Milestone ACM Lenel OnGuard Manual
Milestone ACM Lenel OnGuard Manual
Contents
CONTENTS 3
REVISIONS 6
VERSION COMPATIBILITY 7
SCALABILITY TESTING 8
NUMBERS OF DEVICES 8
PHYSICAL HARDWARE 8
SOFTWARE TESTED AGAINST 8
EVENTS HANDLED 8
GENERAL DESCRIPTION 10
INTRODUCTION 10
SOLUTION OVERVIEW 10
TERMINOLOGY 10
PREREQUISITES 11
INSTALLATION 18
CONFIGURATION 30
OPERATIONS 49
TROUBLESHOOTING GUIDE 62
KNOWN ISSUES 67
EVENTS HANDLED 68
LENELFETCHEVENTTYPES UTILITY 68
EXAMPLE EVENT LIST 68
Copyright
© 2018 Milestone Systems A/S.
Trademarks
XProtect is a registered trademark of Milestone Systems A/S.
Microsoft and Windows are registered trademarks of Microsoft Corporation.
All other trademarks mentioned in this document are trademarks of their respective owners.
Disclaimer
This document is intended for general information purposes only, and due care has been taken in its preparation.
Any risk arising from the use of this information rests with the recipient, and nothing herein should be construed as constituting any
kind of warranty.
Milestone Systems A/S reserve the right to make adjustments without prior notification.
All names of people and organizations used in this document's examples are fictitious. Any resemblance to any actual organization
or person, living or dead, is purely coincidental and unintended.
This product may make use of third party software for which specific terms and conditions may apply. When that is the case, you
can find more information in the file 3rd_party_software_terms_and_conditions.txt located in your Milestone surveillance system
installation folder.
Revisions
Date Version What was changed Author
05/11/2016 1.0 Original version Doug Beyer
05/17/2017 2.0 Prerequisites, scalability, and Doug Beyer
troubleshooting sections updated.
Some images updated.
12/14/2017 2.5 Performance improvements for Doug Beyer
event processing and handling
large numbers of card holders.
Support for Lenel OnGuard
Enterprise.
4/1/2018 3.0 Using OpenAccess for OnGuard Doug Beyer
versions >= 7.4
10/29/2018 3.1 Integration v2.6 Brian Hayes
Version Compatibility
The Milestone Lenel OnGuard ACM integration has been tested with Milestone XProtect® Corporate (XPCO) and Lenel OnGuard
according to the following table.
Scalability Testing
The Lenel ACM integration has been tested against the following. Any customer exceeding the number of devices, using different
hardware, or using different software versions should contact Milestone to coordinate any additional testing or code changes.
Numbers of devices
Type of Device Count
Door 1029
Reader 1029
Panel 1900
Alarm Panel 38
Card Holders 20000
Physical hardware
Any other hardware has not been tested:
• LNL-500 Intelligent System Controller
• LNL-2220 Intelligent Dual Reader Controller
• LNL-1320 Dual Reader Interface Module
• LNL-1300 Single Reader Interface Module
• LNL-1100 Input Control Module
• LNL-1200 Output Control Module
Events Handled
See the Events Handled section.
General description
Introduction
This document describes specifics to the Access Control Module (ACM) integration between Milestone XProtect and the Lenel
OnGuard access control (AC) system.
This integration supports the following standard ACM features:
• Retrieve configuration from the Lenel AC system, e.g. doors and event types
• Receive AC event streams and state changes from the Lenel system
• Get/Search cardholder information with picture association (if available through the HR API)
• Create alarms in alarm manager based on AC events.
• Alarm acknowledgment from XProtect (2016 R3 or greater) to Lenel. Alarm acknowledgment from Lenel to XProtect is not
implemented due to the lack of such functionality in Lenel.
• Association of access events to cameras for simultaneous display of events and live video
• Select and categorize the events the user wants to view from the Lenel system
• Trigger rules or actions based on access events – e.g. start recording, go to PTZ preset, display access request, send
camera to matrix and system actions such as activate output or trigger manual event. With XProtect Corporate and Expert
this functionality is extended to full use of the event as a triggering mechanism for the rules system.
Solution overview
The solution provided is split in 3 components:
• The ACM Server MIP Plugin that runs in the XProtect Event Server
• The ACM Server that runs on the Lenel server
• The Lenel-OnGuard ACM Server plugin that runs on the Lenel server as well
Terminology
• Legacy plugin – Refers to Lenel OnGuard plugins with version numbers <= 1.0.16354, dated approximately 12/19/2016.
Prerequisites
• General
o .NET Framework 4.5 must be installed on the Lenel server machine (dotnetfx45_full_x86_x64.exe)
o All servers (i.e. the Lenel and Milestone machines) must be time-synchronized to within a couple of minutes of
one another.
o The customer must have a Milestone license with Access Control enabled and the proper number of doors and
cameras allocated.
o It is essential that the same version of the Lenel ACM integration be installed on both the XProtect and Lenel
machines.
• The Lenel AC System
o SQL Server is properly configured. See Configure SQL Server for Connections for suggestions.
o Lenel is properly configured for its hardware and successfully communicates with its hardware.
o See Software Tested Against for the minimum supported Lenel OnGuard versions.
o Lenel is configured for single sign-on (see below for details).
o Lenel is configured to generate software events (see below for details).
o The following Windows services are running on the Lenel machine:
▪ LS Communication Server – required for the hardware to communicate with the Lenel OnGuard AC
system
▪ LS DataConduIT Service – required for our integration to use the Lenel DataConduit API
▪ LS Linkage Server – required for event handling.
o If installing on a Lenel OnGuard Enterprise system, the Enterprise system must be correctly configured and
functioning.
• The Milestone ACM Server
o Must be run in the context of a Windows admin user that is linked to a Lenel Directory that is marked as single
sign-on. See below for details.
• XProtect Management and Smart Client Applications
• The machine running the Milestone Event Server must have network name resolution such that it can resolve the
computer name of the Lenel Server machine (e.g. DNS, manual host file entry, etc). The Lenel machine must also be
able to resolve the Milestone machine.
• The user that runs the Milestone Management Client application needs to be configured as an administrator within
Milestone.
• The user that runs the Milestone Management Client and Smart Client applications needs to be configured to use the
default smart client and management profiles.
o In the Milestone Management Client, the user should be a member of the Administrator’s Role
o The Smart Client user’s profile should include Access Control – Show access request notifications =
Yes (default setting) and any other rights that affect what the user can see/access in Smart Client
The default Smart Client profile does have these rights as shown below:
In the Select Account dialog, Select Directory from drop-down, click Search, select a Windows user (must be a member of the
machine’s local Administrators group) in Accounts then click OK.
Note that a single Lenel Directory can only be linked to one Windows user. If you attempt to create another Lenel user and try to
link that same Lenel Directory to a different Windows user the dialog’s Accounts list, it will fail.
Installation
It is essential that the same version of the Lenel ACM integration be installed on both the XProtect and
Lenel machines.
The installation package consists of three files which should be installed in the following order:
1) Install the pre-requisites on the Lenel server machine
a) .NET Framework 4.5
4) Milestone.ACMServer.MipPlugin.msi: Installer for the XProtect Event Server ACM MIP Plugin
a) Must be installed on the XProtect Machine that hosts the Event Server Windows service
ACM Server
Copy the “Milestone.ACMServer.msi” file to a temporary folder on the Lenel server and double-click to install, you should see a
screen similar to the following:
In the next dialog, if installing on a Lenel machine running an OnGuard version greater than or equal to 7.4, leave the ACM
Server set to run as LocalSystem.
If installing on a Lenel machine running an OnGuard version less than 7.4, enter the credentials of an admin user on the local
machine. Note that this admin user must be linked to a Lenel Directory that is configured for single signon (see Configure Lenel
OnGuard for Single Sign-On). The installer will give this user the “Log on as a service” right in Windows (see the following image).
Do not leave the fields blank. WMI integration will not work if the ACM Server is running as the Local System Account. Do not prefix
the user name with the machine name or “.” (e.g. machineName\userName, .\userName).
www.milestonesys.com Page 18 Installation
V1.0 – 08/25/2014
Press next and you will now be able to select the installation path, it is recommended to use the default as displayed:
Press next and you are now ready to install, if you are satisfied with the selected options, press install to continue:
Install progress...
You can verify that the service installed successfully by looking in the Services control panel for a service named Milestone ACM
Server.
The Lenel-OnGuard plugin automatically detects the presence of both the Lenel server and the pre-installed ACM Server. If either
is missing it will refuse to install.
Press Next to go to the Options screen. Here is where you tell the plugin to provide ACM Server-scoped IDs (i.e. ”Use new IDs”) to
XProtect, or not.
• If you are upgrading a legacy plugin, do not use new IDs. This is to ensure that the the upgraded plugin uses the same IDs
already being used by XProtect for the Lenel panels, readers, card holders, etc.
• If you are installing a new plugin, or upgrading a non-legacy plugin, then use new IDs. This will ensure that the IDs are
scoped to a particular ACM Server.
IMPORTANT – If using new IDs, then changing the Lenel server machine name after installing the plugin will break the
plugin.
Press Next to go to the final screen. When you are ready, press install.
You have successfully installed the Milestone ACM Server Lenel-OnGuard Plugin
You can verify that the Lenel-OnGuard Plugin is installed and loaded from the logs below:
If you are satisfied with the path selection and you are ready to install press ”Install”
Installation progress...
You have successfully installed the ACM MIP Plugin for ACM Server
Configuration
On the Lenel server machine, click the Windows Start menu and type “services”. Right click Services and select “Run as
administrator”.
Click the “Log On” tab, select “This account”, and enter the credentials of an admin user on the local machine. Note that this admin
user must be linked to a Lenel Directory that is configured for single signon (see above for configuring single signon).
Reducing Permissions
It is not recommended to reduce the Lenel Sql Server database permissions of the single signon user since we don’t know exactly
what the minimum permission set is. If you want to reduce the single signon user permissions, contact Lenel Support.
Once you click next, you will have to provide the IP Address / Machine name of the Lenel server on which the ACM Server package
was installed.
After you have provided the server name/ip address and pressed next, you should get the following screen after the software has
validated that there is an ACM Server present at that address. The green checkmark means that it has successfully connected to
the provided server name, the red x means that it failed to connect to the provided server. The wizard will not allow you to proceed
without a valid connection to the server.
Note that the most common causes of the wizard not being able to connect to the provided server is that 1) you entered the wrong
IP information, or 2) the ACM Server on the Lenel machine is not running with sufficient administrative privileges.
Once you have a successful connection, notice that there is a list of checkboxes under the server heading that represents all
detected ACM server plugins installed on that machine. In this case we are looking for Lenel-OnGuard.
Check the box circled in red below and press next to install a MIP plugin on this host to connect to the Lenel-OnGuard server
identified.
This screen will confirm what actions are going to happen. Once you are ready to install, press finish.
Once the operations are completed, the wizard will display a green checkmark for successful operations and a red x for failed
operations.
You have successfully installed the ACM Server: XProtect MIP ACM Plugin.
This will pop up a wizard to step you through the access control instance creation process. Type a name for the instance of the
plugin you wish to create and select from the drop down box the integration plug-in. Note that you will find a plugin named Lenel-
OnGuard-OnGuardAcmServer-{ServerName} where {ServerName} is the name of the machine where Lenel and ACM Server are
installed.
After selecting the plugin, you will have to provide credentials and parameters to configure the connection to the Lenel database
server, optimize particular settings, etc.
Some of these settings only apply if the Lenel OnGuard version is < 7.4; and some apply only if the version >= 7.4. The reason for
this is that the underlying OnGuard APIs changed – prior to 7.4, DataConduit was used; and from 7.4 on, OpenAccess was used.
However, all the properties used for all versions of OnGuard are shown in the Management Client wizard.
All Versions
• ConnectionProfileName
• DbMachineName
• DbInstanceName
• DbName
• DbUserName
• DbPassword
• DbUsesIntegratedSecurity
• CardHolderProcessSleepInterval
• ReaderPollingInterval
• LivePropertyUpdateInterval
• DoEventPropagation
• DoProcessStateChanges
• DisableCommands
Property Details
ConnectionProfileName – Should be set to the same as was shown in the ACM Wizard when you added the ACM server. For
example:
DbMachineName – Name of the computer hosting the Lenel OnGuard SQL Server instance
DbInstanceName – Name of the SQL Server instance hosting the Lenel OnGuard Access Control database. Leave blank to
connect to the default SQL Server instance.
DbName – Name of the Lenel OnGuard Access Control database.
DbUserName – User name to login to the Lenel OnGuard Access Control database.
DbPassword – Password to login to the Lenel OnGuard Access Control database.
DbUsesIntegratedSecurity – Flag indicating if the Lenel OnGuard Access Control database uses integrated security. If false, the
database user name and password is required.
CardHolderProcessSleepInterval – Defines how long the Lenel plugin will sleep (in minutes) between fetching card holders from
Lenel OnGuard. Legitimate values are greater than zero. This is here as a safety to ensure that card holders are kept up-to-date
even if card holder modification events from Lenel OnGuard are not received or missed.
ReaderPollingInterval – Defines how long the Lenel plugin will sleep (in minutes) between fetching door and reader information
from Lenel OnGuard. Legitimate values are greater than zero. OnGuard doesn’t provide notification of certain reader attribute
changes (e.g. extended strike time) so this polling provides a way to force the system to refresh reader information.
LivePropertyUpdateInterval – As hardware events are received from OnGuard, this property defines the time to wait before
updating a device's live properties (e.g. reader mode, device hardware status) (in seconds) again. Legitimate values are greater
than or equal to zero. This property allows tradeoffs to improve OnGuard event processing speed. For every hardware event
received from OnGuard, the Lenel ACM integration generates related state change events. These state change events are very
slow to process compared to the raw hardware events; this delay is caused by having to update the devices’ live properties. The
smaller you set LivePropertyUpdateInterval, the more “real time” will be those live property values; however, the cost is more cpu
usage and slower state change processing. The higher you set LivePropertyUpdateInterval, state change processing will be faster
due to using the currently cached values of the live properties; the cost is that state change events may be sent to MIP that contain
“stale” live property values.
DoEventPropagation – If checked, then applicable events will be propagated to child hardware. For example, a panel offline event
would end up triggering offline events for all the panel’s child hardware (e.g. readers, alarm panels, inputs, outputs, etc). If not
checked, event propagation is not done.
Note that certain functionality is dependent on event propagation. For example, if event propagation is disabled, a Smart Client
reader map icon may not display the correct state when its panel is toggled between online and offline because we rely on
receiving reader online/offline events to keep that up-to-date.
www.milestonesys.com Page 41 Configuration
V1.0 – 08/25/2014
DoProcessStateChanges – If unchecked, then state change processing (including propagated state changes) is disabled. If
checked, state change processing is performed and the DoEventPropagation setting is respected. This property can be disabled to
maximize raw OnGuard event processing speed. Note that unchecking this property will prevent XProtect Smart Client map icons
from showing the current device state.
DisableCommands – This is a setting to enhance security. If checked (the default), then no commands will be executed. The
commands will still be visible in XProtect Smart Client maps and in the Dev tabs of the XProtect Management Client; however, they
will be silently ignored if a user attempts to execute them. If unchecked, commands will execute as normal.
EventProcessBatchSize – Defines the maximum number of events to process per batch. This is an approximate number; the
actual number could be less than or slightly more than this number due to several factors – less events available, more events with
the same filter criteria, etc.
EventProcessSleepInterval - Defines how long the event processor subsystem will sleep (in milliseconds) between batches of
events. Legitimate values are greater than zero. The subsystem does not sleep when it finishes a batch of events if there is another
batch of events ready to process.
EventCommandTimeout – Events are fetched from OnGuard using a direct SQL query. Internally, there is a timeout for how long
to wait to get the results of the query. This default timeout is 30 seconds. When querying for events from an OnGuard table
containing many (i.e. millions) of rows, the query can easily take longer than 30 seconds. In that case, the query will fail, events
won’t get processed, and errors will be written to the debug log. To prevent failures in this situation, increase the event command
timeout (e.g. 240 seconds). Legitimate values are greater than or equal to 30 seconds. Changing this property value has NO impact
on the actual time it takes to perform the query; it only is an attempt to prevent premature timeouts. It is always better to keep the
number of rows in the OnGuard EVENTS table to a reasonable amount. OnGuard provides the capability to archive events; contact
Lenel Support for help setting that up.
OpenAccessMachineName – Name of the machine hosting the OnGuard OpenAccess service.
OpenAccessMachinePort – The port the OnGuard OpenAccess service is listening on.
OpenAccessPageSize – The OnGuard OpenAccess service limits the number of instances returned for a given query. For
example, multiple queries are required if the number of OnGuard card holders is greater than the page size. Legitimate values are
greater than or equal to 20 and less than or equal to 100. Performance is better with a larger page size.
OpenAccessUserName – The name of an OnGuard administrative user to use to log into the OnGuard OpenAccess web service.
This user should have access to all hardware, cardholders, etc in the system.
OpenAccessPassword – The password of an OnGuard user to use to log into the OnGuard OpenAccess web service.
OpenAccessDirectory – The name of the OnGuard directory to be used when loging into the Onguard OpenAccess web service.
If left blank, the OnGuard internal directory will be used.
The wizard will now fetch the configuration of the Lenel AC system into Milestone.
The screen below is an example of the configuration found on the server:
On this screen an association has to be created between each access point of a door and cameras in the Milestone system. This
is done so that the system will know which cameras to display on door alarms. For each access point of each door drag a camera
from the right tree and place it under the desired access point to create the association. Note that this can also be configured later
in the Milestone Management application.
When there is more than one access point per door, you can select the different cameras for the different angles. You can also
select more than one camera per access point:
Once all the access point cameras have been associated, the wizard completes.
You can verify that the integration module is now connected by looking at the Access control tree.
Reducing Permissions
In the image above, the DbName and DbUserName fields defined the credentials the Lenel ACM integration uses for read-only
access to the Lenel database. This section is only about minimizing the database permissions for this database access.
Since you’re considering changing the Sql Server permissions for the login used by the Lenel ACM integration, this section
assumes you know how to perform the required steps in Sql Server to create/modify a login.
We’ve tested the Lenel ACM integration with the following minimal database permissions:
• Has only the “public” server role.
• User mapping to only the Lenel AccessControl database.
• Has only the following database roles for the AccessControl database:
• db_datareader
• public
• Has only the “Connect SQL” securable.
Personalized Login
Personalized login is an optional feature of XProtect access control plugins. If enabled, when someone logs into the Smart Client,
for each access control instance with personalized login enabled in the Management Client, the smart client will ask for user
credentials. These credentials will be validated against the specific access control system, and, if valid, will be used to fetch a
personalized configuration from the access control system. The personalized configurations will be used throughout that instance of
the Smart Client.
When personalized login is being used, XProtect manages two configurations – a “global” one used by the Management Client,
and, as described above, personalized configurations used by the Smart Client. The personalized configurations are always
subsets of the global configuration. This is necessary to ensure proper event handling, command execution, etc.
An access control plugin must specifically support personalized login. The Lenel ACM plugin does support it only when running on
OnGuard 7.4 or greater since the Lenel OpenAccess API is required to support it.
After entering the user name and password, the XProtect will attempt to validate the credentials against the specific access control
system. If the validation fails, you’ll see:
If you click Skip, the Smart Client is opened without using personalized login.
The Smart Client will not show any entities that are not in (or related to entities in) the personalized configuration. For example, a
personalized user will only see:
• Alarms related to hardware in their personalized configuration.
• Events related to hardware in their personalized configuration.
• Devices in the map element selector that are in their personalized configuration.
XProtect Personalized Login doesn’t specifically include personalized alarm acknowledgment. Rather, as with non-personalized
login, any user can acknowledge any alarm that is visible in the Smart Client. Since alarms will only be visible if the underlying
device is in their personalized configuration, then users can only acknowledge alarms related to hardware they can see.
OnGuard does not support personalized command execution. That is, a user can execute any applicable commands on any
devices that are visible to that user.
1,0,0,Access Granted,granted_access_granted,0x000000FF,True
2,0,1,Access Granted on Facility Code,granted_facilitycode,0x000000FF,True
3,0,2,Access Granted No Entry Made,granted_noentrymade,0x000000FF,False
4,0,3,Access Granted on Facility Code| No Entry Made,granted_fcnoentrymade,0x000000FF,False
When the event types are initially processed, all the hardware types are set to All (i.e. 0xFF)
The intent of this file is to allow an administrator to tailor the description, hardware types, and door animation for specific event
types. The Id, Type, SubType, and Name fields should never be changed as they correspond to identifiers used by Lenel
OnGuard.
If you’re going to modify an event type’s description be aware that any description containing embedded commas must have
those embedded commas changed to pipe characters (i.e. “|”). See the last line of the example lines shown above where the
logical string “Access Granted on Facility Code, No Entry Made” has its embedded comma replaced.
After making and saving changes to the event type file, the administrator should do the following:
1. On the Lenel machine – restart the ACM server.
2. On the XProtect machine – refresh the configuration from within the XProtect Management Client. See MIP Plugin Upgrades
for an image showing the Management Client’s Refresh Configuration button.
Operations
The search can be made by first name, last name, card number, and employee id. Enter the search string in the search cardholder
text box.
Cardholder Properties
The XProtect Management Client does not provide scrolling for the cardholder properties. In the image below, if the properties (see
the red square) are so many that the list is longer than the display area, they will simply run off the bottom edge of the screen and
will not be visible.
OnGuard allows customization of the Cardholder UI in their System Administration application. It’s easy for a customer to define
enough custom fields to extend beyond the visible region shown above for the XProtect Management Client.
The Lenel ACM plugin manages a configuration file
C:\ProgramData\VideoOS\ServiceHost\Services\VideoOSACMServerService\Plugins\OnGuardAcmServer\CredHolderProps.dat.
This configuration file is created the first time credential holders are fetched. By default, it includes all cardholder fields.
Its contents are simply a list of column names from the OnGuard EMP and UDFEMP database tables that you want shown in the
XProtect Management Client. The properties will be displayed in the order and case (i.e. uppercase, lowercase, or a mixture) they
are defined in CredHolderProps.dat. You can remove any fields you don’t want displayed and change the order of the fields.
Column names that don’t exist will be ignored.
Note that the cardholder’s badge numbers are always displayed as the first property.
After making changes to CredHolderProps.dat, you should restart the ACM Server; then close all XProtect clients, restart the
XProtect Event Server, and then re-open the XProtect clients. This is necessary as XProtect caches cardholder data. Restarting
everything clears those caches and then you’ll see the cardholder properties displayed as you have them configured in
CredHolderProps.dat.
Click Add, name the category a pertinent name which represents the group of events, and press OK.
Save your changes and move to the Alarm Definitions section to create an alarm based on that user-defined event category.
Name the alarm a pertinent name and select Access Control Event Categories in the Triggering event dropdown:
Select the new user-defined event category that was defined earlier:
Select the devices/recording server/management server hyperlink and select the event source. To select any source select the
System (+units) node.
The wizard will look like this after selecting the “Access Denied” event and System (+ units) source:
Press next and select the optional time frame when the action will take place. In this example no time frame has been selected,
this means it will always execute.
Select the action that will be executed when the Lenel event occurs. Notice that AC commands can be used as actions based on
any events that come into Milestone:
In this example “create bookmark on <device>” will be selected, click the Bookmark hyperlink and the following dialog will be
displayed to setup the bookmark action:
Click the devices hyperlink and select the device on which the bookmark will be applied:
Click next on the rule wizard and select an optional stop criteria, in this example there is no stop criteria.
Use an existing view, go into setup mode by pressing the setup button in red below and create a map by dragging it onto a tile once
in setup mode.
Select the access control button on the map overview and drag doors from the Element Selector to the map
The finalized map with the doors and server added in this example will look like this:
The following dialog will appear: to set access monitor tile settings select the door, sources, camera, and event types:
Once set the tile(s) can be used to monitor access events from each door configured above:
Alarm Acknowledgment
Alarm acknowledgment from XProtect (2016 R3 or greater) to Lenel is implemented. In XProtect versions earlier than 2016 R3, you
can still perform alarm acknowledgment in XProtect, but it will not be propagated to Lenel.
Alarm acknowledgment from Lenel to XProtect is not implemented due to the lack of such functionality in Lenel.
Alarm acknowledgment is done in the XProtect Smart Client’s Alarm Manager tab. If you right-click an alarm, and select either
Acknowledge or Close, the alarm will be acknowledged in Lenel.
NOTE – As mentioned above, selecting either Acknowledge or Close will cause the alarm to be acknowledged in Lenel and
removed from OnGuard’s active alarm list. But, selecting Acknowledge above does not remove the alarm from XProtect’s Alarm
Manager list. XProtect considers acknowledgment and closing the alarm to be different steps. The result of all this is that, if you first
acknowledge and then close the alarm in XProtect, you will see an error in the debug log about failure to acknowledge the alarm in
Lenel. The reason is simple – the alarm was removed from OnGuard’s active alarm list when you did the acknowledgment;
therefore it didn’t exist when you did the close. This does not cause problems; just noise in the debug logs.
Troubleshooting Guide
If you don’t see these lines, or you expect a communication failure between the Evert Server MIP plugin and Lenel-OnGuard ACM
plugin, take a look at your firewall settings, rules, etc. You may need to adjust them to allow communication.
Note that, by default, the ACM Server’s web service uses HTTPS on port 8443. You may have configured your ACM Server
differently (see ACM Server: XProtect ACM MIP Plugin for where you configured the ACM Server connection on the Milestone
Event Server).
Go to Configure SQL Server for Connections for properly configuring the SQL Server supporting your Lenel installation.
www.milestonesys.com Page 62 Troubleshooting Guide
V1.0 – 08/25/2014
No matter what settings you adjust, all raw events received from OnGuard get sent to XProtect.
If DoProcessStateChanges is enabled, for every raw event received from OnGuard, the Lenel ACM integration will create
corresponding “state change” events. If the raw event is for a “parent” device (e.g. panel, door, I/O control module), and if the
DoEventPropagation setting is enabled, state change events may also be created for child devices (e.g. reader, inputs, outputs).
When added together, state change and propagated state change events add a large number of events to be sent to XProtect.
Therefore, if you’re only interested in optimizing raw OnGuard event processing, disabling DoProcessStateChanges will result in
better performance as it drastically reduces the number of events sent to XProtect. However, XProtect Smart Client map icons
won’t display status changes since no state change events get sent to XProtect.
On one of the Milestone test systems, we achieved almost real time firing of OnGuard events to XProtect with all the default
settings except:
• DoProcessStateChanges disabled
• LivePropertyUpdateInterval = 3600 seconds (effectively disabling live property updates for the duration of the test)
Use the LenelEventCntr.exe utility included in the distributed zip file to count events processed and provide some metrics (e.g.
events per second, etc).
Refreshing Cardholders
The XProtect Management Client’s Cardholders tab doesn’t provide a way to force a refresh of the cardholders. “Refresh” means
performing a full download of all the active cardholders from Lenel OnGuard.
The Lenel ACM integration downloads cardholders from OnGuard at the following times:
1) When the ACM Server is started.
2) When the CardHolderProcessSleepInterval (see Milestone Management Client Configuration) occurs.
3) When XProtect Management Client property values change (see Milestone Management Client Configuration) are saved.
So an easy way to force cardholders to be downloaded is to simply fake changing a property value in the Management Client and
then click the Save button. “Fake changing” means simply changing a property value and then, before saving, reset the property
value back to its original value.
WMI-Related Errors
If you’re getting WMI-related errors in the Lenel ACM log files, they’re typically due to the OnGuard Single-Signon (SSO) user. The
SSO user may not be set up correctly, may be missing some permissions, etc.
A workaround to verify that the errors are indeed due to SSO user permissions, is to change the currently configured Lenel SSO
user to the built-in “System Account” user. This built-in user has all possible permissions within OnGuard.
Steps:
1. Log into OnGuard’s System Administration application as the Lenel “SA” user. Open the Administration + Users view.
2. For the current SSO user, unlink the SSO domain account from the SSO directory.
3. Link the built-in “System Account” user to the SSO directory using the SSO domain account.
4. Restart the LS DataConduIT service.
5. Verify that the Milestone ACM service is running as the SSO domain account.
6. Restart the Milestone ACM service.
7. Inspect the Lenel ACM logs to see if the errors went away.
Logging
By default the debug logs are enabled on both the milestone event server plugin and the Lenel server but they are at a reduced log
level (Info). They can be increased for diagnostics purposes to Debug (or even Trace) but be aware that this change causes more
information to be logged using more disk space and possibly slowing down operations on busy servers. DO NOT LEAVE logging
at Debug levels for extended periods of time for performance reasons. It should only be used for diagnostics purposes and put
back to Info afterwards.
Known issues
• This ACM integration was only tested against the MIP SDK 2017. The MIP SDK is backwards-compatible; so it is
assumed that the ACM integration will work with MIP SDK 2016 and 2014.
• This ACM integration has only been tested when running the Lenel and Milestone systems on Windows Server 2012 R2.
• This ACM integration is currently coded to only work with a Lenel system using SQL Server as its database. Oracle
integration has not been implemented yet.
• Only United States English installers are available.
• Lenel OnGuard doesn’t model doors; they work only with readers. But Milestone ACM requires doors to be modelled.
Therefore, the Lenel-OnGuard plugin creates virtual doors based on reader properties (i.e. panel id, panel address, reader
number, etc). Currently, the virtual door names are based on the first reader that has a non-empty display name. So if that
reader is named “reader 1”, that’s what the door will be named. This may not be intuitive when viewed in the XProtect
Management or Smart Client applications’ hardware hierarchy.
• When creating a new ACM instance on the Access Control tab in the XProtect Management Client, especially when
creating the first instance, it may take 1 or 2 clicks of the Next button in the wizard before configuration is successfully
fetched from the Lenel system.
• See the negative side-effects of upgrading.
• Lenel Enterprise is not supported.
Events Handled
The Lenel OnGuard ACM integration will attempt to handle all the events generated by Lenel.
The actual events handled may vary from one version of Lenel to another. There may also be other circumstances that affect if the
integration can handle an event or not (e.g. the Lenel API used by the integration doesn’t forward the event, the event relates to a
type of hardware not supported in the integration, etc).
LenelFetchEventTypes Utility
To see the events that a particular version of Lenel OnGuard generates, there is a utility called LenelFetchEventTypes.exe
provided with the Lenel ACM integration release. Look in the Tools directory within the release’s zip file.
This application does not require the Lenel ACM integration at all. It is completely independent of the integration.
This application must be run on the Lenel OnGuard machine where the Lenel database is located. Enter the database connection
parameters when requested by the application.
After fetching the events from the database, it will prompt you to write the event list to the console window or a file. If you choose
the console window, ensure that you’ve increased the console’s buffer size; for example, Lenel 7.3 systems have about 1820
events and the default Windows console buffer size is 300. If you choose to write the list to a file, that file will be overwritten if it
already exists; otherwise, it will be created.
Note that piping the output of the application to a file on the command line does not work due to the interactive prompts generated
by the application.
24 Hour Alarm
24 Hour Alarm Restore
24 Hour Auto Test
24 Hour Non-Burglary Alarm
24 Hour Non-Burglary Alarm Restore
24 Hour Report Closed
24 Hour Report Open
24 Hour Zone Bypassed
24 Hour Zone Unbypassed
30 Minutes Since Fallback Command
32 Hour Event Log Marker
AC Battery Fail
AC Restore
AC Trouble
ACU Firmware Upgraded
AFC Mode Off
AFC Mode On
ARDIS Module Communication Loss
ARDIS Module Communication Restored
Abort
Accepted Biometric Score
Access Closed
Access Code Used
www.milestonesys.com Page 68 Events Handled
V1.0 – 08/25/2014
Access Denied
Access Denied (denied_access_denied)
Access Denied : AAM Timeout
Access Denied : AAM Validation Failed
Access Denied Door Secured
Access Denied Interlock
Access Denied Passback
Access Denied Unauthorized Arming State
Access Denied Unauthorized Entry Level
Access Denied Unauthorized Time
Access Denied Under Duress
Access Denied to Destination Floor
Access Denied: Access Control Format Not Found
Access Denied: Area Empty
Access Denied: Area Occupied
Access Denied: Asset Required
Access Denied: Biometric Reader Offline
Access Denied: Card Expired
Access Denied: Escort Timeout Expired
Access Denied: Invalid Access Control Data
Access Denied: Invalid Access Control Data Length
Access Denied: Invalid Access Control Data Parity
Access Denied: Invalid Access Control Data Type
Access Denied: Invalid Smart Card Authentication
Access Denied: Invalid Smart Card Data
Access Denied: Invalid Smart Card Location
Access Denied: Invalid Smart Card Type
Access Denied: Invalid Timezone
Access Denied: No Biometric Template
Access Denied: No Occupant Approval
Access Denied: Reader Locked
Access Denied: Secured Mode
Access Denied: Smart Card Format Not Found
Access Door Propped
Access Door Status Monitor Shunt
Access Door Status Monitor Trouble
Access Exit Request Trouble
Access Granted
Access Granted (intrusion_granted_access_granted)
Access Granted - Anti-Passback Not Used
Access Granted - Anti-Passback Used
Access Granted Entry Made
Access Granted No Entry Made
Access Granted Under Duress
Access Granted Under Duress - No Entry Made
Access Granted on Facility Code
Access Granted on Facility Code, No Entry Made
Access Granted to Destination Floor
Access Granted: Reader Unlocked
Access Level Change
Access Lockout
Access Open
Command Sent
Communication Access Denied
Communication Access Restored
Communication Initialization Failed
Communication Path Switch - Primary to Secondary
Communication Path Switch - Secondary to Primary
Communication Trouble Restore
Communications Fail
Communications Lost
Communications Restore
Communications Restored
Communications Trouble
Communications With Host Lost
Communications With Host Restored
Complimentary Tender
Computer Trouble
Config No Reply
Congestion
Congestion (C)
Congestion (C) Restored
Congestion (R)
Congestion (R) Restored
Congestion Restored
Controller Connection Mismatch
Controller Encryption Error
Controller Memory Overflow - Badges
Credit Card Tendered
Cross Zone Trouble
Current Time
Custom Function Executed
Custom GOV Length Incompatible With Camera Recording Settings
DURESS - Access Denied Under Duress
DURESS - Access Denied: Area Empty
DURESS - Access Denied: Area Occupied
DURESS - Access Denied: Asset Required
DURESS - Access Denied: Biometric Reader Offline
DURESS - Access Denied: Escort Timeout Expired
DURESS - Access Denied: No Biometric Template
DURESS - Access Denied: No Occupant Approval
DURESS - Access Denied: Reader Locked
DURESS - Access Granted
DURESS - Access Granted - Anti-Passback Not Used
DURESS - Access Granted - Anti-Passback Used
DURESS - Access Granted No Entry Made
DURESS - Access Granted Under Duress
DURESS - Access Granted Under Duress - No Entry Made
DURESS - Access Granted on Facility Code
DURESS - Access Granted on Facility Code, No Entry Made
DURESS - Access Granted: Reader Unlocked
DURESS - Anti-Passback Violation
DURESS - Area Closed
DURESS - Area Limit Exceeded
Duct Alarm
Duct Alarm Restore
Duress
Duress Access Grant
Duress Disable
Duress Egress Grant
Duress Enable
EEPROM Fault
EEPROM Fault Restored
Early Close
Early Open
Early to Open From Alarm
Egress Denied
Egress Granted
Elevator Terminal Mode Access to Authorized Floors
Elevator Terminal Mode Default Floor
Elevator Terminal Mode Default Floor or User Entry of Destination Floor
Elevator Terminal Mode User Entry of Destination Floor
Embedded Analytics Failure
Embedded Analytics Restored
Emergency Alarm
Emergency Alarm Restore
Emergency Bypass
Emergency Close
Emergency Off
Emergency Open
Emergency Restore
Emergency Supervisory
Emergency Trouble
Emergency Trouble Restore
Emergency Unbypass
Employee Sign Off
Employee Sign On
End of Office Mode
Engineer Reset
Entry Exit
Entry/Exit Alarm Restore
Equipment Fail Restore
Equipment Failure Condition
Error
Event Log 50% Full
Event Log 90% Full
Event Log Reset
Event Recording Threshold Exceeded
Event Recording Threshold Restored
Event not Sent
Exception Open/Close
Exception Schedule Change
Exit Alarm
Exit Error
Exit Error - Zone
Exit Push Button Failure
Foodstamps Tender
Force Close Early
Force Close Late
Force Close Late Point
Forced Access
Forced Armed Perimeter Delay
Forced Armed Perimeter Instant
Forced Closing
Forced Perimeter Arm
Forced Point
Freeze Alarm
Freeze Alarm Restore
Freeze Bypass
Freeze Restoral
Freeze Supervisory
Freeze Trouble
Freeze Trouble Restore
Freeze Unbypass
Full Panel Download Completed
Full Panel Download Started
Gas Alarm
Gas Alarm Restore
Gas Bypass
Gas Restore
Gas Supervisory
Gas Test
Gas Trouble
Gas Trouble Restore
Gas Unbypass
Gasoline Prepayment
Gasoline Prepayment Refund
Gate Valve Sensor
Gate Valve Sensor Restore
Generic Event
Get Lock Mode Failed
Get Lock Mode Success
Global Linkage Action Executed
Global Linkage Action Failed
Grant Last User (Override)
Granted Access, Common Pin
Granted Double Card
Granted-Dual Custody
Granted-Escort
Granted-Exit-Dual Custody
Granted-Exit-Escort
Granted-Exit-Master
Granted-Master
Granted-Pending Entry
Ground Fault
Ground Fault Restore
Grounded Loop Alarm Active
Group Bypassed
Not Configured
Not Dialing
Notify Appliance Circuit #3
Notify Appliance Circuit #4
Object Crosses A Region (R)
Object Crosses A Region (R) Restored
Object Crosses a Region
Object Crosses a Region (C)
Object Crosses a Region (C) Restored
Object Crosses a Region Restored
Object Detection
Object Detection (C)
Object Detection (C) Restored
Object Detection (R)
Object Detection (R) Restored
Object Detection Restored
Object Left Behind
Object Left Behind (C)
Object Left Behind (C) Restored
Object Left Behind (R)
Object Left Behind (R) Restored
Object Left Behind Restored
Object Lurking
Object Lurking (C)
Object Lurking (C) Restored
Object Lurking (R)
Object Lurking (R) Restored
Object Lurking Restored
Object Moves Too Fast
Object Moves Too Fast (C)
Object Moves Too Fast (C) Restored
Object Moves Too Fast (R)
Object Moves Too Fast (R) Restored
Object Moves Too Fast Restored
Object Removed
Object Removed (C)
Object Removed (C) Restored
Object Removed (R)
Object Removed (R) Restored
Object Removed Restored
Object Starts To Move (R)
Object Starts To Move (R) Restored
Object Starts to Move
Object Starts to Move (C)
Object Starts to Move (C) Restored
Object Starts to Move Restored
Object Stops
Object Stops (C)
Object Stops (C) Restored
Object Stops (R)
Object Stops (R) Restored
Object Stops Restored
Sale Subtotal
Schedule Changed
Schedule Executed
Schedule Resumed
Schedule Suspended
Scheduler Action Executed
Scheduler Action Failed
Secondary Communication Path Lost
Secondary Communication Path Restored
Security Alarm Acknowledge
Security Alarm Block Acknowledge
Security Alarm In
Security Alarm Out
Security Denied Blocked Mode
Security Denied Privacy State
Security Mode Card Not Swiped
Security Passage Denied Blocked Mode
Security Passage Denied Privacy State
Self-Test Fail
Self-Test Fail Restore
Senior Watch Trouble
Sensor Reset
Sensor Self Test Fail
Sensor Supervisory Fail
Sensor Tamper
Sensor Tamper Restore
Sensor Tamper Trouble
Sensor Tamper Trouble Restore
Sensor Trouble
Sensor Trouble Restore
Sensor Watch Trouble
Serial Interface Device Communication Loss
Serial Interface Device Communication Restored
Serial Interface Device Receive Error
Serial Interface Device Receive Error Restored
Serial Interface Device Transmit Error
Serial Interface Device Transmit Error Restored
Service Completed
Service On/Off Premise
Service Requested
Service Required
Service Walk Test Ended
Service Walk Test Started
Shorted Line Alarm Active
Shunted
Signal Silence
Silent Alarm
Silent Alarm Restore
Silent Burglary Alarm
Silent Burglary Alarm Restore
Slot/Line Caller Unknown
Slot/Line Codec Error