Shell,
please refer to Microsoft documentation.

•

A WISE-DeviceOn ARM template prepared.

4.7.2 Steps to Deploy DeviceOn to AKS by ManualThis document tries to describe, and guide you, how to deploy WISE-DeviceOn on Azure cloud. The
version is focused on Azure PaaS components to integrate to provide security, scalability, and highavailability. Microsoft Azure provides lots of cloud services with security, scalability and high available.
Based on Azure PaaS solutions, DeviceOn could focus on functionalities for device management anddata acquisition. We fully integrate with below services:•

Azure Application Gateway (WAF protection and traffic load balancer), Optional•

Kubernetes (Container Management)•

Azure AD (Authentication), Optional•

Cosmos DB, Azure PostgreSQL (Database)•

Azure Function, IoTHub (Secure Device Connection)

Purchase Information & Product Page

195

•

Stream Analytics, Event Hub, Service Bus (Message Bus and Filter)

When you build on Azure’s secure foundation, you accelerate your move to the cloud by achieving
compliance more readily, allowing you to enable privacy-sensitive cloud scenarios, such as financial
and health service, with confidence.
Step 1: Obtain the following three parameters for deployment.
•

Application ID•

Password (Client Secrets)•

Tenant ID
1.

Sign into your Azure account through Azure CLI

Use any way you prefer to open a Command Prompt and enteraz login

Note: If the CLI can open your default browser, it will do so and load a sign-in page. Otherwise, youneed to open a browser page and follow the instructions on the command line to enter anauthorization code after navigating to https://aka.ms/devicelogin in your browser. Sign in with youraccount credentials in the browser.
2.

Select your Subscription.

After you login, the terminal console will list all subscriptions, please select the subscription thatyou would like to deploy.
az account set --subscription <SUBSCRIPTION_NAME>

If you do not know which subscriptions you have, you can use below command to list all thesubscriptions and determine whether the subscription has been selected according to isDefault.
az account list --output table

Purchase Information & Product Page

196

3.

Create a service principal.

The last step to create a service principal and generate these parameters. (1. Application ID, 2.
Password and 3. Tenant ID)
az ad sp create-for-rbac --name <SERVICE_PRINCIPAL_NAME>

Step 2: Obtain the following three parameters for deployment.
Let’s start the deployment. After you log in to the Azure portal, adopt Deploy a custom template to
deploy the service automatically.
1. From the Azure portal menu, in the search box, type deploy, and then select Deploy acustom template.

Purchase Information & Product Page

197

2. Select Build your own template in the editor.

3. Select Load file, and then follow the instructions to load DeviceOn_Template.json or
copy/paste the json content to the editor.

4. Select Save.
5. Enter the following values:
Name
Resource
Group

Value
Select the resource group name you created in the last section.

Purchase Information & Product Page

198

Name

Value

RegionSelect a location for the resource group. For example, Southeast Asia.

Application Id

The application Id is obtained from Step 1.

Password

The password is obtained from Step 1.

Tenant Id

The tenant Id is obtained from Step 1.

Email

After deployment, the result/progress will be sent to this email
Enter the location name according to the data center. for examle, Asia

LocationEast(eastasia), Asia Southeast(southeastasia), Japan East(japaneast), US
East(eastus), Europe North(northeurope)

IoTHub SKU

S1/S2/S3, the default is S1, you could adjust the tier from Azure Poral if need.

IoTHub Unitdefault is 1
Advantech hardware connection, enter N/A (free support for 1000 Advantech

Activate Key

devices), or please contact us to purchase license key for Non-Advantech
devices.

Purchase Information & Product Page

199

6. Select Review + create
7. Validation and start to create.

Purchase Information & Product Page200

8. The entire deployment process takes about 30 minutes. After completion, you will receive amail notification. The content of the mail includes the DeviceOn web Service IP and login
Account password.

Purchase Information & Product Page

201

Assuming that your mail is intercepted/block or not received due to mail server filters, wewill synchronously write this information to the Azure Blob Log container. Go to yourresource group (you entered at the stage of deployment) storage account -> container -> Log-> ServerInformation.log. If the container has not been created, please wait a few minutes
for initialization.

Purchase Information & Product Page202

9. There are two resource group generated on your subscription, one is you entered at the stageof deployment, which include the services such as: AKS, IoTHub, EventHub, Stream Analytics,
CosmosDB, PostgreSQL…etc. Another resource group name prefix name starts with MC_,
that contains AKS VM node.
4.7.3 Steps to Upgrade DeviceOn

Step 1: Login to Azure Portal and Redirect to Your Resource Group
Select deviceon-upgrade-aci

Purchase Information & Product Page

203

Step 2: Run the Azure Container Instance
Click Start button to check and upgrade DeviceOn container to the latest version.

After running, the service (deviceon-upgrade-aci) will automatically check and update the DeviceOnin your AKS. At the end, this service will stop.

Step 3: Check your DeviceOn Verison
Please go to your DeviceOn portal to confirm the version updated. If the version has not changed, itmeans that it is the latest version.

Purchase Information & Product Page

204

4.8 How to Batch Provision to Your Devices
WISE-Agent will connect to DeviceOn server through Credential URL and IoT Key and those setting inagent_config.xml, if you have many devices (that has WISE-Agent in it) need to connect to the server,
it takes time to modify agent_config.xml in each device. Here, we build-in the “Local Provision” Pluginto speed up this process. You will learn how to trigger all local devices to connect to the server withthe same Credential URL and IoT Key.
The WISE-Agent local provision plugin will send Credential URL and IoT key to other local agent devices,and the local agent devices can connect to the server successfully. In following figure, you can send
trigger command to make device A and B connect to a server with a Windows GUI tool.

4.8.1 Prerequisite⚫

All devices must install WISE-Agent in it.

⚫

All devices and the control PC must in the same local network (The multicast packet will not
be filtered)⚫

All devices have the capability to connect to DeviceOn server.

4.8.2 Steps to Local Provisioning

Purchase Information & Product Page

205

Step 1: Download and unzip the local provision GUI tool.
Step 2: Place valid “agnet_config.xml” file (with correct Credential URL and IoT Key) to “GUItool\resources\tools” folder

Step 3: Double click “LocalProvision.exe”

Step 4: Click Discover button

Purchase Information & Product Page206

If windows display a firewall dialog, please click allow to enable TCP server permission in tool.

Step 5: Wait for 10 second and then you can get the devices on checkbox list.

Purchase Information & Product Page

207

Step 6: Pick-up the device that you would like to connect to the server and click Active.

Purchase Information & Product Page

208

Until now, the checked devices should connect to server after few second later.
4.8.1 Troubleshooting

Why can’t I find some WISE-Agent devices? Please help check following:

Purchase Information & Product Page

209

A.

Please check if your local provision plugin is enabled.

Open the module_config.xml in “Installation path\module\” to check if local provision handler isenabled.

B.

Please check if your device and windows PC is in the same local network and can transfer
multicast packets.

C.

Because the local provision discovers WISE-Agent by UDP port 9178 and TCP port 9177, pleasecheck if your IT block these ports in your local network.

4.9 How to Secure Connect to DeviceOn though X.509
This section tries to teach you how to connect DeviceOn server through x509. There are two topics
we will cover through this document. The first part will show you how to get the credential files from
DeviceOn server. Another part will show you how to configure WISE-Agent and make it connect
DeviceOn sever through x509.
4.9.1 Prerequisite⚫

Your operation system should install the following software.

◼

DeviceOn Server that is greater than version 4.4.2◼

WISEAgent◼

OpenSSL

Purchase Information & Product Page

210

4.9.2 Steps to Generate the Credential Files

In this session, you will learn how to create a private key file with OpenSSL command line tools. You
can upload the created private key file to DeviceOn server and then download the zip file from server.
To understand this SOP, you should have the knowledge of the following topics:⚫

Generate the private key file with OpenSSL command line tool.

⚫

Get the credential files from DeviceOn server.

Step 1: Press Win+X to open the Command Prompt.
Step 2: Navigate to the OpenSSL bin directory.
Step 3: Enter the following command to generate a private key:
openssl.exe genrsa –out private_key.pem 2048

Step 4: Once complete, you will find the name private_key.pem that under the directory.
4.9.3 Steps to Download the Credential Files from DeviceOn Server

Step 1: Sign in to the DeviceOn server portal.
Step 2: From the menu on the left, under Settings, select System.
Step 3: On the right panel, extend Certificate, select Upload and browser the private key file that you
created before.

Purchase Information & Product Page

211

Step 4: If anything well, you should get a zip file named Certificate-xxxx-xx-xx.zip.

Purchase Information & Product Page

212

Step 5: Extract the zip file. There are two files in the zip. One is the client credential files named
certificate.pem and another is the root certificate ca.pem.

4.9.4 Steps to Configure the Setting of WISE-AgentIn this session, you will learn how to configure the WISE-Agent and make it connect DeviceOn server
through the credential files that generated previously.
To understand this SOP, you should have the knowledge of the following topics:⚫

Where the agent’s configuration file is.

⚫

Adjust the agent’s settings for connecting DeviceOn server through x509.

Purchase Information & Product Page

213

Step 1: Open the agent_config.xml that existed in the installation folder of WISE-Agent.
Step 2: Copy the credential files to a folder outside the WISE-Agent installation path. They should
contain three files. Just like the following picture

Step 3: Open agent_config.xml with your familiar editor. There are four tags which you should adjust.
They are TLSType, CAFile, CertFile and KeyFles.

Step 4: Configure the TLSType, CAFile, CertFile and KeyFile as below.
•

TLSType to 1.

•

CAFile to <Credential Path>\ca.pem•

CertFile to <Credential Path>\certificate.pem•

KeyFile to <Credential Path>\Private_Key.key

Purchase Information & Product Page214

Step 5: Save agent_config.xml and reconnect to server. If anything goes well, the WISE-Agent should
show connected.

Purchase Information & Product Page

215

5. DeviceOn Development Guide
5.1 WISE-Agent Plugin Development
Advantech provides an edge software tool to communicate and exchange information between IoT(Internet of Thing) devices and DeviceOn cloud, called a WISE-Agent. The WISE-Agent not only
provides a rich set of users friendly, intelligent, standardization and scalability.
⚫

Standardization
The communication protocol is based on the MQTT protocol to communicate and exchange
data with DeviceOn cloud. The IoT sensor data report format is following the IPSO Alliance.
in JSON format.

⚫

Portability
The whole framework is written in C language and follow the ANSI C Standard that C
compilers are available for most systems and are often the first compiler provided for a new
system, such as OpenWRT, Yacto and Linux based system.

⚫

Scalability
The WISE-Agent is modular design and offering plugin concept to Plug & Play (PnP) which is
one with a specification that facilitates the discovery of a Plugin in a system without the needfor a physical device to advanced configuration or user intervention in resolving resource
conflicts.

Besides the basic device connectivity, the WISE-Agent provides an advanced heartbeat solution tosynchronize device status. On the different network environment, how to keep your device data
without loss? The WISE-Agent has built-in “Data Synchronization” to avoid and overcome thedisconnect for a long time. For various protocols, we offer a plugin SDK, users only focus on how toretrieve the data, do not worry about the connectivity and stability.
5.1.1 WISE-Agent Architecture

WISE-Agent includes two parts, one is the Core Framework and Plugins.

Purchase Information & Product Page

216

⚫

Core Framework
The main library used to communicate with WISE-PaaS IoTHub or standard MQTT broker andinclude below components.


Platform Profiler: describes the target platform (e.g., OS version, SN, Device name,
MAC address)Configuration: describes how to connect to MQTT broker (e.g., Credential URL, IoTKey,
TLS/SSL settings)

Core Manager: integrates and manages the resources and keeps them alive.

Core Command: responsible for handling commands that interact with internal
components (e.g., rename, update, get capability, auto report start/stop)

Plugin SDK: A plugin framework that makes plugin implement more easily.

Keep Alive: A component to detect the connection between WISE-Agent and
DeviceOn Server.



Data Synchronization: kernel plugin that caches and restores data to ensure zero
downtime.



Rule Engine: kernel plugin that supports the threshold rule check and then sends
event or trigger actions



Plugin Loader: responsible for loading and managing plugins indicated inmodule_config.xml⚫

The plugins

Purchase Information & Product Page

217

The plugins include IPC monitoring (Advantech Hardware, HDD/SSD, Networks,
Process…etc.), control function (Backup/Recovery, Protection, Remote Desktop, Terminal…),
and sensor protocol collection. Following are the list of supported plugins in WISE-Agent.


SUSI Control: Monitoring and Control Advantech Hardware Platform

HDD Monitoring: Monitoring Hard Drives (HDD, SSD) Usage, Healthy and S.M.A.R.T
Information, especially for Advantech SQFlash.

Network Monitoring: Monitoring Network Interface Usage, Throughput…

Process Monitoring: Monitoring System Process Status, CPU, Memory Usage.

Power Management: Remote Control Power On, Off, Reboot, Sleep, Hibernate.

Backup/Recovery: Remote Backup/Recovery System via AcronisProtection: Remote System Protection via McAfeeRemote Desktop: Remote Desktop via VNC Viewer

Remote Terminal: Remote Terminal CommandRemote Screenshot: Remote Screenshot on Current ScreenOTA (Over-the-Air): Remote Software, Firmware Update

System Program Monitoring: System Program Information

Embedded Control: Advanced Control (UWF, USB Lock, Keyboard Filter, …etc.) for
Windows 10 Embedded, LTSC, LTSBHDD Prediction: Build-in Hard Drives (HDD, SSD) Failure Prediction ModelModbus: Modbus Device Data GatheringService Plugin: Bridge Southbound Device Service

5.1.2 Prerequisite⚫

Visual Studio 2019 for Windows Plugin⚫

Android NDK for Android Plugin⚫

A WISE-Agent that is running on your system.

5.1.3 Develop a Plugin on Windows Environment

Step 1: You can configure Visual Studio across your organization with installation configuration
files, .vsconfig

Purchase Information & Product Page

218

Step 2: Download SRP-Plugin,https://gitlab.edgecenter.io/ei-paas-edge-connect/SRP-Plugin
Step 3: Open SRP-Plugin solution file, SRP-Plugin-V2015.sln

Purchase Information & Product Page

219

Step 4: Click OK to update the SDK and Toolset for current compile environment

Step 5: You can implement new plugin base on plugin sample project.

Purchase Information & Product Page

220

Step 6: It is more easily to create a new plugin by Web-Simulator tools. Web-Simulator is an auxiliary
tool that helps you quickly simulate data on the cloud via MQTT over WebSocket (network port: 15675)
and directly generate the corresponding code. Following step will introduce how to create a newplugin by Web-Simulator tools. If you want to know exactly how this tool is used, you can refer WebSimulator QuickStart.
Step 7: Download Web-Simulator tools.
Step 8: The sample code can be generated in the fourth step. Please save it as handler_data.c andreplace it in the “SRP-Plugin\Sample\HandlerSample” path.

Purchase Information & Product Page

221

Step 9: Right click the “HandlerSampe” project in Step 5 and choose “Solution”.
Step 10: Check output without error message. If appear error message, suggest to copy the error
message search in google or ask Advantech technical people.
Step 11: After successfully completing the compilation, you can find all the .dll files in below path
“SRP-Plugin\Debug\module”
Step 12: Download and install WISE-Agent for Windows. The default installation path is
C:\Program Files (x86)\Advantech\WISE-Agent
Step 13: After install the WISE-Agent, copy “HandlerSample.dll” file to“C:\Program Files (x86)\Advantech\WISE-Agent\module” folder.
Step 14: Modify module_config.xml on“C:\Program Files (x86)\Advantech\WISE-Agent\module\module_config.xml”⚫

Increase ModuleNum value in below line 3⚫

Add HandlerSample.dll item in below line 7.

Step 15: Reconnect WISE-Agent by “Server Connection” tools. Press “Disconnect” then “Connect”.
Purchase Information & Product Page

222

Step 16: Check if your plugin appears in DeviceOn Page, (Device -> Device Data -> PLUGIN)

5.1.4 Develop a Plugin on Linux Environment

Purchase Information & Product Page223

5.1.5 Multiple Languages Support in Linux Plugin

The DeviceOn handshake protocol only supports UTF-8 encoded string. WISE-Agent for Windows
platform will automatically convert the ANSI string to UTF-8 string. But in the Linux platform, plugin
developers need to maintain the string conversion with the iconv library themselves.
Step 1: Prepare the compile environment with iconv library. In some cross-compile, developers mayneed to download iconv source code and cross-compile yourself.
Step 2: Add iconv include into source code#include "iconv.h"

Step 3: Add Convert API into source code, the sample code is converted GB2312 to UTF-8
1 int GB2312ToUTF8(char* pOut, int iOutLen, const char* pIn, int iInLen)
2{
3

int len = -1;

4

char* inbuff = (char*) pIn;

5

char* outbuff = calloc(1, iOutLen);6

iconv_t cd;

7

size_t inlen = iInLen;

8size_t outlen = iOutLen;

910

cd = iconv_open("utf-8", "gb2312");11

if (cd==(iconv_t)-1)

12
13

return len;
len = iconv(cd, &inbuff, &inlen, &outbuff, &outlen);

14
15

return len;

16 }Step 4: Convert the multi-language string to UTF-8 before insert into JSON string
1 char utf8value[32] = {0};2 char gbvalue[32] = "some GB2312 string";
3
4 GB2312ToUTF8(utf8value, sizeof(utf8value), gbvalue, 4);
5 srand(time(NULL));
6 ret = createTagValJson(data, sizeof(data),
Purchase Information & Product Page

224

7

"pm2.5", TYPE_FLOAT( (double)(rand()%20) +8 (rand()%10)/10.0 ),// 0.0 ~ 20.0

9"enabled", TYPE_BOOL( (rand()%2==0)?false:true ),10"notify", TYPE_NULL(),

11"level", TYPE_INT(rand()%5), // 0~512"description", TYPE_STRING(utf8value),

13

NULL);

14 fprintf(stderr, "sensor json: [%s]\n", data);

Step 5: In Makefile, developers may need to add ‘-liconv’ in LDFLAGS
5.1.6 Develop a Plugin on Android Environment

Step 1: Download SRP-Plugin as Section 5.1.3 Step 2.
Step 2: In Plugin SDK (SRP-Plugin) folder, execute android_build.sh, where
•

CMD :

•

APP_ABI : x86, armeabi-v7a and so on-b : build,-c : clean

For example, to build an armeabi-v7a arch plugin you may enter:source android_build.sh -b armeabi-v7a &Step 3: You can find the release build file in“SRP-Plugin/~/obj/local/armeabi-v7a/libHandlerSample.so” folder.
Step 4: Copy libHandlerSample.so to DUT in the /system/lib/module/.
Step 5: Modify module_config.xml in DUT as 5.1.3 step 14 described.
Step 6: Check handler as 5.1.3 step 16 described.

5.2 DeviceOn UI Plugin Development
Actually, DeviceOn provide plenty of features to remote management, control to your edge devices,
but it’s hard to meet all domains application, such as, medical, traffic, energy system and etc.
Fortunately, DeviceOn provide APIs and Addins (web user interface) for users to develop their own
solution.
5.2.1 Prerequisite
Purchase Information & Product Page

225

•

Visual Studio Code V 1.4.1•

DeviceOn Server

5.2.2 Environment Setup

Step 1: Download Visual Studio Code v-1.4.1 and launch VSCodeUserSetup-x64-1.41.1.exe.

Step 2: Install Visual Studio Code, step by step.

Purchase Information & Product Page

226

Step 3: Install DeviceOn Server, if you don’t install DeviceOn Server before, please reference Section
2.2.
5.2.3 Develop a Sample Add-in

Step 1: Open DeviceOn Server folder and go to the installation path:\DeviceOn Server\server\portal\static\addins\SampleAddin.
Here are serval Add-in examples (*.html) that we provide, for your reference.

Purchase Information & Product Page

227

Step 2: Open Visual Studio Code -> Open the path:\DeviceOn Server\server\portal\static\addins\SampleAddin\

Step 3: Here are serval resources for you to develop your function.

Purchase Information & Product Page

228

⚫

CSS folder that include *.css style to describes how HTML elements are to be displayed onscreen, paper, or in other media.

⚫

js folder provides DeviceOnApis.js which is the API for get or set Data from Database on theserver and RMMGlobal.js which is the function to get or set the data from the local storageof Website.

⚫

libs folder provides simple library, if you need another library, please download from CDN.js
and place in this folder.

Step 4: Download sample code, there are two files (demo.html, demo2.html), please placedemo.html into “SampleAddin” folder.
Line 18 to 30 (demo.html) to include java script library, you could place your library in the relative
path, or alternatively, given library URL from CDNjs.

1. <!-- CDNjs-->
2. <script src="https://code.jquery.com/jquery.js"></script>
3. <script src="https://cdnjs.cloudflare.com/ajax/libs/twitterbootstrap/3.3.7/js/bootstrap.min.js"></script>

Step 5: Enable “AddIN” option from DeviceOn Server. (Setting -> System Menu -> ADDINS)

Purchase Information & Product Page

229

After the option is enabled, the “Addins” will appear in the menu item.

Step 6: Click on the “Setting” (Addins -> Setting) to add your Addins.

⚫

Name: Label name on the menu item⚫

URL: Relative path, /static/addins/SampleAddin/demo.html⚫

Icon: Reference Fontawesome site to get the string of icon

After that, the “demo” shown on the menu item, if not, please enable the “Addin” on Setting page.
Purchase Information & Product Page

230

Step 7: Click on the “demo” addins.

5.2.4 Develop an Add-in to Access DeviceOn API

This example will show you how to get all accounts, groups and devices.
APIs used on below sample
1.

DeviceOnApis.accounts.get.accounts(aid)

Purchase Information & Product Page231

To get all accounts information from database.
2.

DeviceOnApis.accounts.get.deviceGroups(aid)To get all groups which under this aid’s account from database.

3.

DeviceOnApis.devicegroups.get.devicesAll(data)
To get all devices which under this aid’s account from database.

4.

DeviceOnApis.devicegroups.get.devices(gid, data)
To get all devices which under this gid’s group from database.

Step 1: Download sample code, there are two files (demo.html, demo2.html), please placedemo2.html into “SampleAddin” folder.

Step 2: Line 10 ~22 (demo2.html) that describe library used in the Add-in.

Use single-select component to build demo view. (Line 27 ~ 57)
Purchase Information & Product Page

232

Use RMMGlobal() to get your login account ID (aid), through the aid as parameter to request API.

The API (DeiceOnApis.accouts.get.accouts(aid)) will send request to server, and return all accountdata.

Step 3: Add an Addin (demo2) as before steps.

Purchase Information & Product Page233

6. FAQ
6.1 General
6.1.1 How to Get DeviceOn Product Information & News?

You are welcome to visit the following pages for more information and experience on DeviceOn.
⚫

DeviceOn Product Page⚫

News & Solution Package

6.1.2 How to Get WISE-Agent Installer?

The WISE-Agent supports Windows 7 SP1, 8, and 10, you could download latest version from
DeviceOn portal, otherwise click here to get installer package. Please contact us to get Ubuntu x64
18.04/16.04 or others support.
6.1.3 How to Monitor Device Hardware Information?

The device hardware information includes FAN Speed, Voltage, Watchdog and brightness. Before
monitoring this information on DeviceOn, please make sure your device is Advantech hardware andwith SUSI driver support. Recommend to download SUSI driver from Advantech Support site for yourhardware platform first. Click here get the latest driver version.
Purchase Information & Product Page234

6.1.4 How to Purchase a License File for Non-Advantech Device?

Please contact Advantech sales and we will provide further assistance in the order process. After that,you will get a license key from the email.
6.1.5 How Do I Find My DevieOn License File?

When your purchase is complete you will receive an email with your license file from WISEMarketplace, this unlocks the on-premise version of WISE-DeviceOn.
6.1.6 How Many Devices Could be Managed on DeviceOn?

It depends on your server configuration. Taking the Azure DeviceOn VM specification, as an example,
the instance D2sV3 can manage 1000pcs devices. If you need to manage more than 1000 devices,
please contact us for advanced solution and architecture.
6.1.7 Does DeviceOn Support on Cloud?

Yes, the DeviceOn is listed on Azure and AWS Marketplace, it’s single console that can manage several
devices at the same time.
6.1.8 How to Deploy DeviceOn on Azure?

It is really simple that just login Azure Marketplace and search for DeviceOn, then follow the steps tocreate a virtual machine. Here is a Quick Start Guide to deploy through Azure Marketplace.
6.1.9 What Operating System Are Supported on WISE-Agent?

➢

Windows 7 SP1/8/10 32-bit/64-bit➢

Ubuntu 16.04, 18.04, 20.04 x64➢

Ubuntu Core➢

Ubuntu 18.04 on Nvidia Jetson➢

CentOS 7.7, 8.2 x64➢

Other Linux flavours (e.g. Yocto) on x86 or RISC (on a per project basis)➢

Android on RISC (on a per project basis)

6.1.10 Can DeviceOn Perform Bulk Operations on Devices Remotely?

Yes, group the devices for different attributes and set the task for each group, bulk operation can befinished.

Purchase Information & Product Page

235

6.1.11 Does DeviceOn Provide Integration Document for Customization?

DeviceOn offers easy customization with a complete REST API for core management on the serverside, and an SDK on the device side that enables the development of custom plugins.
6.1.12 How to Upgrade Software, Firmware via DeviceOn?

DeviceOn has OTA (Over the Air) function to remote provisioning and updates on firmware, driver,and software at the scale.
6.1.13 Does Azure Provide the Similar Service Compare with DeviceOn?

Azure offers “Azure IOT Central” which is the most similar with DeviceOn. But, DeviceOn is a solution
which already integrates many functions that is specialized in Device Management. Either “Azure
Monitor” or “Azure IOT Central” is actually part of the function of DeviceOn. If you are looking for the
total solution for your device monitoring/ troubleshooting, DeviceOn must be the best option.
6.1.14 Which Tier (Size) of Azure VM Should I Select and Cost Estimate?

It is recommended that users select D2sV3 (2Cores 8G RAM) to meet most cases, you may refer below
scenarios that we verified. The list price of VM, storage is based on Azure calculator and the data
center in Southeast Asia (Singapore)•

Case I, Standard IPC Device Management (Hardware, Network, Hard Disk, System),
25Tags/min

Azure VM Tier

D2sV5 (2 Cores 8G)($158.46/mo)

D4sV5 (4 Cores 16G)($316.87/mo)•

DeviceStorage

Number Required/mo

Storage Tier (HDD)
Recommended(Monthly Retention)

Price Estimation
VM + Storage (USD)/mo

10

1.09G

S6 (64G), $3.06/mo$161.52

100

8.22G

S6 (64G), $3.06/mo$161.52

500

39.9G

S10 (128G), $5.94/mo$164.4

1,000

79.5G

S10 (128G), $5.94/mo$164.43,800

302.1G S20 (512G), $21.81/mo$180.277,500

596.25G S30 (512G), $41.01/mo$357.88

Case II, Standard IPC Device Management (Hardware, Network, Hard Disk, System),
187Tags/min

Purchase Information & Product Page

236

DeviceAzure VM Tier

Numb
er

Storage
Required/mo

Storage Tier (HDD)
Recommended(Monthly Retention)

Price Estimation
VM + Storage (USD)/mo

10

4.692GS6 (64G), $3.06/mo$161.52

D2sV5 (2 Cores 8G)

100

44.22G

S10 (128G), $5.94/mo$164.4($158.46/mo)

500

219.9G

S20 (512G), $21.81/mo$180.272,400

1,061.28G

S40 (2,048G), $81.97/mo$240.43

4,000

1,759.2G

S40 (2,048G), $81.97/mo$398.84

D4sV5 (4 Cores 16G)($316.87/mo)•Case III, Data Collection, 15Tags/sec

Azure VM Tier

DeviceStorage

Number Required/mo

Storage Tier (HDD)
Recommended(Monthly Retention)

Price Estimation
VM + Storage (USD)/mo

10

21.18G

S10 (128G), $5.94/mo$164.4D2sV5 (2 Cores 8G)

100

209.1G

S20 (512G), $21.81/mo$180.27($158.46/mo)

300

626.7G

S30 (1,024G), $41.01/mo$199.47800

1,671.3G

S40 (2,048G), $81.97/mo$240.431300

2,714.7G S50 (4,096G), $163.84/mo$480.71

D4sV5 (4 Cores 16G)($316.87/mo)

6.1.15 How Can I Get Support?

In addition to browsing the user manual from technical portal to find answer to your questions,product support is available via email. Please contact below windows to get further information.
Product PM/RD: Rison.Yeh/Sephiroth.Wang

6.2 Technical6.2.1 Why Cannot the WISE-Agent Install? With error code 12007?

Purchase Information & Product Page

237

WISE-Agent requires the Microsoft Visual C++ Redistributable 2008, 2013, 2015 x86 packages, which
will be downloaded from the Internet and set up during the installation process. If you are in anenvironment with limited or no Internet access, please download the “Agent Dependency
Package” through an Internet connected device and install this package first.
6.2.2 Why does the installation UI not appear after I execute the WISE-Agent?

You see the “this file came from another computer and might be blocked” error when you try to open
a downloaded or transferred file from another computer. For instance, if you receive an email
attachment, the file might be blocked because it came from another computer.
When the file is not verified or not originated on your computer, Windows might block the file
execution for security concerns.
Now, this doesn’t happen to every file you download or transfer. However, depending on the file typeand file origin, Windows automatically triggers the security response. However, false positives canhappen. Fortunately, it is easy to unblock the file downloaded from another computer. In fact,
Windows even provides proper options to do so. Let me show you how.
⚫

In the General tab, you will see a new option at the bottom of the window. Select the Unblockcheckbox and click on the Apply button.

Purchase Information & Product Page

238

⚫

As soon as you click on the Apply button, Windows will unblock the file. The option will
disappear too. Click on the Ok button to close the window.

6.2.3 Why the WISE-Agent Cannot Download from Device Onboarding?

In order to allow users to obtain the latest and stable WISE-Agent, the DeviceOn team will place thelatest version on the cloud. When this message appears, it means that your server network cannot
access the cloud or does not have network connectivity.

Purchase Information & Product Page

239

You could download WISE-Agent through your mobile device or laptop and put it in the following path.
The file name must be “WISE-AgentSetup_x.y.z”.
Installation Path: \DeviceOn Server\server\portal\

6.2.4 Why the Acronis and McAfee failed to Install?

Since the installer package require .Net Framework 3.5 dependency, please help to confirm is .Net
Framework 3.5 installed on your devices.
6.2.5 Why Your SMTP Server Cannot Send a Mail?

Case I: Your DeviceOn service is deployed on Azure cloud and your SMTP server adopt port 25.
Starting on November 15, 2017, outbound email messages that are sent directly to external domains(such as outlook.com and gmail.com) from a virtual machine (VM) are made available only to certain
subscription types in Microsoft Azure. Outbound SMTP connections that use TCP port 25 were blocked.
(Port 25 is primarily used for unauthenticated email delivery.)This change in behavior applies only to new subscriptions and new deployments since November 15,
2017. Referenced site>
Case II: Always authentication failed through your Gmail account.
Step 1: Less secure apps & your Google Account.
Please enter to the page with your Google account and set it to Enable.
Step 2: Unlocking Google’s Gmail CAPTCHA
Purchase Information & Product Page

240

Please enter to the page with your Google account and click Continue.
6.2.6 Why Some of Devices Cannot Power On

REF: https://www.lifewire.com/wake-on-lan-4149800/
The DeviceOn leverage Wake-on-LAN (WoL) mechanism to remote power your device on, there are 2
steps to should be configured at first. Wake-on-LAN (WoL) is a network standard that allows acomputer to be turned on remotely, whether it's hibernating, sleeping, or even completely powered
off. It works by receiving what's called a "magic packet" that's sent from a WoL client.
It also doesn't matter what operating system the computer will eventually boot into (Windows, Mac,
Ubuntu, etc.), Wake-on-LAN can be used to turn on any computer that receives the magic packet.
A computer's hardware does have to support Wake-on-LAN with a compatible BIOS and network
interface card, so not every computer is automatically able to use Wake-on-LAN.
Two-step WoL Setup
Enabling Wake-on-LAN is done in two steps, both of which are described below. The first sets up
the motherboard by configuring Wake-on-LAN through BIOS before the operating system boots, andthe next logs into the operating system and makes some small changes there. The first step with theBIOS is valid for every computer, but after following the BIOS setup, skip down to your operating
system instructions, whether it be for Windows, Mac, or Linux.
Step 1: BIOS Setup
The first thing you need to do to enable WoL is to set up BIOS correctly so that the software can listen
for incoming wake up requests.
Every manufacturer will have unique steps, so what you see below may not describe your setup
exactly. If these instructions aren't helping, find out your BIOS manufacturer and check their website
for a user manual on how to get into BIOS and find the WoL feature.
1. Enter BIOS instead of booting to your operating system.
2. Look for a section that pertains to power, such as Power Management. This may be under an
Advanced section. Other manufacturers might call it Resume On LAN, such as on the Mac.
Most BIOS screens have a help section off to the side that describes what each setting does
when enabled. It's possible that the name of the WoL option in your computer's BIOS isn't
clear.
3. Once you find the WoL setting, you can most likely press Enter to either immediately toggle iton or to show a small menu that allows you to toggle it on and off, or enable it and disable it.
4. Save the changes. This isn't the same on every computer, but on many the F10 key will saveand exit BIOS. The bottom of the BIOS screen should give some instructions about saving andexiting.
Purchase Information & Product Page

241

Step 2: Windows operating system WoL setup
Windows Wake-on-LAN is set up through Device Manager. There are a few different settings to enablehere:
1. Open Device Manager

2. Find and open the Network adapters section.

Purchase Information & Product Page

242

You can ignore any Bluetooth connections and virtual adapters. Double-click (or doubletap) Network adapters or select the small + or > button next to it to expand that section.
3. Right-click or tap-and-hold the adapter that belongs to the active internet connection.
Examples of what you might see are Realtek PCIe GBE Family Controller or Intel Network
Connection, but it will vary depending on your computer.
4. Choose Properties.

5. Open the Advanced tab.
Purchase Information & Product Page

243

6. Under the Property section, click or tap Wake on Magic Packet. If you can't find this, skip to
Step 8; Wake-on-LAN might still work anyway.

7. From the Value menu on the right, choose Enabled.
8. Open the Power Management tab. It might be called Power depending on your version of
Windows or network card.
9. Make sure these two options are enabled: Allow this device to wake the computer and Only
allow a magic packet to wake the computer.

These settings might instead be under a section called Wake-on-LAN and be a single setting
called Wake on Magic Packet.
Purchase Information & Product Page244

10. Click or tap OK to save the changes and exit that window. You can also close Device Manager.
6.2.7 Why Cannot Remote Control via KVM (Remote Desktop)

The DevicOn leverage VNC (Virtual Network Computing) technology to achieve remote desktop, tobridge different network between public and private. We build-up a Repeater server on public site for
WISE-PaaS/EnSaaS and Azure PaaS. There is a web-client through WebSocket (port: 6083 ~6183)
mechanism connect to Repeater and device via 5501 to Repeater, the structure as below. Please help
confirm the port available on your browser and device side.

If the DeviceOn running on VM, standalone version, the Repeater also build into same machine, pleasereference the structure, make sure the VM available for these inbound and outbound ports.

6.2.8 How to Enable and Adjust WISE-Agent Log Levels[WISE-Agent v-1.3.x & v-1.2.x]
Purchase Information & Product Page

245

Step 1: Adjust configuration file on WISE-Agent
Open log.ini on Installation path

Adjust level 5 to 7, minus stand for HTML format.
Step 2: Restart WISE-Agent
Open “Task Manager” and switch to “Services”, and restart “WISEAgentService”

Step 3: Retrieve log files from WISE-Agent
The log files under the Installation path\logs

Purchase Information & Product Page

246

[WISE-Agent v-1.4.x and above]
Step 1: Adjust configuration file on WISE-Agent
Open log.ini on Installation path\module\

Adjust log_level from 4 to 5.
Step 2: Restart WISE-Agent
Open “Task Manager” and switch to “Services”, and restart “WISEAgentService”

Purchase Information & Product Page

247

Step 3: Retrieve log files from WISE-Agent
The log files under the Installation path\logs6.2.9 Why the Dashboard Cannot Display All the Data within the Interval?

DeviceOn provide the Simple JSON interface to access sensor data from the edge device, there are
two mechanisms to retrieve data, one is Sampling to scatter the value of the interval, require lot’s ofcomputing resource of databases. The other is Raw to return latest raw data with 5000 records. Bothof two methods support data within 7 days only.
6.2.10 Why Cannot Screenshot and Always Show Device “No Login”

To fix the “No Login” error, you can sign into the system manually, or set the “Automatically Sign in toWindows 10”.

Purchase Information & Product Page

248

Step 1: Right-click the Start button and select Run from the hidden quick access menu, or use the
keyboard shortcut Windows Key  + R to bring up the Run dialog.

Step 2: Now Then Type: netplwiz and hit Enter or click OK.

Purchase Information & Product Page

249

Step 3: Uncheck Users must enter a user name and password to use this computer and click OK.
Step 4: Enter in your user name and the password you use to log into your system twice and click OK.

If you still get the “No Login” error or get the “black screen”, then you can try to disable the Windows
User Account Control (UAC).
Step 1: Press Windows Key  + X hotkeys together on the keyboard and choose the "Control Panel"
item.

Purchase Information & Product Page

250

Step 2: Go to the following path: “Control Panel\User Accounts\User Accounts” There you will findthe Change User Account Control settings link. Click it.

Alternatively, you can enter the “UAC” in the Search box to open the User Account Control settings
dialog.

Purchase Information & Product Page

251

Step 3: In the User Account Control settings dialog, move the slider to the bottom (Never Notify).

Step 4: Enter the “regedit” in the Search box to open the Registry Editor.

Purchase Information & Product Page

252

Step 5: Navigate to the following key:
“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System”

Step 6: In the right pane, modify the value of the EnableLUA DWORD value and set it to 0.

Purchase Information & Product Page

253

Step 7: Restart your computer.

WISE-Agent requires the Microsoft Visual C++ Redistributable 2008, 2013, 2015 x86 packages, which
will be downloaded from the Internet and set up during the installation process. If you are in anenvironment with limited or no Internet access, please download the Agent Dependency
Package through an Internet connected device and install this package first.
6.2.11 How to Enable/Disable Plugins on WISE-Agent

Step 1: Adjust configuration file on WISE-Agent
Open module_config.xml on Installation path\module\

Purchase Information & Product Page

254

Adjust “ModuleEnable” to TRUE/FALSE to enable and disable.

Step 2: Restart WISE-Agent
Open “Task Manager” and switch to “Services”

Restart “WISEAgentService” to connect to DeviceOn
6.2.12 How to Adjust DeviceOn Server Address (Standalone)

If your DeviceOn Server (Standalone) running on public cloud or on-premise environment, and thenPurchase Information & Product Page255

you would like to update DeviceOn Server address, due to machine/VM IP changed. Here are few
steps to update server setting.
Step 1: Search Server_config.xml on installation path,(example, C:\Program Files\Advantech\DeviceOn Server\)Step 2: Open these files with notepad or other txt editor, and then update host IP address to below
path.

Step 3: Restart the Tomcat and Management Services through DeviceOn Server Control.

Purchase Information & Product Page

256

6.2.13 How to Migrate EdgeSense Database to DeviceOn (WISE-PaaS/EnSaaS)

Actually, the DeviceOn is a new product for IoT device management and the backend cores, databasestructure is based on EdgeSense to develop. In the section, we give a few steps to migrate, transfer
database from EdgeSense to DeviceOn. Before the steps, you should prepare the database tool,
download and install the program.
⚫

PostgreSQL: pg_dump, psql⚫

MongoDB: mongodump, mongorestore

Step 1: Sign into your WISE-PaaS/EnSaaS Management portal

Step 2: Enter to your organization, space and listing your applications.

Purchase Information & Product Page

257

Step 3: Retrieve PostgreSQL information via Application (“portal-rmm-1.0.x”) environment, click on
the application.
a. DATABASE_NAME
b. DATABASE_PASSWORD
c. DATABASE_USERNAME
d. DATABASE_HOST

Step 4: Start to backup PostgreSQL data, open the terminal and enter to your PostgreSQL tool path,for example, <INSTALLATION_PATH>\PostgreSQL\11\bin\
Run the following commands and give a password to backup 3 schema data only.
Purchase Information & Product Page258

1. pg_dump.exe -h DATABASE_HOST -U DATABASE_USERNAME --column-inserts --data-only -schema=rmm --dbname=DATABASE_NAME --file=d:\rmm_schema.sql
2. pg_dump.exe -h DATABASE_HOST -U DATABASE_USERNAME --column-inserts --data-only -schema=public --dbname=DATABASE_NAME --file=d:\public_schema.sql
3. pg_dump.exe -h DATABASE_HOST -U DATABASE_USERNAME --column-inserts --data-only -schema=ota --dbname=<DATABASE_NAME> --file=d:\ota_schema.sql

Step 5: Open rmm_schema.sql on text editor tool, replace “rmm” word to “deviceon”.

Then, remove or mark the data on “servicekey”, save as another file (deviceon_schema.sql)

Step 6: Open ota_schema.sql on text editor tool, replace “ota” word to “provisioning”, and save as
another file (provisioning_schema.sql)

Purchase Information & Product Page

259

Step 7: Before to restore database to DeviceOn, please retrieve related information on Management
portal, such as Database name, user name, password and host. On WISE-PaaS 3.0, the steps similar
to previous, click on the application (portal-deviceon-1.1.x) and get the information via environment.

Step 8: Start to restore PostgreSQL data, open the terminal and enter to your PostgreSQL tool path,
Purchase Information & Product Page260

for example, <INSTALLATION_PATH>\PostgreSQL\11\bin\
Run the following commands with the SQL that adjusted and give a password to restore 3 schema
data only.
1. psql.exe -h DATABASE_HOST -U DATABASE_USERNAME -d DATABASE_NAME -f d:\public_schema.sql
2. psql.exe -h DATABASE_HOST -U DATABASE_USERNAME -d DATABASE_NAME -f d:\deviceon_schema.sql
3. psql.exe -h DATABASE_HOST -U DATABASE_USERNAME -d DATABASE_NAME f d:\provisioning_schema.sql

Step 9: For MongoDB backup and restore, you could get the credential on application’s environment,
and start to run below command to dump collection.
1. mongodump.exe --host DATABASE_HOST --db DATABASE_NAME --collection COLLECTION_NAME -out d:\mongodb --username DATABASE_USERNAME --password DATABASE_PASSWORD

Run the following commands to restore collection to new database.
1. mongorestore.exe --host DATABASE_HOST --db DATABASE_NAME -collection COLLECTION_NAME D:\mongodb\COLLECTION_NAME.bson --username DATABASE_USERNAME -password DATABASE_PASSWORD

Before to realize the value of data, to export a precise model on your field side, you must collect theseraw data from edge side through WISE-Agent. The WISE-Agent not only IPC management but dataacquisition for various wire/wireless protocols. DeviceOn could deploy on Azure Kubernetes toleverage Azure PaaS resource, such as Azure Function, IoTHub, Cosmos DB, meanwhile, much easier
to start training via Azure Machine Learning.
Leverage Azure Machine Learning, automated ML is the process of automating the time consuming,
iterative tasks of machine learning model development. It allows data scientists, analysts, anddevelopers to build ML models with high scale, efficiency, and productivity all while sustaining model
quality. Automated ML is based on a breakthrough from our Microsoft Research division.
Traditional machine learning model development is resource-intensive, requiring significant domain
knowledge and time to produce and compare dozens of models. Apply automated ML when you wantAzure Machine Learning to train and tune a model for you using the target metric you specify. The
service then iterates through ML algorithms paired with feature selections, where each iteration
Purchase Information & Product Page

261

produces a model with a training score. The higher the score, the better the model is considered to"fit" your data.
With automated machine learning, you'll accelerate the time it takes to get production-ready ML
models with great ease and efficiency.

6.2.14 How to Enable Data Retention on DeviceOn

The device’s raw data, such as hardware information, voltage, FAN, network or the wireless sensor
data are stored into MongoDB. If ran out of disk storage, the MongoDB service would be stopped. To
avoid this situation, you could set up the retention size of each collection on MongoDB via the API or
MongoDB command, if the collection existed. Second method, you can adjust the configuration(Server_Config.xml) to enable retention for all collections after the DeviceOn server installed.
However, the second method will affect newly created collections only.
⚫

Collection existed:

Please refer to API document to convert collection to capped, the command takes a time (depend on
your collection size) to process in the background.
/rmm/v1/db/nosql/mongo/convertToCapped

Purchase Information & Product Page

262

MongoDB Command line:
1. db.runCommand({"convertToCapped": "common_ProcessMonitor", size: 524288000});⚫

Collection non-existed (Apply to newly created):

Please add the “Capped” item into Server_config.xml that locate on:\DeviceOn Server\server\worker\deviceon\

The unit of size is MB, that’s mean the maximum size (uncompressed) is limited, and then restart
the Management service.

After that, you could check and confirm the collection applied through third party tool (Rob 3T).

Purchase Information & Product Page

263

6.2.15 How to Enable HTTPS on DeviceOn Web Service

Generate Let's Encrypt certificate using Certbot for DeviceOn.
◼

Let’s Encrypt is a new free, automated, and open source, Certificate Authority.

◼

Certbot is a console based certificate generation tool for Let's Encrypt.

In this recipe, we will generate a Let's Encypt certificate using Certbot. This certificate will then be
deployed for use in the DeviceOn server.
Dependancies:◼

Port 443 for https needs to be open and available at time of executing certbot.

◼

Certbot needs root access while executing because only root is allowed to bind to any port
below 1024.

◼

We will be using our own domain myminio.com as an example in this recipe. Replace withyour own domain under your setup.

Step 1: Install Certbot
Install Certbot by following the documentation at https://certbot.eff.org/
Since the DeviceOn Web service is running on Apache Tomcat, please select to “Apache” and“Windows” to donwnload Certbot installer.

Scrolling down the instruction, you may get the installer package on Step 4.
https://dl.eff.org/certbot-beta-installer-win32.exe

Purchase Information & Product Page264

Run the installer and follow the wizard. The installer will propose a default installation
directory, C:\Program Files(x86), that can be customized.)

Step 2: Create the folder to authenticate
Create the folder named acme-challenge under <DeviceOn Folder>\server\portal\.well-known. If
the folder “.well-known” is not exist, please create it manually (via CLI, for example: mkdir).

Purchase Information & Product Page

265

Step 3: Choose how you’d like to run Certbot
Run the following command to create credential files and enter your website information. The domainname(s) should input yours and the webroot to (\DeviceOn Path\server\portal\)
1. certbot.exe certonly --webrootStep 4: Install your certificate
You'll need to install your new certificate in the configuration file or interface for your webserver.
Certificates are located in C:\Certbot\live\[certificate_name], where [certificate_name] is the nameof your certificate (usually the first domain if the --cert-name flag has not been used on
Purchase Information & Product Page

266

the certonly command)

Step 5: Install your certificate on DeviceOn Web Services⚫ Open the server.xml on text editor tool that located in the \DeviceOn Path\tomcat\conf\⚫ Add the following XML attribute (Connector) into Service tag and give your certification paththat generated on Step 4.
1 <Connector port="443"2

protocol="org.apache.coyote.http11.Http11AprProtocol"

3connectionTimeout="20000"

4

useSendfile="false"

5compression="on"6compressionMinSize="2048"

7

noCompressionUserAgents="gozilla, traviata"

8
9 compressableMimeType="text/html,text/xml,text/plain,text/css,text/javascript,applicat
10 ion/javascript,application/xml,application/json"
11redirectPort="8443"

12

maxThreads="150"13

scheme="https"

14

secure="true"

15

SSLEnabled="true">

16<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol"

17

overheadWindowUpdateThreshold="-1"

18

overheadDataThreshold="-1"19

writeTimeout="-1"20

streamWriteTimeout="-1"

Purchase Information & Product Page

267

21

streamReadTimeout="-1"22

maxHeaderSize="8192"

23

maxConcurrentStreams="300"24

readTimeout="-1"

25
26 compressibleMimeType="text/html,text/xml,text/plain,text/css,text/javascript,applicat
27 ion/javascript,application/json"
28
29
30

compression="on" compressionMinSize="1024"/><SSLHostConfig><Certificate certificateKeyFile="C:\Certbot\live\<DNS>\privkey.pem"

31

certificateFile="C:\Certbot\live\<DNS>\cert.pem"
certificateChainFile="C:\Certbot\live\<DNS>\fullchain.pem"
type="RSA" /></SSLHostConfig></Connector>

Step 6: Restart DeviceOn web services (Tomcat_IoT) to reload the configuration
Step 7: Replace the certificate files that in the websockify folder.
xcopy "C:\Certbot\live\<DNS>\privkey.pem" "<INSTALLER_PATH>\server\portal\WEBINF\classes\novnc\websockify\wise-paas.com.private.key" /Yxcopy "C:\Certbot\live\<DNS>\cert.pem" "<INSTALLER_PATH>\server\portal\WEBINF\classes\novnc\websockify\wise-paas.crt" /Y

Step 8: Enable to automatic renewal⚫ Create a batch file named restartTomcat.bat which content as below.

⚫ Copy the batch file into C:\Certbot\renewal-hooks\post\
Step 9 (Optional): Test automatic renewal, please run the following command
Purchase Information & Product Page

268

certbot.exe renew –dry-run

Step 10 (Optional): If you get all renewals succeeded, it means your configuration is correct.

Step 11: Turn Windows firewall on inbound port 443 for your HTTPS, and make sure your network
security rules allow.
6.2.16 How to Enable Passive Mode on DeviceOn FTP Server

DeviceOn FTP default setting is active mode. However, FTP runs active mode may fail in cases where
the server is behind a router or the server deplyed on Azure/AWS or other cloud’s virtual machine.
And that will cause DeviceOn initialize failure.

Purchase Information & Product Page269

To solve this issue, you should change FTP server to passive mode.
Below are step-by-step to change the setting. First is FTP server configuration, second is Network
Security Group (Azure, AWS or your network security setting), and last to restart DeviceOn Server.
Step 1: Open the ftpd-typical.xml on text editor tool that located in the\DeviceOn Path\ftp\res\conf\

Add the following XML attribute (data-connection) into listeners tag and give your passive ports
range and external DNS.
<data-connection idle-timeout="60"><passive ports="60001-60100" external-address="<YOUR_EXTERNAL_DNS>" address="0.0.0.0" />Purchase Information & Product Page270

</data-connection>"60001-60100" means in passive mode, ftp client uses port 60001 to 60100 to transfer data. You couldchange it to any available ports range. "YOUR_EXTERNAL_DNS" means in passive mode, client’s
destination domain name. You should replace it with real domain name which can be access fromexternal side.

Step 2: Apply setting by restart service “Apache FtpServer ftpd”

Step 3: Add inbound security rules on your network security group, make sure blow ports areavailable, and takes Azure as an example.
◼

2121 (command port)◼

60001-60100 (Passive port)

Purchase Information & Product Page

271

Step 4: Restart DeviceOn Server, stop/start the “Management Service”

Back to DeviceOn portal, the default FTP appear in repository list.
Purchase Information & Product Page272

7. Reference
7.1 User Permission
Item

ActionDescription

CreateCreate Account

Edit
Account
Management✔ (NotInclude Self)✔ (Only
Device Admin)✔

✔ (Only Self &Device Admin)

Edit

Disable Account✔ (NotInclude Self)✔ (Only
Device Admin)✔

✔ (Only Self &Device Admin)✔ (Only Self)✔ (Only Self)✔ (Only Self)✔ (Only Self)✔

✔ (Only Self &Device Admin)✔ (Only Self)✔

✔ (Only Self &Device Admin)✔ (Only Self)✔

✔ (Only Self &Device Admin)✔ (Only Self)✔

✔ (Only Self &Device Admin)✔ (Only Self)

✔

✔

✔

✔

✔ (Only Self &Device Admin)✔ (Only SelfManaged

Edit

Group

View AccountInformation
2FA
Authentication
Create Device
Group
Edit Device Group
Information
View Device

View

Group
Information

DeleteAdd

Control &Management✔ (Only Self)✔ (NotInclude Self)

CreateDeviceDevice Admin

Edit Account Role

Edit

Management

Basic Information

System Admin

Edit

View

DeviceEdit Account

Root

Edit

Delete DeviceGroup
Add Unmanaged
DeviceEdit Device
Information

Purchase Information & Product Page

273

Devices)
View

Edit

Edit

View Device
Information

Remove Device

Share Device

✔

✔

✔

✔ (Only Self &Device Admin)✔ (Only Self &Device Admin)✔ (Only Self &Device Admin)✔ (Only SelfManaged
Devices)✔ (Only SelfManaged
Devices)✔ (Only SelfManaged
Devices)

SearchView

Unmanaged✔

✔

✔

✔ (Only Self &Device Admin)✔

Devices
Power, Remote
Desktop,
Terminal,
Screenshot,
Control

Backup/Recovery,
Protection,✔ (Only SelfManaged
Devices)Windows
Lockdown
Actions…

View

View and Export
Device Event✔

✔ (Only SelfManaged &Device Admin
Devices)

Event Log
Management

View

View

View and Export
System Event
View and Export
Operation Event

✔

✔

OTA
Management

Edit
View

Create Storage
Repository
Edit Storage
Repository
View Storage
Repository

Purchase Information & Product Page

Devices)✔
✔ (Only SelfManaged &Device Admin
Devices)Create✔ (Only SelfManaged

✔

✔

✔

✔

✔

✔

✔ (Only SelfManaged
Devices)✔
274

DeleteUploadView

DeleteDeployDelete Storage
Repository
Upload OTA
Package
View OTA
Package

✔

✔

✔

✔

✔ (Only Self
& PublicApp)

Delete OTA✔ (Only

Package

Self)

Deploy OTA
Package✔

✔ (Only Self
& Public App)✔ (Only Self)✔ (Only SelfManaged &Device Admin
Devices)CreateCreate an Action✔ (AllGroups) on
Self Account✔ (Only SelfGroups &Device Admin
Groups) on Self✔
✔ (Only
Self & PublicApp)✔ (Only
Self)✔ (Only SelfManaged
Devices)✔ (Only SelfGroups)

Account

Edit

Update an Action✔ (AllGroups) on
Self Account✔ (Only SelfGroups &Device Admin
Groups) on Self

✔ (Only SelfGroups)

Account
SystemSetting
Management

View

View Action✔ SelfAccount✔ SelfAccount✔ SelfAccount

DeleteDelete Action✔ SelfAccount✔ SelfAccount✔ SelfAccount

Power
Management✔

✔ (Only SelfManaged &Device Admin
Devices)

Provisioning

Backup/Recovery✔

✔ (Only SelfManaged &Device Admin
Devices)Protection

Purchase Information & Product Page✔

✔ (Only SelfManaged
Devices)✔ (Only SelfManaged
Devices)✔ (Only SelfManaged &✔ (Only SelfManaged

Device Admin

Devices)275

Devices)
Edit

Edit Event Alert✔ (Only Self)✔ (Only Self)

✔

✔

✔

✔

Addins✔

✔

Dashboard✔ (Only Self)✔ (Only Self)

Edit

System Report

✔

✔

Edit

System Menu

✔

✔

Edit

System Theme✔ (Only Self)✔ (Only Self)

Edit

System Logo

✔

✔

✔

✔

✔ (Only Self)✔ (Only Self)✔ (Only Self)✔ (Only Self)✔ (Only Self)✔ (Only Self)

✔

✔

✔

✔

✔

✔

✔

✔

✔

✔

Setting✔ (Only Self)

Configure Alert
Services (Email,Edit

SMS, WeChat,
Telegram, LINE,
Teams, Slack,
Webhook.)

Edit
CreateCreate/Edit

Edit
Edit
Edit
Edit
Edit
Edit
Edit
Edit
Edit

Production
Activation

System Login
Page
System Overview
Setting
System Language
SettingServer Time Zone

✔ (Only Self)

Account
Registration
2FA
Authentication
LDAP
Device X.509
Certification
Remote Storage(SMB/CIFS)

Edit

Data Export

✔

✔

Edit

Webhook

✔

✔

Edit

Syslog

✔

✔

✔

✔

Edit

✔ (Only Self)

App Store Setting
Offered by &Purchase Information & Product Page

276

Contact Support
CURD

Map Location

✔

✔

✔

✔ (Only SelfDevice Map

CURD

Map Device✔

Managed &Device Admin✔ (Only Self)

Devices)
CURD
Overview

Schedule✔ (Only Self)✔ (Only Self)✔ (Only Self)✔ (Only Self
View

View Event✔ (All)& Device✔ (Only Self)

Admin)CreateUpdateView

Create RuleEngineEdit Rule Engine

View Rule Engine

✔

✔

✔

Rule
DeleteEdit/View

Delete RuleEngineEdit/View System
UI✔

✔ (Only Self &Device Admin)✔ (Only Self &Device Admin)✔ (Only Self &Device Admin)✔ (Only Self &Device Admin)

✔

✔

✔

✔

✔ (Only SelfManaged
Devices)✔ (Only SelfManaged
Devices)✔ (Only SelfManaged
Devices)✔ (Only SelfManaged
Devices)

Activate
Edit

DeviceOn License(Perpetual Only)

7.2 Retrieve My Azure Account Information
7.2.1 Method 1 – Create & Get Information on Azure Portal

Step 1: Create Your Application
1.1.

Log into your Azure Portal

1.2.

Select [Azure Active Directory]

1.3.

Select [App registrations]Purchase Information & Product Page

277

1.4.

1.5.

Add [New Registration]

Setup your Application Name then click [Register].
⚫
Enter your Application display name in Name filed.
⚫

Setup Supported account types by selecting the respective account type for this API.

⚫

Under Redirect URI, select Web for the type of application you want to create. Enterthe URI where the access token is sent to.
Note: You cannot create a Native application credential nor use the type for an
automated application.

Purchase Information & Product Page

278

Step 2: Get Subscription ID
To access resources in your subscription, you must assign a role to the Application. You can pick
between Subscription, Resource Group or Resource. Permissions are inherited to lower scope levels.
For more details, see RBAC: Built in Roles
2.1. Select All services then select Subscriptions to set up the level of scope you wish to assign
this application.

Purchase Information & Product Page279

2.2. Find the Subscription you would like to assign to the Application created in the Step 1. Copy
the Subscription ID, as this is one of the Azure data fields required on the WISE-PaaS Marketplace
later. (Ref: Marketplace field #A)！Troubleshoot: If you do not see the subscription you're looking for, select global subscriptions
filter. Make sure the subscription you want is selected for the portal.
2.3. Select Access control (IAM) then Add role assignment

2.4. Select the Owner role. By default, Azure AD applications are not displayed in the available
options. To find your application, search for the name.

Purchase Information & Product Page280

2.5. Click Save to finish assigning the role. You will be able to see your application in the list ofusers assigned to a role for that scope.
Step 3: Get Application & Tenant ID
3.1. Select Azure Active Directory
3.2. From App registrations in Azure AD, select your application

3.3. Copy the Directory (tenant) ID as another piece of Azure information that will be requiredon the WISE-PaaS Marketplace later. (Ref: Marketplace field #C)

Purchase Information & Product Page281

3.4. Copy the Application (client) ID as part of Azure information that will be required on the
WISE-PaaS Marketplace later. (Ref: Marketplace field #B)

Step 4: Add & Get Client Secret4.1. Select [Certificates & secrets]
4.2. Select Client secrets then New client secretPurchase Information & Product Page282

4.3. Provide a description for the new client secret, set up the expiration period. Then Click [Add]

Copy Client Secret (Ref: Marketplace field #D)

7.2.2 Method 2 – Create via Azure CLI (Command-line Tool)

Step 1: Install Azure CLI
For details, please view this step by step guide
Step 2: Sign into the Azure Account
Purchase Information & Product Page283

C:\>az login
Note: If the CLI can open your default browser, it will do so and load a sign-in page. Otherwise, youneed to open a browser page and follow the instructions on the command line to enter anauthorization code after navigating to https://aka.ms/devicelogin in your browser. Sign in with youraccount credentials in the browser.
Step 3: Get Subscription ID & Copy Output
C:\>az account show --query id

Step 4: Create service principal and get Application ID, Tenant ID and Client Secret
C:\>az ad sp create-for-rbac --name ServicePrincipalName

Reference: Create an Azure service principal with Azure CLI >Purchase Information & Product Page284