Vtrin-SIEC: Centralized Security and Network Event Collection
Vtrin-SIEC is an automatic security monitoring service that collects alerts and events from your entire IT infrastructure and stores them in one place for easy search and analysis.
Why You Need Vtrin-SIEC
Modern IT environments generate security alerts from many sources:
- Network devices (routers, switches, printers) send automated alerts
- Windows servers generate application and security logs
- Linux servers create system and authentication logs
Without a central collection point, these events stay scattered across your infrastructure, making it impossible to investigate security incidents or maintain compliance.
Vtrin-SIEC solves this by: Automatically collecting all events in one searchable database, so you can correlate incidents, investigate problems, and prove compliance.
What It Does
| Feature | Benefit |
|---|---|
| Listens 24/7 | Automatically monitors all three event sources |
| Selective Collection | Only stores events you care about (by severity level) |
| Cross-Platform | Works on Windows and Linux/WSL |
| Unified Storage | Stores all events together for correlation |
| Secure SNMP | Uses encryption for network device communication |
| Searchable Archive | Find events by device, time, type, or severity |
How It Works
Your Environment
├─ SNMP Devices (send network alerts)
├─ Windows System (generates event logs)
└─ Linux System (generates syslog)
↓
Vtrin-SIEC Service
(listens and collects based on your preferences)
↓
RTDB Database
├─ SimpleConfig Table (stores your preferences)
└─ EquipmentEvents Table (stores collected events)
↓
ABB Ability™ History
(search, analyze, report)Three Types of Events Collected
1. SNMP Traps (Network Devices)
What: Automatic alerts from routers, switches, printers, network devices
Examples:
- Port went offline/online
- Disk space running low
- Device restarted
- Authentication failed
Severity: Information (normal) → Warning (caution) → Error (urgent)
2. Windows Event Logs (Windows Systems)
What: Events from your Windows servers and PCs
| Log Type | Examples |
|---|---|
| Application | Software crash, service failed |
| System | Driver error, disk issue |
| Security | Login attempt, permission change |
Severity: Information (normal) → Warning (watch) → Error (failure)
3. Linux Syslog (Linux & WSL Systems)
What: Events from Linux servers
| Log File | Examples |
|---|---|
| syslog/messages | Service started, kernel message |
| auth.log | SSH login attempt, sudo command |
Severity: Emergency/Alert/Critical (urgent) → Error/Warning (caution) → Notice/Info (normal) → Debug (detailed)
Where Events Are Stored
All events go to the EquipmentEvents table with clear labels:
- SNMPTrap_* attributes → Network device alerts
- WindowsLog_* attributes → Windows server events
- LinuxLog_* attributes → Linux server events
Advantage: You can search and correlate events across all platforms at once.
SNMP Trap Basics
What is an SNMP Trap?
Network devices automatically send SNMP Traps — short alert messages — when something important happens. Vtrin-SIEC receives and translates these into readable information.
The Three SNMP Versions (Auto-Detected)
| Version | Security Level | Best For | Notes |
|---|---|---|---|
| SNMPv1 | None (readable) | Legacy devices | 1988 standard, old hardware only |
| SNMPv2c | None (improved) | Older networks | Still readable but better error info |
| SNMPv3 | Encrypted | Modern networks | Recommended for security |
Vtrin-SIEC automatically detects which version the device sends and handles it correctly.
SNMPv3 Security Options
If using SNMPv3, choose your protection level when setting up users:
| Level | Protection | What It Does | When to Use |
|---|---|---|---|
| NoAuth | None | No security | Testing only |
| AuthNoPriv | Identity checked | Verifies device is trusted | Internal networks |
| AuthPriv | Identity + Encrypted | Sealed envelope with lock | Internet, cloud, critical systems |
Quick Start: Installation
Install Command
Windows:.\Vtrin-SIEC.exe -i -d "C:\RTDB" -c "wss://localhost/vtrin" -l "C:\Logs" -s
Linux:./Vtrin-SIEC.exe -i -d "/var/rtdb" -c "wss://localhost/vtrin" -l "/var/log" -u "vtrin-user" -p "password123" -s
What Each Parameter Means
| Parameter | Purpose | Example |
|---|---|---|
-i | Install service | (no value needed) |
-d | Database location | "C:\RTDB" or "/var/rtdb" |
-c | Connection address | "wss://localhost/vtrin" |
-l | Log file location | "C:\Logs" or "/var/log" |
-s | Run as service | (no value needed) |
-u | Linux user name | "vtrin-user" (Linux only) |
-p | Linux password | "password123" (Linux only) |
What Happens During Installation
Automatic Setup
Windows:
- ✅ Opens firewall port 1162 for SNMP
- ✅ Starts monitoring Event Logs
- ✅ Creates SNMPv3 user accounts
- ✅ Starts the service
Linux:
- ✅ Enables firewall if needed
- ✅ Opens port 1162
- ✅ Monitors syslog
- ✅ Sets up file permissions
Both platforms:
- ✅ Stores your configuration in RTDB database
- ✅ Creates SNMPv3 credentials if needed
- ✅ Starts collecting events 24/7
- ✅ Runs automatically on system restart
Configuration (After Installation)
Where Settings Are Stored
Everything is saved in the RTDB database, SimpleConfig table, Section: Vtrin-SIEC
SNMPv3 Users (If Using SNMP v3)
Each user is stored separately for easy management:
Storage location:Key: SNMPv3Users.
What each row contains:
- Username
- Password (for authentication)
- Password (for encryption)
- Recovery algorithms
Benefits:
- Add/remove users without restarting
- Passwords persist across reboots
- Multiple users can exist simultaneously
- Easy password updates
Uninstallation
Remove Command
\Vtrin-SIEC.exe -r -d
What Gets Cleaned Up
- ✅ Service stops and is removed
- ✅ Firewall rules deleted (port 1162 freed)
- ✅ Monitoring stops
- ✅ Configuration removed from database
- ✅ SNMPv3 user credentials deleted
Important: Historical events are preserved in EquipmentEvents table for compliance records.
Using Collected Events
Search & Find Events
Once events are collected, you can:
✅ Search by time - Find events from specific dates/hours
✅ Filter by severity - Show only errors, or warnings, or everything
✅ Filter by source - Events from specific devices or servers
✅ Correlate incidents - See related events across platforms
✅ Generate reports - Create compliance and audit reports
✅ Track trends - Identify recurring problems
Event Details Stored for Each Type
SNMP Events Include:
- Device IP address
- Alert type (what happened)
- Device values (CPU %, disk space, etc.)
- Alert OID (technical identifier)
- SNMP version used (v1, v2c, or v3)
- If v3: security level used (NoAuth/AuthNoPriv/AuthPriv)
Windows Events Include:
- When it happened (date & time)
- Which log (Application/System/Security)
- What application/service logged it
- Full event message
- Event ID (technical code)
Linux Events Include:
- Server hostname
- When it happened (date & time)
- Which log file (/syslog, /auth.log, etc.)
- Process/service name and ID
- Full message text
Platform-Specific Details
Windows Requirements
- Permissions: Administrator to access all event logs
- Firewall: Port 1162 automatically configured
- Logs monitored: Application, System, Security
- Runs as: Windows service
Linux Requirements
- Permissions: Read access to /var/log directory
- Firewall: UFW automatically configured
- Logs monitored: /var/log/syslog, /var/log/messages, /var/log/auth.log
- Runs as: Linux service (with user account you specify)
Troubleshooting Quick Reference
| Problem | Solution |
|---|---|
| Port 1162 already in use | Stop other services using this port, restart Vtrin-SIEC |
| Event logs not collected (Windows) | Run installation as administrator |
| Syslog not collected (Linux) | Check read permissions on /var/log, verify syslog service running |
| Database connection failed | Verify database path, check network connectivity, ensure SimpleConfig table exists |
| SNMPv3 traps not received | Verify credentials in database, check firewall allows port 1162 |
Summary
| Capability | What You Get |
|---|---|
| Automatic Collection | 24/7 monitoring without manual intervention |
| Multiple Sources | Network devices, Windows, and Linux all in one place |
| Instant Search | Find events by time, device, type, or severity |
| Incident Correlation | See related events across all platforms |
| Compliance Ready | Historical archive for audits and regulations |
| Secure SNMP | Optional encryption for network device communication |
Key Takeaways
✅ One database stores all events (SNMP, Windows, Linux)
✅ Automatic setup - once installed, it monitors 24/7
✅ Flexible filtering - collect only the severity levels you care about
✅ Searchable archive - find events anytime
✅ Security integrated - encrypted SNMP available
✅ Cross-platform view - correlate incidents across your entire infrastructure
Result: You have complete visibility into your IT infrastructure's security status — automatically, centrally, and searchably.
Updated 13 days ago