AXIS S3008 Mk II Recorder

Show or hide the main menu.

Access the release notes.

Access the product help.

Change the language.

Set light theme or dark theme.

The user menu contains:

• Information about the user who is logged in.

• Change account : Log out from the current account and log in to a new account.

• Log out : Log out from the current account.

The context menu contains:

• Analytics data: Accept to share non-personal browser data.

• Feedback: Share any feedback to help us improve your user experience.

• Legal: View information about cookies and licenses.

• About: View device information, including AXIS OS version and serial number.

• Legacy device interface: Change the device’s web interface to the legacy version.

NTP settings: View and update the NTP settings. Takes you to the Date and time page where you can change the NTP settings.

Recordings: View ongoing and filtered recordings and their source. For more information, see

Shows the storage space where the recording is saved.

Upgrade AXIS OS: Upgrade the software on your device. Takes you to the Maintenance page where you can do the upgrade.

View details: View and update the list of connected clients. The list shows IP address, protocol, port, state, and PID/process of each connection.

Add app: Install a new app.

Find more apps: Find more apps to install. You will be taken to an overview page of Axis apps.

Allow unsigned apps: Turn on to allow installation of unsigned apps.

Allow root-privileged apps: Turn on to allow apps with root privileges full access to the device.

View the security updates in AXIS OS and ACAP apps.

Use the switch next to the app name to start or stop the app.

Open: Access the app’s settings. The available settings depend on the application. Some applications don’t have any settings.

The context menu can contain one or more of the following options:

• Open-source license: View information about open-source licenses used in the app.

• App log: View a log of the app events. The log is helpful when you contact support.

• Activate license with a key: If the app requires a license, you need to activate it. Use this option if your device doesn’t have internet access.

  If you don’t have a license key, go to axis.com/products/analytics. You need a license code and the Axis product serial number to generate a license key.

• Activate license automatically: If the app requires a license, you need to activate it. Use this option if your device has internet access. You need a license code to activate the license.

• Deactivate the license: Deactivate the license to replace it with another license, for example, when you change from a trial license to a full license. If you deactivate the license, you also remove it from the device.

• Settings: Configure the parameters.

• Delete: Delete the app permanently from the device. If you don’t deactivate the license first, it remains active.

Synchronization: Select an option for the device’s date and time synchronization.

• Automatic date and time (manual NTS KE servers): Synchronize with the secure NTP key establishment servers connected to the DHCP server.

• • Manual NTS KE servers: Enter the IP address of one or two NTP servers. When you use two NTP servers, the device synchronizes and adapts its time based on input from both.

  • Max NTP poll time: Select the maximum amount of time the device should wait before it polls the NTP server to get an updated time.

  • Min NTP poll time: Select the minimum amount of time the device should wait before it polls the NTP server to get an updated time.

• Automatic date and time (NTP servers using DHCP): Synchronize with the NTP servers connected to the DHCP server.

• • Fallback NTP servers: Enter the IP address of one or two fallback servers.

  • Max NTP poll time: Select the maximum amount of time the device should wait before it polls the NTP server to get an updated time.

  • Min NTP poll time: Select the minimum amount of time the device should wait before it polls the NTP server to get an updated time.

• Automatic date and time (manual NTP servers): Synchronize with NTP servers of your choice.

• • Manual NTP servers: Enter the IP address of one or two NTP servers. When you use two NTP servers, the device synchronizes and adapts its time based on input from both.

  • Max NTP poll time: Select the maximum amount of time the device should wait before it polls the NTP server to get an updated time.

  • Min NTP poll time: Select the minimum amount of time the device should wait before it polls the NTP server to get an updated time.

• Custom date and time: Manually set the date and time. Click Get from system to fetch the date and time settings once from your computer or mobile device.

Time zone: Select which time zone to use. Time will automatically adjust to daylight saving time and standard time.

• DHCP: Adopts the time zone of the DHCP server. The device must connected to a DHCP server before you can select this option.

• Manual: Select a time zone from the drop-down list.

Assign IPv4 automatically: Select to let the network router assign an IP address to the device automatically. We recommend automatic IP (DHCP) for most networks.

IP address: Enter a unique IP address for the device. Static IP addresses can be assigned at random within isolated networks, provided that each address is unique. To avoid conflicts, we recommend you contact your network administrator before you assign a static IP address.

Subnet mask: Enter the subnet mask to define what addresses are inside the local area network. Any address outside the local area network goes through the router.

Router: Enter the IP address of the default router (gateway) used to connect devices that are attached to different networks and network segments.

Fallback to static IP address if DHCP isn’t available: Select if you want to add a static IP address to use as fallback if DHCP is unavailable and can’t assign an IP address automatically.

Assign IPv6 automatically: Select to turn on IPv6 and to let the network router assign an IP address to the device automatically.

Assign hostname automatically: Select to let the network router assign a hostname to the device automatically.

Hostname: Enter the hostname manually to use as an alternative way of accessing the device. The server report and system log use the hostname. Allowed characters are A–Z, a–z, 0–9 and -.

Assign DNS automatically: Select to let the DHCP server assign search domains and DNS server addresses to the device automatically. We recommend automatic DNS (DHCP) for most networks.

Search domains: When you use a hostname that is not fully qualified, click Add search domain and enter a domain in which to search for the hostname the device uses.

DNS servers: Click Add DNS server and enter the IP address of the DNS server. This provides the translation of hostnames to IP addresses on your network.

Bonjour^®: Turn on to allow automatic discovery on the network.

Bonjour name: Enter a friendly name to be visible on the network. The default name is the device name and MAC address.

UPnP^®: Turn on to allow automatic discovery on the network.

UPnP name: Enter a friendly name to be visible on the network. The default name is the device name and MAC address.

WS-Discovery: Turn on to allow automatic discovery on the network.

LLDP and CDP: Turn on to allow automatic discovery on the network. Turning LLDP and CDP off can impact the PoE power negotiation. To resolve any issues with the PoE power negotiation, configure the PoE switch for hardware PoE power negotiation only.

Http proxy: Specify a global proxy host or IP address according to the allowed format.

Https proxy: Specify a global proxy host or IP address according to the allowed format.

• Allowed formats for http and https proxies:

• http(s)://host:port

• http(s)://user@host:port

• http(s)://user:pass@host:port

• No proxy: Use No proxy to bypass global proxies. Enter one of the options in the list, or enter several separated by a comma:

• Leave empty

• Specify an IP address

• Specify an IP address in CIDR format

• Specify a domain name, for example: www.<domain name>.com

• Specify all subdomains in a specific domain, for example .<domain name>.com

Allow O3C:

• One-click: This is the default setting. Press and hold the control button on the device to connect to an O3C service over the internet. You need to register the device with the O3C service within 24 hours after you press the control button. Otherwise, the device disconnects from the O3C service. Once you register the device, Always is enabled and the device stays connected to the O3C service.

• Always: The device constantly attempts to connect to an O3C service over the internet. Once you register the device, it stays connected to the O3C service. Use this option if the control button on the device is out of reach.

• No: Disables the O3C service.

Proxy settings: If needed, enter the proxy settings to connect to the proxy server.

Host: Enter the proxy server’s address.

Port: Enter the port number used for access.

Login and Password: If needed, enter username and password for the proxy server.

Authentication method:

• Basic: This method is the most compatible authentication scheme for HTTP. It’s less secure than the Digest method because it sends the username and password unencrypted to the server.

• Digest: This method is more secure because it always transfers the password encrypted across the network.

• Auto: This option lets the device select the authentication method depending on the supported methods. It prioritizes the Digest method over the Basic method.

Owner authentication key (OAK): Click Get key to fetch the owner authentication key. This is only possible if the device is connected to the internet without a firewall or proxy.

Power over Ethernet

• Allocated power: Number of watts (W) that are currently allocated.

• Total PoE consumption: Number of watts (W) that are consumed.

• Keep PoE active during recorder restart: Turn on to supply power to connected devices during a restart of the recorder.

Click to show or hide the ports image.

• Click a port in the image to see the port details in the port list.

Port list

• Port: The port number.

• PoE: Turn on or off PoE for the port.

• Network: Turn on or off network for the port.

• Status: Shows if there is device connected to this port.

• Friendly name: The friendly name is set in Network settings. The default name is a combination of the model and the media access control address (MAC address) of the connected device.

• Power consumption: Number of watts (W) that are currently consumed and allocated by the connected device.

Allocated power: Number of watts (W) that are currently allocated.

Total PoE consumption: Number of watts (W) that are consumed.

Keep PoE active during recorder restart: Turn on to supply power to connected devices during a restart of the recorder.

Used space: Percentage of space used.

Free space: Percentage of space available for recordings.

Free space: Available disk space displayed in megabytes (MB), gigabytes (GB), or terabytes (TB).

Disk status: Current status of the disk.

Disk temperature: Current running temperature.

PoE: Turn on or off PoE for each port. When a device is connected, you’ll see the following information:

• Friendly name: The friendly name is set in Network settings. The default name is a combination of the model and the media access control address (MAC address) of the connected device.

• Power consumption: Number of watts (W) that are currently consumed and allocated.

Certificates are used to authenticate devices on a network. The device supports two types of certificates:

• Client/server certificates

  A client/server certificate validates the device’s identity, and can be self-signed or issued by a Certificate Authority (CA). A self-signed certificate offers limited protection and can be used before a CA-issued certificate has been obtained.

• CA certificates

  You can use a CA certificate to authenticate a peer certificate, for example to validate the identity of an authentication server when the device connects to a network protected by IEEE 802.1X. The device has several pre-installed CA certificates.

These formats are supported:

• Certificate formats: .PEM, .CER, and .PFX

• Private key formats: PKCS#1 and PKCS#12

Add certificate : Click to add a certificate.

• More: Show more fields to fill in or select.

• Secure keystore: Select to use Secure element or Trusted Platform Module 2.0 to securely store the private key. For more information on which secure keystore to select, go to help.axis.com/en-us/axis-os#cryptographic-support.

• Key type: Select the default or a different encryption algorithm from the drop-down list to protect the certificate.

The context menu contains:

• Certificate information: View an installed certificate’s properties.

• Delete certificate: Delete the certificate.

• Create certificate signing request: Create a certificate signing request to send to a registration authority to apply for a digital identity certificate.

Secure keystore:

• Secure element (CC EAL6+): Select to use secure element for secure keystore.

• Trusted Platform Module 2.0 (CC EAL4+, FIPS 140-2 Level 2): Select to use TPM 2.0 for secure keystore.

IEEE 802.1x

IEEE 802.1x is an IEEE standard for port-based network admission control providing secure authentication of wired and wireless network devices. IEEE 802.1x is based on EAP (Extensible Authentication Protocol).

To access a network protected by IEEE 802.1x, network devices must authenticate themselves. The authentication is performed by an authentication server, typically a RADIUS server (for example, FreeRADIUS and Microsoft Internet Authentication Server).

IEEE 802.1AE MACsec

IEEE 802.1AE MACsec is an IEEE standard for media access control (MAC) security that defines connectionless data confidentiality and integrity for media access independent protocols.

Certificates

When configured without a CA certificate, server certificate validation is disabled and the device tries to authenticate itself regardless of what network it is connected to.

When using a certificate, in Axis' implementation, the device and the authentication server authenticate themselves with digital certificates using EAP-TLS (Extensible Authentication Protocol - Transport Layer Security).

To allow the device to access a network protected through certificates, you must install a signed client certificate on the device.

Authentication method: Select an EAP type used for authentication.

Client certificate: Select a client certificate to use IEEE 802.1x. The authentication server uses the certificate to validate the client’s identity.

CA certificates: Select CA certificates to validate the authentication server’s identity. When no certificate is selected, the device tries to authenticate itself regardless of what network it is connected to.

EAP identity: Enter the user identity associated with the client certificate.

EAPOL version: Select the EAPOL version that is used in the network switch.

Use IEEE 802.1x: Select to use the IEEE 802.1x protocol.

These settings are only available if you use IEEE 802.1x PEAP-MSCHAPv2 as the authentication method:

• Password: Enter the password for your user identity.

• Peap version: Select the Peap version that is used in the network switch.

• Label: Select 1 to use client EAP encryption; select 2 to use client PEAP encryption. Select the Label that the network switch uses when using Peap version 1.

These settings are only available if you use IEEE 802.1ae MACsec (Static CAK/Pre-Shared Key) as the authentication method:

• Key agreement connectivity association key name: Enter the connectivity association name (CKN). It must be 2 to 64 (divisible by 2) hexadecimal characters. The CKN must be manually configured in the connectivity association and must match on both ends of the link to initially enable MACsec.

• Key agreement connectivity association key: Enter the connectivity association key (CAK). It should be either 32 or 64 hexadecimal characters long. The CAK must be manually configured in the connectivity association and must match on both ends of the link to initially enable MACsec.

Activate: Turn on the firewall.

• Default Policy: Select the default state for the firewall.

• Allow: Allows all connections to the device. This option is set by default.

• Deny: Denies all connections to the device.

To make exceptions to the default policy, you can create rules that allows or denies connections to the device from specific addresses, protocols, and ports.

• Address: Enter an address in IPv4/IPv6 or CIDR format that you want to allow or deny access to.

• Protocol: Select a protocol that you want to allow or deny access to.

• Port: Enter a port number that you want to allow or deny access to. You can add a port number between 1 and 65535.

• Policy: Select the policy of the rule.

: Click to create another rule.

• Add rules: Click to add the rules that you have defined.

• Time in seconds: Set a time limit for testing the rules. The default time limit is set to 300 seconds. To activate the rules straight away, set the time to 0 seconds.

• Confirm rules: Confirm the rules and their time limit. If you have set a time limit of more than 1 second, the rules will be active during this time. If you have set the time to 0, the rules will be active straight away.

Pending rules: An overview of the latest tested rules that you are yet to confirm.

Confirm rules: Click to activate the pending rules.

Active rules: An overview of the rules you are currently running on the device.

: Click to delete an active rule.

: Click to delete all rules, both pending and active.

To install test software or other custom software from Axis on the device, you need a custom signed AXIS OS certificate. The certificate verifies that the software is approved by both the device owner and Axis. The software can only run on a specific device which is identified by its unique serial number and chip ID. Only Axis can create custom signed AXIS OS certificates, since Axis holds the key to sign them.

Install: Click to install the certificate. You need to install the certificate before you install the software.

The context menu contains:

• Delete certificate: Delete the certificate.

Add virtual host: Click to add a new virtual host.

Enabled: Select to use this virtual host.

Server name: Enter the name of the server. Only use numbers 0-9, letters A-Z, and hyphen (-).

Port: Enter the port the server is connected to.

Type: Select the type of authentication to use. Select between Basic, Digest, and Open ID.

The context menu contains:

• Update: Update the virtual host.

• Delete: Delete the virtual host.

Disabled: The server is disabled.

Add a rule: Create a rule.

Name: Enter a name for the rule.

Wait between actions: Enter the minimum time (hh:mm:ss) that must pass between rule activations. It is useful if the rule is activated by, for example, day-night mode conditions, to avoid that small light changes during sunrise and sunset activate the rule repeatedly.

Condition: Select a condition from the list. A condition must be met for the device to perform an action. If multiple conditions are defined, all of them must be met to trigger the action. For information about specific conditions, see Get started with rules for events.

Use this condition as a trigger: Select to make this first condition function only as a starting trigger. It means that once the rule is activated, it remains active for as long as all the other conditions are met, no matter the state of the first condition. If you don’t select this option, the rule will simply be active whenever all the conditions are met.

Invert this condition: Select if you want the condition to be the opposite of your selection.

Add a condition: Click to add an additional condition.

Action: Select an action from the list and enter its required information. For information about specific actions, see Get started with rules for events.

Add a recipient: Click to add a recipient.

Name: Enter a name for the recipient.

Type: Select from the list:

• FTP

• • Host: Enter the server's IP address or hostname. If you enter a hostname, make sure that a DNS server is specified under System > Network > IPv4 and IPv6.

  • Port: Enter the port number used by the FTP server. The default is 21.

  • Folder: Enter the path to the directory where you want to store files. If this directory doesn’t already exist on the FTP server, you will get an error message when uploading files.

  • Username: Enter the username for the login.

  • Password: Enter the password for the login.

  • Use temporary file name: Select to upload files with temporary, automatically generated filenames. The files get renamed to the desired names when the upload completes. If the upload is aborted/interrupted, you don’t get any corrupt files. However, you probably still get the temporary files. This way you know that all files that have the desired name are correct.

  • Use passive FTP: Under normal circumstances, the product simply requests the target FTP server to open the data connection. The device actively initiates both the FTP control and data connections to the target server. This is normally needed if there is a firewall between the device and the target FTP server.

• HTTP

• • URL: Enter the network address to the HTTP server and the script that will handle the request. For example, http://192.168.254.10/cgi-bin/notify.cgi.

  • Username: Enter the username for the login.

  • Password: Enter the password for the login.

  • Proxy: Turn on and enter the required information if a proxy server must be passed to connect to the HTTP server.

• HTTPS

• • URL: Enter the network address to the HTTPS server and the script that will handle the request. For example, https://192.168.254.10/cgi-bin/notify.cgi.

  • Validate server certificate: Select to validate the certificate that was created by HTTPS server.

  • Username: Enter the username for the login.

  • Password: Enter the password for the login.

  • Proxy: Turn on and enter the required information if a proxy server must be passed to connect to the HTTPS server.

• Network storage

  You can add network storage such as NAS (network-attached storage) and use it as a recipient to store files. The files are stored in the Matroska (MKV) file format.

• • Host: Enter the IP address or hostname for the network storage.

  • Share: Enter the name of the share on the host.

  • Folder: Enter the path to the directory where you want to store files.

  • Username: Enter the username for the login.

  • Password: Enter the password for the login.

• SFTP

• • Host: Enter the server's IP address or hostname. If you enter a hostname, make sure that a DNS server is specified under System > Network > IPv4 and IPv6.

  • Port: Enter the port number used by the SFTP server. The default is 22.

  • Folder: Enter the path to the directory where you want to store files. If this directory doesn’t already exist on the SFTP server, you will get an error message when uploading files.

  • Username: Enter the username for the login.

  • Password: Enter the password for the login.

  • SSH host public key type (MD5): Enter the fingerprint of the remote host’s public key (a 32-digit hexadecimal string). The SFTP client supports SFTP servers using SSH-2 with RSA, DSA, ECDSA, and ED25519 host key types. RSA is the preferred method during negotiation, followed by ECDSA, ED25519, and DSA. Make sure to enter the right MD5 host key that is used by your SFTP server. While the Axis device supports both MD5 and SHA-256 hash keys, we recommend using SHA-256 due to stronger security over MD5. For more information on how to configure an SFTP server with an Axis device, go to the AXIS OS Portal.

  • SSH host public key type (SHA256): Enter the fingerprint of the remote host’s public key (a 43-digit Base64 encoded string). The SFTP client supports SFTP servers using SSH-2 with RSA, DSA, ECDSA, and ED25519 host key types. RSA is the preferred method during negotiation, followed by ECDSA, ED25519, and DSA. Make sure to enter the right MD5 host key that is used by your SFTP server. While the Axis device supports both MD5 and SHA-256 hash keys, we recommend using SHA-256 due to stronger security over MD5. For more information on how to configure an SFTP server with an Axis device, go to the AXIS OS Portal.

  • Use temporary file name: Select to upload files with temporary, automatically generated filenames. The files get renamed to the desired names when the upload completes. If the upload is aborted or interrupted, you don’t get any corrupt files. However, you probably still get the temporary files. This way, you know that all files that have the desired name are correct.

• SIP or VMS:

  SIP: Select to make a SIP call.

  VMS: Select to make a VMS call.

• • From SIP account: Select from the list.

  • To SIP address: Enter the SIP address.

  • Test: Click to test that your call settings works.

• Email

• • Send email to: Enter the email address to send emails to. To enter multiple addresses, use commas to separate them.

  • Send email from: Enter the email address of the sending server.

  • Username: Enter the username for the mail server. Leave this field empty if the mail server does not require authentication.

  • Password: Enter the password for the mail server. Leave this field empty if the mail server does not require authentication.

  • Email server (SMTP): Enter the name of the SMTP server, for example, smtp.gmail.com, smtp.mail.yahoo.com.

  • Port: Enter the port number for the SMTP server, using values in the range 0-65535. The default value is 587.

  • Encryption: To use encryption, select either SSL or TLS.

  • Validate server certificate: If you use encryption, select to validate the identity of the device. The certificate can be self-signed or issued by a Certificate Authority (CA).

  • POP authentication: Turn on to enter the name of the POP server, for example, pop.gmail.com.

  • Note

    Some email providers have security filters that prevent users from receiving or viewing large amount of attachments, from receiving scheduled emails and similar. Check the email provider's security policy to avoid your email account being locked or missing out on your expected emails.

• TCP

• • Host: Enter the server's IP address or hostname. If you enter a hostname, make sure that a DNS server is specified under System > Network > IPv4 and IPv6.

  • Port: Enter the port number used to access the server.

Test: Click to test the setup.

The context menu contains:

View recipient: Click to view all the recipient details.

Copy recipient: Click to copy a recipient. When you copy, you can make changes to the new recipient.

Delete recipient: Click to delete the recipient permanently.

Schedules and pulses can be used as conditions in rules. The list shows all the schedules and pulses currently configured in the product, along with information about their configuration.

Add schedule: Click to create a schedule or pulse.

You can use the manual trigger to manually trigger a rule. The manual trigger can, for example, be used to validate actions during product installation and configuration.

• Hard drive

• Free: The amount of free disk space.

• Status: If the disk is mounted or not.

• File system: The file system used by the disk.

• Encrypted: If the disk is encrypted or not.

• Temperature: The current temperature of the hardware.

• Overall heath test: The result after checking the health of the disk.

• Tools

• Check: Check the storage device for errors and tries to repair it automatically.

• Repair: Repair the storage device. Active recordings will pause during the repair. Repairing a storage device may result in lost data.

• Format: Erase all recordings and format the storage device. Choose a file system.

• Encrypt: Encrypt stored data.

• Decrypt: Decrypt stored data. The system will erase all files on the storage device.

• Change password: Change the password for the disk encryption. Changing the password doesn't disrupt ongoing recordings.

• Use tool: Click to run the selected tool

Unmount: Click before you disconnect the device from the system. This will stop all ongoing recordings.

Write protect: Turn on to protect the storage device from being overwritten.

Autoformat: The disk will automatically format using the ext4 file system.

Secure Shell (SSH): Turn on to allow a user to securely log on and perform shell and network services over the network.

Restart: Restart the device. This does not affect any of the current settings. Running applications restart automatically.

Restore: Return most settings to the factory default values. Afterwards you must reconfigure the device and apps, reinstall any apps that didn’t come preinstalled, and recreate any events and presets.

Factory default: Return all settings to the factory default values. Afterwards you must reset the IP address to make the device accessible.

AXIS OS upgrade: Upgrade to a new AXIS OS version. New releases can contain improved functionality, bug fixes, and completely new features. We recommend you to always use the latest AXIS OS release. To download the latest release, go to axis.com/support.

• When you upgrade, you can choose between three options:

• Standard upgrade: Upgrade to the new AXIS OS version.

• Factory default: Upgrade and return all settings to the factory default values. When you choose this option, you can’t revert to the previous AXIS OS version after the upgrade.

• Autorollback: Upgrade and confirm the upgrade within the set time. If you don’t confirm, the device reverts to the previous AXIS OS version.

AXIS OS rollback: Revert to the previously installed AXIS OS version.

This can mean that the PoE budget is exceeded. If you just connected a device to the recorder, try to remove it again. For more information about PoE limitations, see .

My recordings are not available.

Go to Fix common issues.

I cannot connect to my cameras.

Go to Fix common issues.

I receive error notification: “No contact”.

Go to Fix common issues.

My sites do not appear in my mobile app.

Make sure you have version 4 of the AXIS Companion mobile app.