Dots Connected #2: Inventory Quality (part 2), choose the right inventory tool(s)

Can't cook a nice dish without good ingredients

"No worries, we have this home grown tool that already performs inventory of our IT estate" is one of the statements I fear the most at the beginning of a SAM Project!

Just like you don't cook nice dishes without nice ingredients, you can't perform valuable SAM without a good inventory tool, developed in the purpose of doing Software Asset Management.

There is no bad or good inventory tool. There are inventory tools that have different objectives, and in the activity of recognizing applications and computing license consumption requires very specific information... that some inventory tools don't care about.

The ideal inventory tool for SAM

In an ideal world, and inventory tool should bring the following

• Hardware information (Cores, Processors, Threads, Processor type)

• Virtualization Information (Cluster/Host/Pools/VM links)

• Applications signatures (add remove / files / Registry keys (when necessary))

• User informations (last logged user)

• Application usage information

• Specific information for Microsoft (Windows registry keys, SQL Server SKUs for editions or engines...), Microsoft online usage for Microsoft 365.

• Specific information for oracle (Oracle database Options, Options Usage, Java activated features, middleware processes)

• Specific information for IBM (activated queue manager for WebSphere MQ, DB2 activated features, swidtags...)

• Specific informations for Red Hat (IBM): JBoss jar and zip-based information

• Specific information for Adobe (Acrobat editions subscribed)

• Specific information for SAP (named accounts, roles definitions, transaction data, engines measurements...)

• Microsoft Client Access Logging

• Streaming from Citrix (XenApp, Xen Desktop), VMWare horizon

• Active accounts and usage for Cloud Applications (M365, SalesForce, Service Now...)

IT world is so real though

This long list may appear discouraging because no tool (or maybe one) has this magnitude of data collection. That's why the title if the post is the Right Inventory Tool(s).

Different scopes of servers / computers deserve different levels of information and impose different constraints. That's why at the beginning of a SAM Project, a critical workshop must happen that will define the SAM Project strategy: the Business and Technical Planning workshop. Inventory collection is high in the list of topics. The licensing consultant and the team will create a map of the IT infrastructure to be inventoried and decide the right tools, combining requirement for good quality SAM inventory and timing constraint, because time to value is key for a SAM Project to prove value and win time and attention to expend. Pragmatism will guide our choices of a staged approach to inventory.

Getting as soon as possible good enough inventory data is critical. I have seen project where decision was made to use the Flexera inventory agent (a good choice, I will explain later) and after 6 months, 2000 or 60000 IT devices were inventoried and the project was at high risk!

A staged approach during project phase shortens time to value

At the beginning of project phase: good enough is good.

At the beginning of a project, using standard tools in place is a perfect way to have a rough view on IT estate. The Busienss and Technical Planning workshop will draw the target inventory map... but also the the road to there. Deploying a new inventory tool takes time and good enough information will allow to start the project, particularly on desktop applications.

The interest of using existing tools (that may not completely do the job) is that is provides a target for future inventory. See the recent Active Devices Not Reported By Flexera Agent report shared in this blog. The report identifies from other inventory sources where the Flexera agent should be deployed.

Standard inventory tools include: Microsoft SCCM, Altiris, BMC ADDM, Microsoft Intune, HP (Microfocus?, OpenText? ;) DDMI, Tanium.

Standards will rise with the maturity of the project

Recognizing correctly applications, getting information that is necessary to compute license consumptions are mandates you cannot ignore and that will narrow down the scope of sources of information you want to use. Here are the sources (in my humble experience) that don't pass the bar.

Intune: Flexera recently added an Intune Connector to its capabilities. Intune is an IT management tool, and has not been designed for Software Asset Management. No "publisher" attribute in add/remove data, no file evidence, no usage. Things may evolve, but at this stage, I don't recommend using Intune that will have poor recognition level (Despite the fact Flexera has set in the inventory import special rules for Intune recognition that will fabricate a Publisher name).

BMC ADDM: BMC ADDM is an extremely clever discovery tool that can, on an agentless technology and based on patterns that can be extended, collect clever informations and create a map of your applications that will be a perfect feed for a CMDB (Impact analysis etc.). ADDM can identify SQL Server editions, Oracle database. However, in the Server scope

• ADDM will not perform Oracle databases "introspection" to catch options usage

• I have seen very strange reporting on LPARs flagged as Physical computers

• Also Oracle Database being reported on the LPAR Hosts when is was installed on LPARs (causing an exaggeration by USD millions of Oracle License consumption on these hard partitioning technology)

• Strange LPARs serial numbers, causing a "merge" in Flexera One ITAM.

• ADDM cannot perform IBM PVU 30 minute measurements.

• Another issue is that applications names are normalized by ADDM and the recognition in ARL that contains the "Classical Raw signature" may fail recognizing applications reported by ADDM

In the end, while it is a good source of information for "missing inventory", I don't recommend using ADDM in a Flexera SAM Project. Note that you can use ADDM to execute the Flexera scanner!

HP DDMI (/HP Universal Discovery): My past life would tend to make me affirm HP DDMI is a good inventory tool, but it already has its normalization database and provides Flexera ARL with already normalized information that is not recognized correctly. You can activate a "Include Raw OS Installation Data", name=.* to have the raw data. My next concerns would be on Oracle Option usage collection that will not provide the transparency (what feature causes the usage). Middleware or Java information collection are missing, IBM 30 minute scan too...

Tanium: Tanium is an impressive agentless technology where you can query real time data on your full computer network. You have to define explicitly what has to be collected and will miss the specific server data collection.

ILMT: I did not mention ILMT (initially IBM, now HCL) in the standard inventory tools because it is very specialized on IBM PVU or VPC calculations. ILMT is a great tool, but just covers IBM... and if you have a Flexera agent deployment project on server, why would you keep two agents on Servers that have IBM products installed? Flexera One ITAM is an Certified IBM Alternative To ILMT. and using ILMT as a benchmark tool at the Beginning of the SAM Project and using Flexera native capabilities on Oracle is the most efficient path.

Picture must be perfect during run phase. The ideal combination.

The winning inventory combination

On server estate, no doubt you need the Flexera agent in a Flexera SAM Project. Some SAM competitors specialized, inventory solutions may collect the right data, but will not be integrated nicely, and will for sure not meet the IBM requirements.

For the desktop estate, The Flexera agent will do the job (see next section that expends) SCCM (or Altiris in absence of SCCM, that) is an acceptable solution that avoids painful deployment with the following (minor or not, you will judge) reservations

• SCCM can be tedious for metering activation (file by file activation). Add/remove last used date from Asset Intelligence is automated and does not require extra configuration but can have false positives.

• SCCM (if you collect file data) will allow recognition of commercial versions of Java, but will not collect the activated features (AMC agent, Mission Control, Unlock Commercial Feature).

• Regarding activated editions of Acrobat, SCCM is not able to read and interpret the right registry keys while the Flexera agent does.

For SaaS applications, use the native capabilities of Flexera SaaS Manager that has out of the box connections with tens of applications.

For specific data collection vCenter, Streamed Applications (Citrix, VMWare Horizon)... use the Flexera toolset that has native integration into the ITAM solution. The ITAM Inventory Adapters and Connectors reference will provide you a mine of information.

Ban overlapping inventory sources!

This one of the trickiest topic of inventory Management that has its own report in the SAM Operations Hub. This is the Merged Devices Issues Issues Analysis report. You can see a screenshot below.

Flexera One ITAM Powerfully merges inventory data coming from multiple sources with a Powerful matcher algorithm that you can tune if you are on premise (have a look to: C:\ProgramData\Flexera Software\Compliance\ImportProcedures\Inventory\Matcher).

However, if one of your source is aging, the recognized applications will have false positives, sticky installations that will reflect what was the situation last time data came in. If you add the fact that data quality from different sources can vary, you should use the best source and not a mixed blending gold and lead.

Deep dive into Flexera inventory

If I wanted to write everything I have in mind, this post would become a book. I will provide examples of what you can do and what probably 90% of users don't know, as well pointers to Webinars I have already presented as Product Manager of Flexera One ITAM. The Bible of inventory is the Gathering FlexNet Inventory . You will find he tens of options (see the Preferences section that is just shows an impressive sets of capabilities) when running the inventory, the exact scripts ran by the agent

Tip and tricks

• You can run the agent in Command Line from any tool (Control-M for instance). Particularly useful for servers that can't be modified (Exadata, unsupported AIX servers).

• Remote scan is possible (agentless) but not recommended as it implies massive network port opening and using an admin / root user. Agent will be more stable.

• Adoption is possible from the beacon but will have the same constraints as remote scan.

• You can inventory Oracle from a beacon or through the agent. Again, Beacon is a second choice when server cannot be instaleld with an agent.

• You can extend the data collection with a vbs script (RunInventoryScript)/

• You can focus the file collection to avoid the big bang of collection all files (IncludeFile), for instance with Java.exe.

• You can extend usage metering beyond MSI files with a Manual Mapper.

• If you are on premises, you can "push" agents setting directly with a script in the database without using the mgssetup.ini default settings file or a Microsoft Group Policy Object (GPO).

• On premises again, you can extend the file extensions you collect.

The list could be long. Keep in mind the wide range of capabilities you have with the agent.

Want to learn more?

I would recommend some of the recorded SAM Best Practices Webinars I delivered you can find in the Flexera Community

• Managing metering and usage in ITAM

• Managing unrecognized applications in ITAM

• Everything about Oracle

• Managing Hybrid applications in SaaS Manager and Flexera One

• Managing Streamed Applications in Flexera One ITAM

• Keep Java under Control!

You can find the links to the 24 recorded Flexera SAM Best Practices Webinars in the "ITAM Best Practice Available in the Community" Flexera KB article.