The Video Intelligence Framework has two parts. The Video Intelligence Controller (VIC) is a plugin that runs inside Wowza Streaming Engine. The Video Intelligence Service (VIS) is the GPU service that runs the AI models. Most deployments run VIS as a Docker container, but when Docker is not an option, you can install VIS natively with the standalone Windows installer.
The installer is self-contained. The .exe bundles the service, its Python runtime, and all of its dependencies, including CUDA, cuDNN, and TensorRT, and it registers a WowzaVIS Windows service. No Docker required.
Note: This installer sets up the VIS service only. To complete VIF, you also need the VIF plugin in your Wowza Streaming Engine (see Install the VIF module), and you point Engine at this service (see Connect Wowza Streaming Engine below).
Note: The installer bundles the object detection and scene understanding models. VLM analysis and synthetic video detection run as separate containers, so those two detectors still need Docker even when the service is installed natively.
Requirements
- Windows x86_64 (amd64), with administrator rights.
- An NVIDIA Turing-architecture GPU or newer with driver 570 or later (
nvidia-smimust work). Only the driver is needed. CUDA, cuDNN, and TensorRT are bundled. - About 13 GB of disk for the installed service, plus about 5 GB for model checkpoints that download on first start. The bundled runtime ships compressed and is extracted during setup, which is what the wizard’s free-space figure covers.
- Outbound HTTPS on first start to download the model checkpoints. See Air-gapped installs to avoid this.
Download
Download the installer from the Wowza customer portal. Sign in, go to My Account, open the Downloads tab, and select Wowza Video Intelligence Framework. Under Video Intelligence Service, choose the Windows package. The file is named wowza-vis-<version>-windows-amd64.exe.
You also need a Video Intelligence Service license key, a base64 string. If you do not have one, contact Wowza support.
Install
- Run
wowza-vis-<version>-windows-amd64.exe. It requests administrator rights. - In the wizard, enter:
- VIS License Key (required). Paste your base64 license string. Setup checks its shape, so a typo is caught here. The service checks the signature, expiry, and product at startup.
- VIS API Key (required while Secure Mode is on). This is the key Engine uses to authenticate.
- Secure Mode, a checkbox that is on by default and recommended (see below).
- Port, pre-filled with 5001. Type another over it if needed.
- Leave Start the Wowza Video Intelligence Service (WowzaVIS) automatically ticked to start the service at the end of setup and at every boot. Unticking it registers the service without starting it and leaves it on manual start.
- Finish. Setup registers the service and checks that it answers on
/status. A failure here fails the install: Setup reports it and exits, and the service is not left half-registered.
The default location is C:\Program Files\Wowza Media Systems\Video Intelligence Service. You can change it on the destination page. The last step takes several minutes and reports each phase as it goes, such as “Extracting bundled runtime” and “Registering Windows service”.
Secure Mode
Secure Mode is the fail-closed switch, and leaving it on is the recommended setting. With it on and no API key, the service refuses to start, so turning it off is what allows an empty key. With it on, a connection from another host must use wss. Configure TLS in VIS (see TLS and WSS) or put a TLS-terminating proxy in front, because an API key sent over plaintext ws is a key on the wire. Secure Mode off with a key set still checks the key on every connection. It only disables the startup guard.
Silent install
wowza-vis-<version>-windows-amd64.exe /VERYSILENT /VISLICENSE=<base64> /VISAPIKEY=<key> /PORT=5001
Use /NOAUTH instead of /VISAPIKEY= to install with Secure Mode off. /MERGETASKS="!startservice" registers the service without starting it, and /PORT= is optional (an omitted port means 5001). A silent install refuses exactly what the wizard refuses, such as a missing or non-base64 license, a missing API key without /NOAUTH, or a port outside 1 to 65535, and exits non-zero without copying anything.
Verify
curl http://localhost:5001/status
On first start, the service downloads about 5 GB of model checkpoints and builds GPU engines, so it can take several minutes before /status reports ready. It starts answering with ready:false well before that. If it does not come up, the whole install is logged to C:\Program Files\Wowza Media Systems\Video Intelligence Service\logs\install.log.
Connect Wowza Streaming Engine
Point your Wowza Streaming Engine at this service in the VIF configuration (Stream Config Defaults, or conf.modules/vif/Default.json):
- Set the VIS URL to
ws://<this-host>:5001/ws/stream/, orwss://...once TLS is configured. - Set the VIS API Key to the key you set during install, or store it as a secret and reference it by name.
See Configure VIF in Wowza Streaming Engine Manager. If Engine is on a different host and Secure Mode is on, configure TLS first.
Configure
All settings live in one file, inside the install directory:
C:\Program Files\Wowza Media Systems\Video Intelligence Service\config\wowza-vis.env
To change any setting, edit the file and restart the service from an elevated PowerShell. The file holds your license and API key, so it is restricted to SYSTEM and Administrators:
notepad "$env:ProgramFiles\Wowza Media Systems\Video Intelligence Service\config\wowza-vis.env"
Restart-Service WowzaVIS
The format is KEY=VALUE, one per line. A # starts a comment, quotes around a value are optional and stripped, and there is no variable expansion. A variable already set in the environment wins over the file. Settings you add, such as SSL_KEYFILE, are preserved on upgrade. The installer rewrites only the four settings it collects: VIS_LICENSE, VIS_API_KEY, SECURE_MODE, and VIS_PORT. Clearing VIS_API_KEY by hand also requires SECURE_MODE=false in the same file.
TLS and WSS
VIS serves plaintext http and ws until you configure a certificate. With Secure Mode on, a remote Engine must connect over wss, so configure TLS in VIS or put a TLS-terminating proxy in front. Configure exactly one of the two sources below in wowza-vis.env. Setting both, or a keystore without its password, stops the service at startup.
Reuse the keystore Engine already uses
If Engine on this host serves TLS, point VIS at the same keystore. Use the values from VHost.xml (<KeyStorePath> and <KeyStorePassword>):
SSL_KEYSTORE_PATH=C:\Program Files\Wowza Media Systems\Wowza Streaming Engine x.y.z+vv\conf\example.streamlock.net.jks
SSL_KEYSTORE_PASSWORD=your-keystore-password
VIS reads JKS and PKCS12 keystores and detects the format from the file’s contents. The keystore must hold one private key with its issuers and nothing else, and the keystore password must open the key too. The service runs as LocalSystem, so it reads the keystore where Engine keeps it, and nothing about the file has to change.
Use a PEM key and certificate
SSL_KEYFILE=C:\Program Files\Wowza Media Systems\Video Intelligence Service\config\vis-key.pem
SSL_CERTFILE=C:\Program Files\Wowza Media Systems\Video Intelligence Service\config\vis-cert.pem
# Only when the private key is encrypted.
#SSL_KEYFILE_PASSWORD=
Both are required. Setting one alone stops the service at startup. SSL_CERTFILE may hold the whole chain, leaf certificate first. Keep both files in config\, which the installer restricts to SYSTEM and Administrators.
Certificates and keystores are read at startup only, so restart the service after you renew one. The startup log names the certificate it loaded, its hostnames, and its expiry, and warns through the last 30 days of validity.
Engine has to trust the certificate
Serving TLS is only half of wss. The Engine that connects also has to accept the certificate VIS serves. Engine judges it against its Java trust store, and the VIF plugin has no setting to relax that. Two things have to hold:
- The certificate chains to a CA the trust store knows. A public CA, such as StreamLock, already qualifies.
- The host in Engine’s VIS URL appears in the certificate. A certificate for
example.streamlock.netcovers neitherlocalhostnor an IP address, even on a shared host.
A self-signed certificate, or one from an internal CA, has to be imported into a copy of Engine’s trust store, from an elevated PowerShell:
$engine = "$env:ProgramFiles\Wowza Media Systems\Wowza Streaming Engine x.y.z+vv"
$cert = "$env:ProgramFiles\Wowza Media Systems\Video Intelligence Service\config\vis-cert.pem"
Copy-Item "$engine\jre\lib\security\cacerts" "$engine\conf\vis-truststore.jks"
& "$engine\jre\bin\keytool.exe" -importcert -alias wowza-vis -file $cert `
-keystore "$engine\conf\vis-truststore.jks" -storepass changeit
Name the copy in <VMOptions> in Engine’s conf\Tune.xml, then restart Engine:
<VMOption>-Djavax.net.ssl.trustStore=C:\Program Files\Wowza Media Systems\Wowza Streaming Engine x.y.z+vv\conf\vis-truststore.jks</VMOption>
<VMOption>-Djavax.net.ssl.trustStorePassword=changeit</VMOption>
Kept under conf\, the store survives an Engine upgrade.
Update
The portal installer handles both a first install and an update. Run a newer wowza-vis-<version>-windows-amd64.exe. It detects the existing install, stops the service, and upgrades in place, keeping your configuration (license, API key, and port) and downloaded models. On an upgrade, the wizard fields start empty, and an empty field means “keep the value already configured”. Fill one in only to change it.
Operate
The service is registered as WowzaVIS and starts with Windows. Start, stop, and restart need an elevated PowerShell. Status and logs do not. Restart after any change to wowza-vis.env.
Get-Service WowzaVIS
Restart-Service WowzaVIS
curl http://localhost:5001/status
Get-Content "C:\Program Files\Wowza Media Systems\Video Intelligence Service\logs\videointelligenceservice.log" -Tail 50
services.msc lists it as “Wowza Video Intelligence Service”. Note that Get-Service reports Running as long as the service wrapper is alive, even while it keeps restarting a service that fails on every attempt, so /status answering is the only proof the service itself is up.
Uninstall
Use Control Panel > Programs > Wowza Video Intelligence Service > Uninstall, or run uninstall.cmd in the install directory. The uninstaller asks whether to keep the downloaded models and your configuration. Answer Yes (the default) to keep models\ and config\, so a later re-install skips the 5 GB download and reuses your settings. Answer No to remove them. logs\ is kept either way.
Troubleshooting
A service that stops right after starting says why in one of two files. A configuration error the service rejects, such as an unreadable certificate, is a single line in the service log that begins with Fatal error, the service is stopping (logs\videointelligenceservice.log). A port already in use (error while attempting to bind on address) goes to logs\service-stderr.log, so check both.
If the service runs but Engine cannot use it, the evidence is on the Engine side. PKIX path building failed against VisService in Engine’s access log means Engine is refusing the certificate VIS serves. Until you resolve it, the VIF pages read nothing from VIS: the Checkpoint Path list shows “No custom models available”, the class lists come up empty, and no stream connects.
Air-gapped installs
To skip the first-start checkpoint download, copy a populated models directory into the install directory (default C:\Program Files\Wowza Media Systems\Video Intelligence Service\models) before you start the service. Checksums are validated on startup, and matching files are not re-downloaded.
