Deploy One OTserver Scanner per Production Line

Placement and scope

Place one scanner host at each approved production line or cell boundary. Set its interface and target list to that line, and map its output to the matching OTserver site. Layer 2 discovery remains local while the manager stays central.

Scanner configuration

Create otscanner.json beside each scanner binary:

Keep apiKey out of the file and provide OTSERVER_API_KEY to the process. Run once for an authorized baseline:

1

OTSERVER_API_KEY='...' otserver-scanner scan --ack-authorized

On Windows, keep the same otscanner.json beside otserver-scanner.exe and run:

1
2

$env:OTSERVER_API_KEY = '...'
.\otserver-scanner.exe scan --ack-authorized

The Windows GUI can load the line configuration and run the scan interactively with the same protocol and authorization controls. Use Task Scheduler for the weekly unattended command and keep --ack-authorized in the task arguments.

The scanner validates the JSON, uploads it to the configured site, and keeps the local file if upload fails. Command-line values override the file, so the authorization flag remains visible in scheduled commands.

For a weekly Linux schedule, use a systemd oneshot service with ExecStart=/opt/otserver-scanner/otserver-scanner scan --ack-authorized and a timer with OnCalendar=weekly.

Windows Task Scheduler

Run PowerShell as Administrator on the scanner host:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

$scannerDir = 'C:\OTserver Scanner'

$action = New-ScheduledTaskAction `
  -Execute "$scannerDir\otserver-scanner.exe" `
  -Argument 'scan --ack-authorized' `
  -WorkingDirectory $scannerDir

$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At '02:00'
$principal = New-ScheduledTaskPrincipal `
  -UserId 'SYSTEM' `
  -LogonType ServiceAccount `
  -RunLevel Highest

Register-ScheduledTask `
  -TaskName 'OTserver Scanner - Line 10' `
  -Description 'Authorized weekly OT discovery scan for production line 10' `
  -Action $action `
  -Trigger $trigger `
  -Principal $principal

Keep otscanner.json beside the executable. If direct upload or SNMP is enabled, make the required environment variables available to the scheduled task’s service account; keep credentials out of otscanner.json.

Verify the result

Confirm that each line’s site receives only its own assets, that the import warning count is reviewed, and that the scanner host’s API key has read/write access only to the intended site.

Plan isolated collection or structure the site tree.