Remote monitoring

Monitoring Live's screens from browsers of computers, tablets and TVs on the network: enabling, port, browser users, single-computer rule, access networks, Windows Firewall permission, what the viewer sees and the list of connected viewers in Live. Optional remote control is a separate topic.

What it is used for

While remote monitoring is on, Live runs a small web server on the computer it is installed on. Computers, tablets and smart TVs on the same network enter the address of the Live PC in the browser and watch the screens of the project live. Monitoring is read-only by default: control, alarm acknowledgment, recipe operations and setting changes are made from the Live computer.

If Remote control is enabled in Studio, browser users who have been assigned an authorization group can also control from the browser; other users and TVs still only monitor. Details: Remote control.

The monitoring settings are in the Remote monitoring section in Studio (under Live settings in the project tree). In the project tree, the badge next to the section shows the state: ON, or TV if only the TV is on.

Installation steps

1. Turn on monitoring

   In the Remote monitoring › General › Browser monitoring group, set Browser monitoring to On. Port is an integer between 1024 and 65535 (default 8080). While it is off, Live is not opened to the network; only the TV display on the second monitor (if it is on) works.

2. Add a browser user

   On the Browser users tab, enter the Name (at most 40 characters, must not start with @, unique) and the Password for each viewer. The password has at least 6 characters and is typed twice in the password window; open the window by double-clicking the cell or with Enter / F2. Shorter passwords entered earlier keep working. A user without a password cannot log on. The Remote control column is set to Monitor only by default; selecting an authorization group is for control (Remote control). Operator users are in User administration. Create a separate user for each person: the same user cannot connect from two computers at the same time (see below).

3. Review the access rule

   General › Access (VPN) › Allowed addresses and, if necessary, Access Networks (below).

4. Upload the project to Live

   The server starts when the project is opened. The address strip in Studio shows the monitoring address in the form http://<Live PC'sinin IP adresi>:8080.

5. Add the firewall permission

   In the system menu › Remote monitoring… window on the Live computer, click Add firewall permission (see below).

123

1. Browser monitoring — on / off and port.
2. Connection address — typed into the browser.
3. Access (VPN) — allowed addresses.

How to monitor from a browser

http://<Live PC'sinin IP adresi>:<port> is entered in the browser. On the login screen, User name and Password are entered; if Remember me (30 days) is selected, the session is valid for 30 days, otherwise for 12 hours. The session is carried by a cookie; if a user is deleted or the password is changed, their session becomes invalid immediately.

• Screens arrive with the same appearance as in Live, with live data refreshed about once per second. The system menu is simplified: screens, connection states, language, theme (Light / Dark), interface language and Logout. The language and theme are stored in that browser.
• The menu of a user without control authorization shows read-only. A control attempt is not written; a short warning is shown: Remote monitoring: control off. The menu of a user with an authorization group shows the group and remote control instead (Remote control).
• Scripts: scripts do not run in the read-only viewer. In a remote control session, event scripts run in the browser. Scheduled tasks, drivers and the simulator do not exist in any browser: these exist only in the Live program.
• Screen trail: if the time machine is enabled in the project and the Live license includes the time machine, the screens and windows the browser user opens, the mouse movements and the value entries are recorded on the Live computer (passwords are not recorded). A note saying so appears in the user's system menu. The recording is viewed in the time machine in Live (Time machine).
• The Camera image and the files of the PDF viewer are delivered through the server and require a session. A PDF is opened only from the folder defined for the PDF viewer objects in the project.
• Screen that requires authorization: in the read-only viewer, authorization is determined by the session on the Live computer (in a remote control session, by the authorization group of the browser user). Until an authorized user logs on at the Live PC, the message The … screen requires the "…" authorization: it is shown when an authorized user logs in on the Live PC. appears instead of the screen.
• Hiding a screen from viewers: if Web access › Viewable from browser / TV is switched off in the screen properties, the screen does not appear in the viewer's list and is skipped in the TV sequence; it does not affect the Live display.

If the license of the Live computer does not include browser monitoring, the login screen says Browser monitoring is not included in this license (FV-WEB). and the rejection is written to Live's program log.

Same user from one computer only

A browser user can connect from only one computer at a time. The computer is identified by the IP address the connection comes from; opening a second tab or window on the same computer is allowed.

• If a user who is connected on one computer tries to log on from another address, the login screen says This user is connected from another computer (<address>). The same user can sign in from only one computer at a time. A session left on the old computer also returns to the login screen with the same message.
• The slot is freed immediately with Logout. If the browser is closed, it is freed 15 seconds after the last request; the user can then log on from another computer.
• The rule applies to all browser users; there is no setting to turn it off. TV addresses and the second-monitor TV window are not subject to this rule. If you use a shared viewer account on several computers, create a separate user for each computer.
• A rejected log-on is written to the Live program log (Log files).

Security

Access rule (source address check)

The server looks at the address the connection comes from. General › Access (VPN) › Allowed addresses:

A rejected request receives the response 403 and Access from this address is not allowed. The counter is shown in the Remote monitoring window in Live.

12

1. Network / address — CIDR or a single address.
2. Type — private network or internet address.

Access Networks table: Network / address (e.g. 10.8.0.0/24, 192.168.1.20, fd00::/8; the value you type is converted to a single standard form), Description, Enabled, Type (private network, public address / network, all addresses). An entry that covers all internet addresses is an error; a network that is too wide and writing the same network twice are warnings.

Logon attempts

If there are 5 failed logins from the same address within 10 minutes, that address is put on hold for 60 seconds; the login screen says Too many failed attempts. Try again in N seconds. A wrong password gives User name or password is incorrect.; whether the user exists cannot be told from the message. Logins and failed attempts are written to Live's program log (Log files).

Other protections

• The origin of the request is checked: a request coming from a foreign site gets 403 with Invalid request origin.; the cookie has HttpOnly and SameSite=Strict set.
• The viewer can read only certain logs and records. In a session without control authorization, requests that write (tag write, store write, exit) are never sent to the server; the server in turn accepts action requests only from a remote control session and returns 403 to all others.
• Passwords are stored in the project file as a hash (sha256); plain text is not kept.

Remote monitoring window in Live

On the Live computer, system menu › Remote monitoring… shows the server status and refreshes every two seconds.

1234

1. State — whether the server is running, the port, the number of viewers.
2. Browser address — with the Copy button.
3. Last rejected address — a hint for VPN problems.
4. Add firewall permission

State badge

On — browsers on the network can monitor, On — this computer only or Off; when on: Port and the number of connected Viewers.

Browser addresses, TV addresses

The addresses of the Live PC and the /tvN address of each TV; Copy buttons.

Networks allowed to connect

The active rule, the networks in the list, the Rejected connections count and the Last rejected address. If a VPN client cannot connect, add the network of this address to Access Networks.

Windows Firewall

Allowed, Not allowed — devices on the network may be unable to connect, Not required (the server is not open to the network) or State unknown.

Second screen (TV)

The state of the TV window and the connected screens (see Multi-screen and TV).

Firewall permission

For the devices on the network to be able to connect, Windows Firewall must have an inbound connection permission for this program and port. The Add firewall permission button does this: first the settings authorization is checked, then Windows administrator approval (UAC) is requested. The rule that is added is named FabyaVision Uzaktan Izleme (TCP <port>) (inbound, allow, TCP, this program and this port, all profiles). When the port changes, the old rule is deleted and a new one is added. If approval is not given, the message Administrator approval was not granted; the rule was not added. is shown.

Web Viewers window

On the Live computer, the Web viewers… button in the system menu shows which browsers and TVs are currently connected. The button appears only when monitoring from a browser is enabled in the project, and only in the main window on the Live computer; it is not present in additional monitor windows or in the browser. If viewers are connected, the button also shows their number: Web viewers (3)…. There is no separate indicator for viewers on the Live screen.

1

1. Web viewers (3)… — the number of browsers and TVs connected right now; click to open the list.

1

1. Authorization — TV, Remote control (with the authorization group) or Read-only.

User

Name of the browser user; for a TV, its number and name (e.g. TV 1 · Production TV).

Address

The IP address the connection comes from.

Authorization

TV, Remote control and the authorization group (Remote control), or Read-only.

Connected, Duration

The time the connection started and the time elapsed since then.

• The list shows the viewers that sent a request in the last 20 seconds and is refreshed every second while the window is open. A viewer who closes the browser drops off the list after 20 seconds at the latest; if they reconnect, it counts as a new connection.
• Tabs opened by the same user from the same address form a single row. Live's own additional-monitor and second-screen TV windows are not in the list.
• While a user with remote control authorization is connected, a note at the bottom of the window says that operations are written to the event log with the user name and address. If nobody is connected, the window says No web viewers are connected right now.

Limitations and points to note

• Plain HTTP: passwords and data are not encrypted; use a VPN. TV addresses have no password by default (TVs watch without password).
• Users without an authorization group and TVs are read-only. Tasks, drivers and the simulator do not run in any browser; scripts run only in a remote control session (Remote control).
• The same browser user can connect from only one computer at a time.
• If the port is used by another program, browser monitoring cannot be started: the Live window says Port … is being used by another program; browser monitoring could not be started. Select a different port in the project. and the server runs on a random port bound to this computer only.
• A real-network and Windows Firewall test for connections from other computers must be carried out on site.