MAP: Software Usage Tracking
Software Usage Tracking
The Software Usage Tracking capability in the MAP Toolkit helps you gather information about users and devices that access Microsoft core server products in your environment. This data can significantly simplify the inventory process for client access license reporting and can also help with other scenarios such as Enterprise Agreement baselines and renewals.
MAP can be used in several business scenarios related to Software Usage Tracking, IT Asset Management (ITAM) and Software Asset Management (SAM). The main types of inventory scenarios for the MAP Usage Tracking feature are:
1. Active Devices and Users
This scenario reports devices with a Windows operating system and allows filtering this list by activity indicators such as last logon date and last password reset (or other criteria).
2. Software Usage (server as well as client accesses)
These scenarios report usage for the Microsoft server products and for users and devices accessing these server products. The list of supported product versions is listed in Appendix A: Software Usage Tracker Supported Server Products
Regardless of the particular scenario the overall flow is the same and similar guidelines apply for how to interpret the data.
The next section called Reporting Limitations includes a general disclaimer regarding the use of MAP Usage Tracking data.
The sections following it describe the steps involved in running Usage Tracking scenarios, in much greater detail than the section called Quick Start: Software Usage Tracking.
Reporting Limitations
The information in the Software Usage Tracker reports that the MAP Toolkit generates is subject to many limitations. The information these reports contain does not constitute legal, accounting, or other professional advice. These reports are for informational purposes only and should not be used as the sole source of information for determining software license usage compliance.
Software Usage Tracker reports should be used as a baseline for client access license (CAL) usage analysis rather than as an authoritative summary of software usage. Due to the wide variety of ways that software can be deployed and inventoried in your environment, the Software Usage Tracker cannot always produce accurate counts of server software and access to that software. For more information about scenarios that could lead to inaccurate reporting, see Appendix B: “Software Usage Tracker Examples of Limiting Scenarios.”
Step 1: Proactively enable logging (90 days in advance)
Note: You only need to enable logging for the software listed in the “Configure Log Files” section of this guide. If you are tracking usage on server software that does not require log files, you can skip this section and move on to the “Analyze the Results” section.
You must ensure that logging is enabled, and do so at least 90 days in advance of running the inventory scenario. You must also ensure that all the columns required for MAP Usage Tracking are enabled as described in the section called “Configure Log Files”.
Step 2: Parse Logs
Note: You only need to parse logs for the software listed in the “Configure Log Files” section of this guide. If you are tracking usage on server software that does not require log files, you can skip this section and move on to the “Analyze the Results” section.
For accurate analysis of software usage in your environment, you will need to ensure that your computers have generated logs for the appropriate time period. We recommend that you have 90 days of log files generated prior to proceeding.
After you confirm that your logs have been accumulated for the appropriate amount of time, and you have finished the inventory process, you are ready to parse the logs and analyze software usage. To proceed, export all relevant Windows and IIS logs from your servers and store them in a location that is accessible by the computer that is running the MAP Toolkit (and by the logged-on user).
Important: Before you parse the log files, ensure that you inventory the servers that created the log files you want to parse. You must connect the MAP Toolkit to the appropriate MAP database (the database that contains the inventory data of the servers from which the logs came.) This is necessary because, for proper data processing, the data from parsing the logs must be mapped to the inventoried servers. Only parse log files for supported software versions and editions. See Appendix A: “Software Usage Tracker Supported Server Products,” for a complete list of supported software.
To parse logs
1. In the navigation pane, click the Software Usage Tracking node.
Log Parsing Overview
2. In the Steps to complete section, click the Go button for Configure Log Parser.
Figure 9: Configure the Log Parser
3. The Specify Log File Paths dialog box opens.
4. Click the Add button.
a. The Browse for Folder dialog box opens.
5. Choose the directory on the local computer where the files are located. If the files are in a shared network directory, in the Folder box, type the shared path—for example, \server_name\logs\ The MAP Toolkit does not perform a recursive folder search, so you must list the full directory structure name for each location of log files you want parsed.
6. After you add all the directories where the log files reside to the Specify Log File Paths dialog box, click Save.
7. Click the Go button for Parse Logs.
a. A Status dialog box opens to show the progress of the log parsing process.
8. In the navigation pane, expand the Data Collection node and then click Log Files to monitor the results of the files as they are being parsed. The information shown is static. To refresh the pane and view the most current status, click away and then click Log Files again.
Figure 10: The Log Files pane
The Log Files pane shows data about the logs being parsed, including:
· Processed – The number of log files that have been parsed.
· Unprocessed – The number of log files that have yet to be parsed.
· Errored – The number of log files that could not be parsed completely due to errors in the format of the log file. Some events in an Errored log file may be parsed if the row that has the event is in the correct format.
· Total – The total number of log files that the Log Parser attempted to parse. This value should be equal to the total number of log files in the directories you configured for the Log Parser.
· Computer System Name – The name of the server that logged the event. You can also choose to group the displayed information by Log File Name.
· Log File Name – The name of the log files being parsed.
· Status – Indicates if the log file has been processed, remains unprocessed or if an error condition exists.
· Events – The number of applicable usage events contained in a processed log file.
· Start Date – The date of the first logged event.
· End Date – The date of the last logged event.
Special notes on Windows Server “8” Beta. Log parsing is no longer a requirement for usage tracking on Windows Server “8” Beta. |
In the navigation pane, click Instance Summary to view a summary of the parsed data held in the current MAP database. Each row represents one log file that was parsed.
Figure 11: Instance Summary pane
The Instance Summary pane shows data that came from the parsed log files, including:
· Software Instance – The name of the server software that was inventoried.
· Computer System Name – The name of the computer hosting the server software. You can also choose to group the displayed information by Software Instance.
· Start Date – Event time stamp for the first event recorded in the log.
· End Date – Event time stamp for the last event recorded in the log.
· User Count – The total number of users associated with an authorized logon.
· Device Count – The total number of devices associated with an authorized logon.
Step 3: Prepare your environment
If no log parsing is required this is actually the first step in running Software Usage Tracking scenarios.
This is a step that is required for most MAP scenarios and is not limited to Usage scenarios.
If you want to run the Windows Server “8” Usage Tracking prototype then you must make sure you configure the following entry in the MAP app.config file. XML file = Microsoft.AssessmentPlatform.UI.Console.exe <add key="Microsoft.AssessmentPlatform.UI.Console.Tasks.InventoryWorker.CollectUAL" value="false"/> CollectUAL must be set to “TRUE” before starting up MAP and running the Windows computers scenario. What determines whether Windows Server “8” Beta User Access Logging data will be collected is the value of CollectUAL when running the Windows computers scenario. |
All the details are in Section 1: Prepare your environment.
Step 4: Collect inventory
This is a step that is required for most MAP scenarios and is not limited to Usage Tracking scenarios.
All the details are in Section 2: Collect Inventory.
Finally: Analyze Results
The MAP Toolkit generates a series of server inventory and software usage tracking reports that you can use to significantly simplify the “true-up” process for software asset management. You can also gather this data multiple times, to analyze usage trends and plan future growth and acquisition of the necessary licenses.
Note: If you choose to gather this data multiple times, use a new MAP database each time. Information about computers that were successfully inventoried previously but have since changed would not be updated if you use an old database.
Each of these reports allows you to quickly filter results to find detailed information about each Microsoft core server product discovered during the inventory process, and authenticated access to each product. You can use these reports to help determine your server license and CAL needs for the server products.
To analyze the results, you need to:
· Review the software usage summary.
· Interpret reports.
· Use report data.
Review Combined Products Usage Summary
The Combined Products Usage Summary pane provides an overview of the server and usage data collected for each server product you inventoried. In general, summary reports list the version of the product found, the total number of users, and the total number of devices that connected during a given range of time. Client access is divided into two categories: users and devices. When applicable, the type of access is divided into total and enterprise.
Figure 12: Combined Products Usage Summary
Configure the Date Range
You can set a date range for the period of usage data you want to view. The date range that you set affects all reports under the Software Usage Summary node. For example, if you set the date range while viewing the Windows Server report pane and then traverse to the Office SharePoint Server report pane, the date range remains the same. If you want to report on data over a different period of time than you set for Windows Server usage, you will need to reconfigure the date range.
You can configure the date range while viewing any of the panes under the Software Usage Summary node for which date ranges are relevant.
To configure the date range
1. In the Actions pane, click the Configure Date Range task.
The Configure Date Range dialog box appears.
Figure 13: Configure Date Range dialog box
2. Click the Range drop-down list to select a given range or select Custom to set your own dates, and then click Save.
You have the option to select:
· Custom – The date range that you set must be within the span of time for which events exist in parsed logs. Therefore, it must begin no earlier than the first recorded date for an event and end no later than the last recorded date for an event. In addition, the end date cannot be after the current date.
· Earliest to date – This option sets the date range from the earliest recorded client access date to the current date for inventoried server products. If you are viewing a combination of server products, the earliest date of any one of the combined products is used.
Note: For server products that use parsed log files, this date is the earliest date found among all log files parsed. For server products that use MAP inventory data, this date is the date of the inventory.
· Past 7 days – The past seven days including the current date.
· Past 30 days – The past 30 days including the current date.
· Past 60 days – The past 60 days including the current date.
· Past 90 days – The past 90 days including the current date.
The date range that you configure is used for all software usage reports generated and will show at the top of each report pane you view.
Note: The format for the start and end dates in the Log Files and Instance Summary panes is as follows: yyyy-mm-dd hh:mm:ss UTC
For example, 2010-03-09 12:45:21 would be March 9th in the year 2010 at 12:45 and 21 seconds Coordinated Universal Time (UTC).
Summary of Combined Product Distinct Usage
This section compiles the count of users and devices that access at least one of the server products in the compiled list. This count is useful for special packaged CALs, such as Microsoft Core CALs, that only require one CAL per user or device to access multiple server products. A user or device that accesses more than one server product counts as one distinct usage for all products; not as one usage for each product. For example, if you select the check boxes for Windows Server, Office SharePoint Server, and Office SharePoint Server Enterprise Servers, a user who logs on to Windows Server and an enterprise SharePoint server counts as one distinct usage.
Figure 14: Combined Product Distinct Usage summary
To configure the Combined Product Distinct Usage summary
1. In the Actions pane, click the Configure Combined Products task.
The Configure Combined Products dialog box opens.
Figure 15: The Configure Combined Products dialog box
2. Select the products you want to combine for reporting and then click Save.
3. On the Combined Products Usage Summary pane, the list of products you chose to report on will be listed above the table that summarizes distinct usage of combined products.
Interpret Reports
You can use Software Usage reports to help verify compliance and analyze current licensing needs. Summary reports provide a count of users or devices for all servers of a given type for the date range that you configure. Detailed reports provide information about specific users or devices and the servers they accessed. You can use these reports to analyze software usage to determine whether device CALs or user CALs would more effectively meet your needs.
Software Usage reports should be used as a baseline for CAL usage analysis and evaluation of license needs rather than as an authoritative summary of software usage. Additionally, the number of servers from which software usage is reported might differ from the number of servers inventoried if the security event logs for all servers are not configured to log success logon events.
Generate Reports
At any time while viewing reports in the Combined Products Usage Summary pane or in a specific server product pane, you can generate a report. To create a report, in the Actions pane, click the Generate Report task.
If you click the Generate Report task while viewing the Combined Products Usage Summary pane, the tool will generate a report for each server product. The Combined Products Distinct Usage summary data is not generated as a report. Also, the Active Devices report is only generated from the Active Devices node.
To generate a report on only one product, in the navigation pane, browse to the node for the product for which you want to generate a report and then, in the Actions pane, click Generate Report.
Note: To ensure you have the most accurate information, run an inventory just prior to parsing log files and generating reports.
Summary Results
To view a summary of the data before generating a full software usage report, expand the Software Usage Tracking node in the navigation pane, and then click the name of a server product. The results pane shows selected overview information for each product. For full details, review the generated reports.
Detailed Reports
For each server product for which you configured usage tracking, there will be a detailed report. The detailed reports, which are generated as Microsoft Excel® workbooks, have inventory and usage data detailed for each server on which the product is installed. You can use the detailed report to filter for the information required for determining license usage for server product and client access.
Each detailed report has several worksheets. The following sections describe the information listed in each worksheet.
Note: You may find additional product-specific worksheets in some of the Usage Tracker reports. For example, the Exchange Server Report has a mailbox worksheet that provides details about various mailboxes. The System Center Configuration Manager report does not have a Log File Details worksheet because log files are not used to track Configuration Manager servers or clients.
· Server Summary Worksheet
This sheet lists each version of the product that was discovered and the total number of users and devices that accessed each version. Use this worksheet if you need to know about license and client access data on a per product version basis.
· Farm and Server Summary Worksheet
This sheet lists each server that was found to have a supported version of Office SharePoint Server installed. This information is detected via WMI inventory. The Log File Availability column indicates whether any IIS log files were found to contain information about this server. The Sites Found in Parsed Logs column indicates whether any IIS log files were found to contain one or more accesses to sites on this particular server. When a row lists Success for WMI Status and No for Log File Availability, Office SharePoint Server was discovered on the server, but no IIS log file for usage data was parsed for that server. If a row lists Yes for Log File Availability and No for Sites Found in Parsed Logs, one or more log files were parsed for this server, but no accesses were recorded by Software Usage Tracker.
· Server Details Worksheet
This worksheet lists information for each server on which the product was found during inventory. It can include such information as: installed server product, product roles configured for each server, services that the product installed, the operating system on which the product is installed, whether it is a physical computer or virtual machine, and computer hardware information, such as the number of CPUs. If you think the Server Summary page does not give you the data you require to determine server and CAL counts, you can filter on the data in the Server Details and Client Access Details worksheets to find the information you need for your environment.
· Client Access Summary Worksheet
This worksheet lists the name of each computer found to have the software product installed. For each server, the data shows the number of unique users and devices that accessed it, for the range of time you configured. Additional information for each computer may be provided for specific server products.
· Client Access Details Worksheet
This worksheet lists all unique connections that accessed each server, as found in the log files. For each unique connection, the worksheet indicates the date of the most recent access to the server. A unique connection is a distinct combination of computer name, user name, and name or IP address of the device that accessed the software. This data is very detailed and can take up numerous rows in the worksheet. This is the data used to determine the total number of client and device connections to each server for a specific software product. You may need to use this data to analyze findings in summary data. You can also use the detail data to determine if anomalies you find are due to missing usage data.
In the MAP 7.0 Beta, the format of the Client Access Details data will be identical to what is displayed in older versions of Windows Server and MAP when determing usage tracking on a Windows Server “8” Beta machine. Some rows might display NULL devices and some rows will display NULL users. No rows will contain both devices and users so there is no way to map devices to users. This should not impact the accuracy of the CAL counts. |
· Mailbox Details Worksheet
This worksheet lists all unique mailboxes and the name of the Exchange Server on which the mailbox resides. For each unique mailbox, the worksheet lists the email address associated with the mailbox, the user name of the mailbox owner and what, if any, enterprise features are assigned to the mailbox. This data is very detailed and can take up numerous rows in the worksheet. This is the data used to determine the total number of user mailboxes and enterprise user mailboxes as shown on the Overview and Server Summary worksheets. You may need to use this data to analyze findings in summary data. You can also use the detail data to determine if anomalies you find are due to missing mailbox data.
· Log File Details Worksheet
Usage data for some software products is extracted from log files. For these products, the accuracy of user and device access information given in the report is based on the log files that were parsed. Use this worksheet to determine whether the correct log files were parsed and if there were any issues parsing any log files.
Use Report Data
You can use the reports that the Software Usage Tracker generates to learn a lot about software usage in your environment. Microsoft offers a series of white papers to help customers better understand product licensing and to provide guidance to simplify compliance with software licensing. You can use the information from Usage Tracker along with the guidance in these white papers to get a fairly complete view of your client access license needs. Refer to the “Additional Tools, Products and Services” section of the appropriate white paper to learn how to use the usage reports for license and CAL analysis. You can download the white papers from the About Licensing page on the Microsoft Volume Licensing website.
Active Devices and Users
Active Devices and Users is similar to other Software Usage Tracker scenarios in terms of the steps performed for running the scenario, processing the reports and analyzing the data.
Active Devices and Users is different from other Software Usage Tracker areas in that it is not detecting or tracking usage for specific server products. Instead, the scenario is reporting the devices that are active on the network and running a Windows operating system.
|
Overview of the Active Devices and USers Scenario
The Active Devices and Users functionality provides organizations with a way to track and inventory accounts within their Active Directory environment.
By providing a summary of all devices and users, along with date of last logon and password reset of most recent activity, MAP enables network administrators and IT asset managers to separate current device populations from those that are no longer active on the network. This can help organizations keep their Active Directory accounts current and can also help with overall license management. For example customers that have or are considering a Microsoft Enterprise Agreement (EA), can use this data to help establish the Qualified Device count at the start of the agreement. They can also track changes to the counts that should be reported as part of the EA True-up process.
The MAP Active Devices and Users data should not be used as the sole source for determining software license compliance. One should employ multiple data points – from MAP and outside of MAP – in combination with a rigorous Software Asset Management process. |
Step 1: Run the inventory scenario
Run the Active Devices and Users scenario and specify the appropriate credentials for the discovery methods and collection technologies being used by the scenario (Active Directory and WMI).
The time required to run the collection varies depending on the size of the environment. It includes the time for collecting Active Directory data as well as detailed WMI information from each machine. To ensure you have the most accurate information, you may want to re-run an inventory prior to generating the report.
As with other usage tracker scenarios it is recommended you create a fresh MAP database when re-running inventory on the same set of machines, to avoid stale data.
You can re-run the scenario on the same MAP database and the results will be incremented as new machines are discovered. For example, you may choose to perform separate runs on different OUs (Organizational Units) in Active Directory.
Step 2: Generate and View the Reports
The Reporting Limitations section at the beginning of Section 7: Software Usage Tracker describes the limitations and disclaimers that apply to the interpreting the reports.
Step 3: View Active Devices Summary Results
To view a summary of the data before generating a full report expand Software Usage Tracking and click Active Devices and Users.
This view displays the same data as the Summary Worksheet report.
Step 4: Generate Reports
To create a report, click the Generate Report task in the Actions pane.
The generated Excel report will include a Summary worksheet, as well as a Device Details worksheet and a User Details worksheet.
· Summary Worksheet
This worksheet displays the same data as the Active Devices Summary view. It provides the following information.
o Devices with Windows OS: Show a count of computers with a Windows OS, without any filtering based on recency of activity.
o Total Devices Discovered: Shows a count of all discovered computers, without any filtering on OS or recency of activity.
o Total users: Shows a count of users discovered in Active Directory, after filtering out invalid users such as service accounts.
o Total Device to User Ratio: The ratio between Total Devices Discovered and Total Users.
To infer what subset of the devices is active, one can filter the data in the Device Details worksheet according to activity indicators such as last logon date, last password reset date, or other criteria.
· User Details Worksheet
This worksheet displays detailed information about the users discovered. It includes columns that can be used to filter the data further based on criteria outlined in the Enterprise Agreement description of qualified users.
The information under the following columns describe the user:
o User name
o Domain
o AD sn (surname)
o AD givenName
o AD middleName
The information under these columns are similar to the ones in the Device Details Worksheet . They can be used to filter users and adjust active user counts. These columns are:
o Last Activity Date
o Days since last activity
o AD Age or record (Days)
o Disabled (Y/N)
o AD Collection Date
o Manually Removed (Y/N)
o Removal Reason, Active (Y/N)
· Device Details Worksheet
This worksheet displays detailed information about the devices discovered. It includes columns that can be used for further filtering the data based on criteria outlined in the Enterprise Agreement description of qualified devices. These criteria include: recency of activity on the device and operating system installed.
The exact criteria of what constitutes an active or qualified device depends upon the customer and might change over time. The worksheet is designed to allow both filtering and manual exclusions of devices from the count. This flexibility also enables usage of this report in scenarios other than Enterprise Agreement baselines and renewals.
The Device Details worksheet has the following columns:
o Computer Name: This information comes from Active Directory(AD) and WMI data (WMI data prevails if it is present)
o Users Currently Logged On: A list of users that are currently logged on the machine. For best results, you must run this inventory scenario during business hours for the particular OU (Organizational Unit); otherwise this field might be sparsely populated
o Operating System: This information comes from AD and WMI data (WMI data prevails if present)
o Type: Client or Server, computed based on the Operating System field. This information can help identify servers and exclude them from the qualified device counts if they are not used as personal devices.
Note: Some devices with a server OS are in fact used as personal devices. This can be inferred based on criteria such as applications installed on the machine, and/or number of users.
o WMI Collection Date, AD Collection Date: These fields indicate the collection date for the record. In the usual case, they will be identical (and identical with the Last Inventory Date). They might be different if the inventory is run incrementally over several days.
o WMI Status: This is the WMI inventory status, similar to other MAP reports.
o Virtual (Y/N), Virtualization host: This information can be used to infer if the device corresponds to a virtual machine. Additional licensing considerations might apply to virtual machines.
o Days since last activity: This field is computed based on the fields that indicate activity. It is the number of days since the most recent of the activities, and can be used for filtering of machines based on recency of activity.
o AD Age of Record (Days): This field is based on the whenCreated attribute of the corresponding Computer object instance in AD. It can be used as an extra data point for the history of the device.
o AD Record last Changed (Days): This field is based on the whenChanged attribute of the corresponding Computer object instance in AD and can be used in a similar way to the fields that indicate activity.
The following fields are empty and are provided just for convenience, to facilitate the adjustment and filtering process:
o Manually Removed (Y/N)
o Removal Reason (which is a free form string)
o Active (Y/N)
See Stage 3: Post-Processing and Final Counts for details about how these fields can be used in practice.
Dealing with Insufficient Data:
o If a particular device was discovered using a discovery method other than Active Directory and is not in Active Directory, the corresponding columns might display “Insufficient Data”. In such a case we recommend you research why the device is missing from Active Directory. It might indicate a gap in your Active Directory coverage of devices in your organization.
o If your WMI Status is anything other than Success you might have some missing data. We recommend you debug the error and rerun inventory if you need the missing information. The Active Devices inventory can be run successfully with partial WMI data as long as there’s enough information to infer that the devices are active and running a Windows OS.
Stage 3: Post-Processing and Final Counts
The following fields are empty and are provided just for convenience, to facilitate the adjustment and filtering process:
· Manually Removed (Y/N)
· Removal Reason (which is a free form string)
· Active (Y/N)
These fields can be filled in during post-processing of the spreadsheet. They allow you to specify manually removed devices or users and the reason for their removal from the final counts. Active (Y/N) can be used to compute the final Active (or Qualified) status based on other fields. One can the specific Excel formula that makes sense for that particular organization running the scenario.
Use of these fields is optional, and is one of many possible methods for post-processing the data.
IMPORTANT: MAP does not preserve the information entered in these 3 fields in between inventory runs. The information is lost when re-generating the report. One has to re-enter the information in the newly generated report. Consider using Excel automation for importing lists of excluded machines for post-processing.
Related information
Other MAP data can be used to infer Qualified Device and User counts as described in the Microsoft Enterprise Agreement at http://go.microsoft.com/fwlink/?LinkId=228287.
Also available are overall device counts (Windows and non-Windows operating systems).
The MAP data should not be used as the sole source for determining software license compliance.
Specifically:
· Combined Product Distinct Usage counts unique devices and users based on their usage of Microsoft Server Products.
· The Machine Summary view displays the complete list of devices with Windows operating systems as well as other operating systems. This view is accessible in the navigation pane under Data Collection.
· MAP collects Active Directory information about users in the organization. This data can be retrieved by running a SQL query directly on the MAP database.
· MAP collects information about Applications installed on all inventoried devices. This information is accessible in the navigation pane under Data Collection: Application Summary. This information can be used to infer the usage pattern of the machine: i.e. is it used as a Personal Device, is it a Line of Business machine.
· This data cannot be exported from the MAP UI. One can retrieve it by running a SQL query directly on the MAP database.