IBM Endpoint Manager for Software Use Analysis Version 9. Scalability Guide. Version 3

Transcription

1 IBM Endpoint Manager for Software Use Analysis Version 9 Scalability Guide Version 3

2

3 IBM Endpoint Manager for Software Use Analysis Version 9 Scalability Guide Version 3

4 Scalability Guide This edition applies to ersions 9.1 and 9.0 of IBM Endpoint Manager for Software Use Analysis (product number 5725-F57) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2002, US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Scalability Guidelines Introduction Scanning and uploading scan data Extract, Transform, Load (ETL) Decision flow Planning and installing Software Use Analysis.. 6 Hardware requirements Network connection and storage throughput. 7 Diiding the infrastructure into scan groups... 7 Good practices for running scans and imports.. 8 Plan the scanning schedule Aoid scanning when it is not needed Limit the number of computer properties that are to be gathered during scans Ensure that scans and imports are scheduled to run at night Run the initial import Reiew import logs Maintain frequent imports Disable collection of usage data Make room for end-of-scan-cycle actiities Configuring the application and its database for medium and large enironments Configuring the transaction logs size Configuring the transaction log location Increasing Jaa heap size Preentie actions Limiting the number of scanned signature extensions Recoering from accumulated scans Cleaning up high olume of Software Use Analysis scans uploaded since the last import.. 14 Verifying the remoal of scan data IBM PVU considerations REST API considerations Improing user interface performance Using relays to increase the performance of IBM Endpoint Manager Reducing the Endpoint Manager serer load.. 18 Appendix. Executie summary Notices Trademarks Priacy policy considerations Copyright IBM Corp. 2002, 2014 iii

6 i

7 Scalability Guidelines This guide is intended to help system administrators plan the infrastructure of IBM Endpoint Manager for Software Use Analysis and to proide recommendations for configuring the Software Use Analysis serer to achiee optimal performance. It explains how to diide computers into scan groups, schedule software scans, and run data imports. It also proides information about other actions that can be undertaken to aoid low performance. Introduction IBM Endpoint Manager clients report data to the Endpoint Manager serer that stores the data in its file system or database. The Software Use Analysis serer periodically connects to the Endpoint Manager serer and its database, downloads the stored data and processes it. The process of transferring data from the Endpoint Manager serer to the Software Use Analysis serer is called Extract, Transform, Load (ETL). By properly scheduling scans and distributing them oer the computers in your infrastructure, you can reduce the length of the ETL process and improe its performance. Scanning and uploading scan data To ealuate whether particular software is installed on an endpoint, you must run a scanner. It collects information about files with particular extensions, package data, and software identification tags. It also gathers information about the running processes to measure software usage. The software scan data must be transferred to the Endpoint Manager serer from which it can be later on imported to Software Use Analysis. To discoer software that is installed on a particular endpoint and collect its usage, you must first install a scanner by running the Install Scanner fixlet. After the scanner is successfully installed, the Initiate Software Scan fixlet becomes releant on the target endpoint. The following types of scans are aailable: Catalog-based scan In this type of scan, the Software Use Analysis serer creates scanner catalogs that are sent to the endpoints. The scanner catalogs do not include signatures that can be found based on the list of file extensions or entries that are irreleant for a particular operating system. Based on those catalogs, the scanner discoers exact matches and sends its findings to the Endpoint Manager serer. This data is then transferred to the Software Use Analysis serer. File system scan In this type of scan, the scanner uses a list of file extensions to create a list of all files with those extensions on an endpoint. Package data scan In this type of scan, the scanner searches the system registry (Windows) or package management system (Linux, UNIX) to gather information about packages that are installed on the endpoints. Then, it returns the findings to the Endpoint Manager serer where the discoered packages are compared with the software catalog. If a particular package matches an entry in the catalog, the software is discoered. Copyright IBM Corp. 2002,

8 Application usage statistics In this type of scan, the scanner gathers information about processes that are running on the target endpoints. Software identification tags scan In this type of scan, the scanner searches for software identification tags that are deliered with software products. You should run the catalog-based, file system, package data, and software identification tags scans on a regular basis as they are responsible for software discoery. The application usage statistics gathers usage data and can be disabled if you are not interested in this information. When the status of the Initiate Software Scan fixlet shows complete (100%), it indicates that the scan was successfully initiated. It does not mean that the releant data was already gathered. After the scan finishes, the Upload Software Scan Results fixlet becomes releant on the targeted endpoint. It means that the releant data was gathered from the endpoint. When you run this fixlet, the scan data is uploaded to the Endpoint Manager serer. It is then imported to Software Use Analysis during the Extract, Transform, Load (ETL) process. Extract, Transform, Load (ETL) The Extract, Transform, Load (ETL) is a process in the database usage that combines three database functions, which transfer data from one database to another. The first stage, Extract, inoles reading and extracting data from arious source systems. The second stage, Transform, conerts the data from its original form into the form that meets the requirements of the target database. The last stage, Load, saes the new data into the target database, thus finishing the process of transferring the data. In Software Use Analysis, the Extract stage inoles extracting data from the Endpoint Manager serer. The data includes information about the infrastructure, installed agents, and detected software. ETL also checks whether a new software catalog is aailable, gathers information about the software scan and files that are present on the endpoints, and collects data from VM managers. The extracted data is then transformed to a single format that can be loaded to the Software Use Analysis database. This stage also inoles matching raw data with the software catalog, calculating processor alue units (PVUs), processing the capacity scan, and conerting information that is contained in the XML files. After the data is extracted and transformed, it is loaded into the database and can be used by Software Use Analysis. 2

9 Extract, Transform, and Load Client computer - console Client computer - browser Endpoint Manager serer Endpoint Manager database Information about files Endpoint Manager file system Raw scan files Core business logic Relay 1. Extract Infrastructure information Installed agents Scan data files Software Use data files Capacity data files Package data files Files with VM manager information High-speed network connection Software catalog Software Use Analysis serer Web user interface Core business logic 2. Transform Information from the XML files is processed. Data is transformed to a single format. Raw data is matched with the software catalog. PVU and RVU alues are calculated. The capacity scan is processed. Software Use Analysis database 3. Load Data is loaded into the Software Use Analysis database tables. Endpoint Manager Client on Windows, Linux and UNIX Scan data Usage Catalog-based data XML File system XML Capacity Package Software identification tags VM manager data (Windows and Linux x86/x64 only) Endpoint Manager client on Linux on System z XML Scan data Usage Catalog-based data File system Capacity Package Software identification tags XML Capacity configuration The hardest load on the Software Use Analysis serer occurs during ETL when the following actions are performed: A large number of small files is retrieed from the Endpoint Manager serer (Extract). Many small and medium files that contain information about installed software packages and process usage data are parsed (Transform). The database is populated with the parsed data (Load). At the same time, Software Use Analysis prunes large olumes of old data that exceeds its data rentention period. The performance of the ETL process depends on the number of scan files, usage analyses, and package analyses that are processed during a single import. The main bottleneck is storage performance because many small files must be read, processed, and written to the Software Use Analysis database in a short time. By properly scheduling scans and distributing them oer the computers in your infrastructure, you can reduce the length of the ETL process and improe its performance. Scalability Guidelines 3

10 Decision flow To aoid running into performance issues, you should diide the computers in your infrastructure into scan groups and properly set the scan schedule. You should start by creating a benchmark scan group on which you can try different configurations to achiee optimal import time. After the import time is satisfactory for the benchmark group, you can diide the rest of your infrastructure into analogical scan groups. Start by creating a single scan group that will be your benchmark - when you are satisfied with the performance that you achiee for this group, you will create other scan groups on its basis. The size of the scan group might ary depending on the size of your infrastructure, howeer aoid creating a group larger than endpoints. Scan the computers in this scan group. When the scan finishes, upload its results to the Endpoint Manager serer and run an import. Check the import time and decide whether it is satisfactory. For information about running imports, see section Good practices for running scans and imports on page 8. If you are not satisfied with the import time, check the import log and try undertaking one of the following actions: If you see that the duration of the import of raw file system scan data or package data takes longer than one third of the ETL time and the olume of the data is large (a few millions of entries), create a smaller group. For additional information, see section Diiding the infrastructure into scan groups on page 7. If you see that the duration of the import of raw file system scan data or package data takes longer than one third of the ETL time but the olume of the data is low, fine tune hardware. For information about processor and RAM requirements as well as network latency and storage throughput, see section Planning and installing Software Use Analysis on page 6. If you see that processing of usage data takes an excessie amount of time and you are not interested in collecting usage data, disable gathering of usage data. For more information, see section Disable collection of usage data on page 10. After you adjust the first scan group, run the software scan again, upload its results to the Endpoint Manager serer and run an import. When you achiee an import time that is satisfactory, decide whether you want to hae a shorter scan cycle. For example, if you hae an enironment that consists of endpoints and you created a scan group of 6000 endpoints, your scan cycle will last seen days (on assumption that you create seen equal groups). To shorten the scan cycle, you can try increasing the number of computers in a scan group, for example, to It will allow you for shortening the scan cycle to six days. After you increase the scan group size, obsere the import time to ensure that its performance remains on an acceptable leel. When you are satisfied with the performance of the benchmark scan group, create the remaining groups. Schedule scans so that they fit into your preferred scan cycle. Then, schedule import of data form the Endpoint Manager. Obsere the import time. If it is not satisfactory, adjust the configuration as you did in the benchmark scan group. When you achiee suitable performance, plan for end-of-cycle actiities. 4

11 Use the following diagram to get an oeriew of actions and decisions that you will hae to undertake to achiee optimal performance of Software Use Analysis. Installation Plan and install Software Use Analysis Configuration Create a scan group (up to computers) Fine tune hardware (if possible) Initiate the scan and upload scan results Create a smaller scan group Run an import and check its time Disable gathering of usage data (if you do not need it) Is the import time satisfactory? No Yes Increase the size of the scan group Yes Do you want to hae a shorter scan cycle? No Create the remaining scan groups Fine tune hardware (if possible) Schedule the scans to fit into the scan cycle Create a smaller scan group Schedule daily imports Disable gathering of usage data (if you do not need it) Is the import time still satisfactory? No Yes Plan for end-of-cycle actiities Scalability Guidelines 5

12 Planning and installing Software Use Analysis Your deployment architecture depends on the number of endpoints that you want to hae in your audit reports. For information about the Endpoint Manager requirements, see Serer requirements aailable in Software Use Analysis documentation. Hardware requirements If you already hae the Endpoint Manager serer in your enironment, plan the infrastructure for the Software Use Analysis serer. Software Use Analysis serer stores its data in a dedicated DB2 database. The following tables are applicable for enironments with the following configuration parameters: a weekly software scan, daily imports, and 60 applications that are installed on an endpoint (on aerage). Table 1. Processor and RAM requirements for Software Use Analysis Enironment size Topology Processor Memory Small enironment 1 serer IBM Endpoint Manager, Software Use Analysis, and DB2 At least 2,5 GHz - 4 cores 8GB Up to endpoints Medium enironment endpoints* Large enironment More than endpoints** 2/3 serers IBM Endpoint Manager 2-3 GHz - 4 cores 16 GB Software Use Analysis and DB2 At least 2 GHz GB A distributed enironment is adisable. If you separate DB2 from Software Use Analysis, the DB2 serer should hae at least 16 GB RAM. cores 3 serers IBM Endpoint Manager 2-3 GHz cores GB Software Use Analysis At least 2 GHz GB cores DB2 At least 2 GHz - 16 cores 64 GB * For enironments with up to endpoints, there is no requirement to create scan groups. If you hae more than endpoints in your infrastructure, you must create scan groups. For more information, see section Diiding the infrastructure into scan groups on page 7. ** For larger enironments, scan groups are required. 6 Medium-size enironments You can use irtual enironments for this deployments size, but it is adisable to hae dedicated resources for processor, memory, and irtual disk allocation. The irtual disk that is allocated for the irtual machine should hae dedicated RAID storage, with dedicated input-output bandwidth for that irtual machine. Large enironments For large deployments, use dedicated hardware. For optimum performance, use a DB2 serer that is dedicated to Software Use Analysis and is not shared with Endpoint Manager or other applications. Additionally, you might want to designate a separate disk that is attached to the computer where DB2 is installed to store the database transaction logs. You might need to do some fine-tuning based on the recommendations described.

13 Plan and prepare for installation Small enironment Size: Up to endpoints Install Software Use Analysis and DB2 on one computer Install or reuse IBM Endpoint Manager Software Use Analysis and DB2 Small What is the size of your enironment? Medium Medium enironment Size: endpoints Install Software Use Install or reuse Analysis and DB2 IBM Endpoint on one computer Manager Software Use Analysis and DB2 Large Large enironment Size: endpoints Install Software Use Analysis and DB2 on two computers Install or reuse IBM Endpoint Manager Software Use Analysis serer DB2 serer A separate disk or storage might be necessary. Network connection and storage throughput The Extract Transform and Load (ETL) process extracts a huge amount of scan data from the Endpoint Manager serer, processes it on the Software Use Analysis serer, and saes it in the DB2 database. The following two factors affect the time of the import to the Software Use Analysis serer: Gigabit network connection Because of the nature of the ETL imports, you are adised to hae at least a gigabit network connection between the Endpoint Manager, Software Use Analysis, and DB2 serers. Disk storage throughput For large deployments, you are adised to hae dedicated storage, especially for the DB2 serer. The expected disk speed for writing data is approximately 400 MB/second. Diiding the infrastructure into scan groups It is critical for Software Use Analysis performance that you properly diide your enironment into scan groups and then schedule scans in those scan groups accurately. If the configuration is not well-balanced, you might experience long import times. For enironments larger than endpoints, diide your endpoints into separate scan groups. The system administrator can then set a different scanning schedule for eery scan group in your enironment. Example If you hae endpoints, you can create six scan groups (eery group containing endpoints). The first scan group has the scanning schedule set to Monday, the second to Tuesday, and so on. Using this configuration, eery endpoint is scanned once a week. At the same time, the Endpoint Manager serer receies data only from 1/6 of your enironment daily and for eery daily import Scalability Guidelines 7

14 the Software Use Analysis serer needs to process data only from endpoints (instead of endpoints). This enironment configuration shortens the Software Use Analysis import time. The image below presents a scan schedule for an infrastructure that is diided into six scan groups. You might achiee such a schedule after you implement recommendations that are contained in this guide. The assumption is that both software scans and imports of scan data to Software Use Analysis are scheduled to take place at night, while uploads of scan data from the endpoints to the Endpoint Manager serer occur during the day. If you hae a powerful serer computer and longer import time is not problematic, you can create fewer scan groups with greater number of endpoints in the Endpoint Manager console. Remember to monitor the import log to analyze the amount of data that is processed and the time it takes to process it. For information how to create scan groups, see the topic Computer groups that is aailable in Endpoint Manager documentation. Good practices for running scans and imports After you enable the Software Use Analysis site in your Endpoint Manager console, you should carefully plan the scanning actiities and their schedule for your deployment. Plan the scanning schedule After you find the optimal size of the scan group, set the scanning schedule. It is the frequency of software scan on an endpoint. The most common scanning schedule is weekly so that eery endpoint is scanned once a week. If your enironment has more than endpoints, consider performing scans less frequently, for example monthly. Aoid scanning when it is not needed The frequency of scans depends both on how often software products change on the endpoints in your enironment and also on your reporting needs. If you hae systems in your enironment that hae dynamically-changing software, you can group such systems into a scan group (or groups) and set more frequent scans, for example once a week. The remaining scan groups that contain computers with a more stable set of software can be scanned less frequently, for example once a month. 8

15 Limit the number of computer properties that are to be gathered during scans By default, the Software Use Analysis serer includes four primary computer properties from the Endpoint Manager serer that is configured as the data source: Computer Name, DNS Name, IP address, and Operating System. Imports can be substantially longer if you specify more properties to be extracted from the Endpoint Manager database and copied into the Software Use Analysis database during each data import. As a good practice, limit the number of computer properties to 10 (or fewer). Ensure that scans and imports are scheduled to run at night Some actions in the Software Use Analysis user interface cannot be processed when an import is running. Thus, try to schedule imports when the application administrator and Software Asset Manager are not using Software Use Analysis or after they finished their daily work. Run the initial import It is a good practice to run the first (initial) import before you schedule any software scans and actiate any analyses. Examples of when imports can be run: The first import uploads the software catalog from the installation d irectory to the application and extracts the basic data about the endpoints from the Endpoint Manager serer. The second import can be run after the scan data from the first scan group is aailable in the Endpoint Manager serer. The third import should be started after the scans from the third scan group are finished, and so on. Reiew import logs Reiew the following INFO messages in the import log to check how much data was transferred during an ETL. Number Information about Items specified in the import log Description 1. Infrastructure Computer items: The total number of computers in your enironment. A computer is a system with an Endpoint Manager agent that proides data to Software Use Analysis. 2. Software and hardware SAM::ScanFile items SAM::FileFact items SAM::CitFact items SAM::IsotagFact items The number of files that hae input data for the following items: File system scan information (SAM::FileFact items) Catalog-based scan information (SAM::CitFact items) Software identification tag scan information (SAM::IsotagFact items) The total count of information pieces about files from all computers in your enironment (contained in the processed scan files). The total count of information pieces from catalog-based scans (contained in the processed scan files). The total count of information pieces from software identification tag scans (contained in the processed scan files). Scalability Guidelines 9

16 Number Information about Items specified in the import log Description 3. Installed packages SAM::PackageFact items The total count of information pieces about Windows packages that hae been gathered by the package data scan. SAM::UnixPackageFact items The total count of information pieces about UNIX packages that hae been gathered by the package data scan. 4. Software usage SAM::AppUsagePropertyValue items The total number of processes that were captured during scans on the systems in your infrastructure. Example: INFO: Computer items: INFO: SAM::AppUsagePropertyValue items: 4250 INFO: SAM::ScanFile items: INFO: SAM::FileFact items: INFO: SAM::IsotagFact items: 0 INFO: SAM::CitFact items: INFO: SAM::PackageFact items: INFO: SAM::UnixPackageFact items: Maintain frequent imports After the installation, imports are scheduled to run once a day. Do not change this configuration. Howeer, you might want to change the hour when the import starts. If your import is longer than 24 hours, you can: Improe the scan groups configuration. Presere the current daily import configuration because Software Use Analysis handles oerlapping imports gracefully. If an import is running, no other import is started. Disable collection of usage data Software usage data is gathered by the Application Usage Statistics analysis. If the analysis is actiated, usage data is gathered from all endpoints in your infrastructure. Howeer, the data is uploaded to the Endpoint Manager serer only for the endpoints on which you run software scans. For the remaining endpoints, the data is stored on the endpoint until you run the software scan. About this task If you do not need usage data or the deployment phase is not finished, do not actiate the analysis. It can be actiated later on, if needed. If the analysis is already actiated, but you decide that processing of usage data takes too much time or you are not interested in usage statistics, disable the analysis. Procedure 1. Log in to the Endpoint Manager console. 2. In the naigation tree, open the IBM Endpoint Manager for Software Use Analysis 9 > Analyses. 3. In the upper-right pane, right-click Application Usage Statistics, and click Deactiate. 10

17 Make room for end-of-scan-cycle actiities Plan to hae an import from SmartCloud Control Desk through IBM Tioli Integration Composer at the end of a 1- or 2-week cycle. Include in your end-of-scan-cycle actiities the catalog update and the time for extracting Software Use Analysis compliance reports. Configuring the application and its database for medium and large enironments To aoid performance issues in medium and large enironments, configure the location of the transaction log and adjust the log size. Apart from that, you can also adjust the Jaa heap size. Configuring the transaction logs size If your enironment consists of many endpoints, increase the transaction logs size to improe performance. About this task The transaction logs size can be configured through the LOGFILSIZ DB2 parameter that defines the size of a single log file. To calculate the alue that can be used for this parameter, you must first calculate the total disk space that is required for transaction logs in your specific enironment and then diide it, thus obtaining the size of one transaction log. The required amount of disk space depends on the number of endpoints in your enironment and the number of endpoints for which new scan results are aailable and processed during the data import. Procedure 1. Use the following formula to calculate the disk space for your transaction logs: <The number of endpoints> x1mb+<the number of endpoints for which new scan results are imported> x1mb+1gb 2. Diide the result by to obtain the size of a single transaction log file. 3. Run the following command to update the transaction log size in your database. Substitute alue with the size of a single transaction log. UPDATE DATABASE CONFIGURATION FOR SUADB USING LOGFILSIZ alue Example Calculating the single transaction log size for endpoints and scan results: x1MB+15000x1MB+1GB=114 GB 114 / = UPDATE DATABASE CONFIGURATION FOR SUADB USING LOGFILSIZ Configuring the transaction log location To increase database performance, moe the DB2 transaction log to a file system that is separate from the DB2 file system. About this task Medium enironments: Large enironments: Strongly adised Required Scalability Guidelines 11

18 Procedure To moe the DB2 transaction log to a file system that is separate from the DB2 file system, update the DB2 NEWLOGPATH parameter for your Software Use Analysis database: UPDATE DATABASE CONFIGURATION FOR SUADB USING NEWLOGPATH alue Where alue is a directory on a separate disk (different from the disk where the DB2 database is installed) where you want to keep the transaction logs. This configuration is strongly adised. Increasing Jaa heap size The default settings for the Jaa heap size might not be sufficient for medium and large enironments. If your enironment consists of more than 5000 endpoints, increase the memory aailable to Jaa client processes by increasing the Jaa heap size. Preentie actions Procedure 1. Go to the <INSTALL_DIR>/wlp/usr/serers/serer1/ directory and edit the jm.options file. 2. Set the maximum Jaa heap size (Xmx) to one of the following alues, depending on the size of your enironment: For medium enironments ( endpoints), set the heap size to 6144m. For large enironments (oer endpoints), set the heap size to 8192m. 3. Restart the Software Use Analysis serer. Turn off scans if the Software Use Analysis serer is to be unaailable for a few days due to routine maintenance or scheduled backups. If imports of data from Endpoint Manager to Software Use Analysis are not running, the unprocessed scan data is accumulated on the Endpoint Manager serer. After you turn on the Software Use Analysis serer, a large amount of data will be processed leading to a long import time. To aoid prolonged imports, turn off scans for the period when the Software Use Analysis serer is not running. Limiting the number of scanned signature extensions 12 The scanner scans the entire infrastructure for files with particular extensions. For some extensions, the discoered files are matched against the software catalog before the scan results are uploaded to the Endpoint Manager serer. It ensures that only information about files that produce matches is uploaded. For other extensions, the scan results are not matched against the software catalog on the side of the endpoint. They are all uploaded to the Endpoint Manager serer. Thus, you aoid rescanning the entire infrastructure when you import a new catalog or add a custom signature. The new catalog is matched against the information that is aailable on the serer. Howeer, such a behaior might cause that large amounts of information about files that do not produce matches is uploaded to the serer. It might in turn lead to performance issues during the import.

19 To reduce the amount of information that is uploaded to the serer, limit the list of file extensions that are not matched against the software catalog on the side on the endpoint. Procedure 1. Stop the Software Use Analysis serer by running the following command: /etc/init.d/wlpserer stop /etc/init.d/suaserer stop 2. To limit the number of extensions that are not matched against the software catalog on the side of the endpoint, edit the following files. They are in the <SUA_install_dir>\wlp\usr\serers\serer1\apps\tema.war\WEB-INF\domains\ sam\config directory. In the file_names_all.txt file, leae the following extension: \.ear$ In the file_names_unix.txt file, leae the following extensions: \.sh$ \.bin$ \.pl$ \.ear$ \.SH$ \.BIN$ \.PL$ \.EAR$ In the file_names_windows.txt file, leae the following extensions: \.exe$ \.sys$ \.com$ \.ear$ \.ocx$ Note: Do not remoe file extensions that you used to create custom signatures. They are likely to produce matches with the software catalog, so they can be uploaded to the Endpoint Manager serer. 3. Start the Software Use Analysis serer by running the following command: /etc/init.d/wlpserer start /etc/init.d/suaserer start 4. Upload the software catalog. If a new ersion of the catalog is aailable, upload the new ersion. If it is not aailable yet, reupload the catalog that is currently imported to Software Use Analysis. If you are using Software Knowledge Base Toolkit for catalog management and upload a new ersion of the catalog, see: Updating the software catalog in Software Knowledge Base Toolkit. If you are using Software Knowledge Base Toolkit but reupload the same software catalog, perform the following steps: a. Log in to Software Use Analysis. b. In the top naigation bar, click Management > Catalog Serers. c. To automatically import the software catalog from Software Knowledge Base Toolkit, click Update Catalog. Scalability Guidelines 13

20 If you are using the built-in catalog management functionality that is aailable in Software Use Analysis, perform the following steps: a. Optional: Download the software catalog by using the Software Catalog Downlaod fixlet. Download the compressed file that contains only the software catalog in the XML format. b. In the naigation bar, click Management > Catalog Upload. c. Click Browse and select the IBMSoftwareCatalog_canonical_2.0_form_date.zip file. d. To upload the file, click Upload. What to do next After you modify the list of extensions that are uploaded directly to the serer, wait for the scheduled import or run it manually. During the import, the changes are propagated to the specified endpoints. After the next scheduled scan and import, the changed list of file extensions is used. More file extensions are matched against the software catalog on the side of the endpoint and the import time is shorter. Recoering from accumulated scans To recoer from a situation when you hae a large amount of accumulated scan data, you need to clean up the Software Use Analysis scans and then erify if the data was remoed correctly. Cleaning up high olume of Software Use Analysis scans uploaded since the last import To clean up accumulated scan data, use an SQL query that remoes scan file entries from the BFEnterprise tables. Procedure 1. Back up the BFEnterprise and, tem_analytics databases. 2. Back up and remoe all files from the UploadManager/sha1 directory on the Endpoint Manager serer. 3. To delete Software Use Analysis scan files entries from BFEnterprise tables, run the following SQL statement against the BFEnterprise database: use BFEnterprise delete from dbo.uploads where (FileName LIKE %itsitsearch% OR FileName LIKE %citsearch% ) delete from dbo.uploads_aailability where (FileName LIKE %itsitsearch% OR FileName LIKE %citsearch% ) 4. Run a Software Use Analysis import. What to do next You can either: Restore Software Use Analysis scans in sha1 directory in small chunks and run imports (that is, restore scans, run an import, restore next scans, run another import, and so on. Software Use Analysis will incrementally import scans). While restoring the scans in sha1 directory, Endpoint Manager FillDB process monitors changes in UploadManager\sha1 directory and updates dbo.uploads and dbo.uploads_aailability tables. Perform the following steps: 14

21 1. Rescan computers. 2. Upload new scan files. 3. Run an import. Repeat the procedure for eery computers. Tip: Aoid importing more than or scans within one Software Use Analysis import. Such an import takes hours een on systems that meet the Software Use Analysis hardware requirements. Verifying the remoal of scan data After you remoe the scan data, erify whether the remoal was successful. Procedure 1. Stop all fixlets that scan and upload data. 2. Back up the Endpoint Manager databases: SQL serer BFEnterprise and BESReporting In SQL Serer Management Studio, right click the database and select Tasks > Back Up... DB2 BFENT and BESREPOR If you get a SQL1015N The database is in an inconsistent state. SQLSTATE = error when attempting to back up the DB2 database, check if the database is in an inconsistent state by running the following command: db2 get db cfg for database_name. Note: Verify whether the parameter All committed transactions hae been written to disk is set to NO. If the database is in inconsistent state, run the following commands: a. DB2 restart database DATABASE_NAME b. DB2 force applications all c. db2stop d. db2start 3. Moe all files in the Upload Manager/sha1 directory on the Endpoint Manager serer to a backup location. Linux: /install_dir/uploadmanagerdata/bufferdir/sha1 (that is install_dir = /ar/opt/besserer) Windows: install_dir\uploadmanagerdata\bufferdir\sha1 (that is install_dir = c:\program Files (x86)\bigfix Enterprise\BESSerer\ UploadManagerData\BufferDir\sha1) 4. Delete scan files entries from BFEnterprise tables: SQL Serer use BFEnterprise delete from dbo.uploads where (FileName LIKE %itsitsearch% OR FileName LIKE %citsearch% ) delete from dbo.uploads_aailability where (FileName LIKE %itsitsearch% OR FileName LIKE %citsearch% ) DB2 Scalability Guidelines 15

22 connect to BFENT delete from dbo.uploads where (FileName LIKE %itsitsearch% OR FileName LIKE %citsearch% ) delete from dbo.uploads_aailability where (FileName LIKE %itsitsearch% OR FileName LIKE %citsearch% ) 5. Run a Software Use Analysis import. 6. Moe a subset of the sha1 folders from the backup location from step 3 back to the original sha1 folder. The sha1 directory contains folder names that match the last 2 digits of the endpoint (computer) ID. The folder names can be used to identify a specific endpoint or endpoints from a specific scan group. The Presentation Debugger can be used to run session releance queries to retriee computer information. The following sample queries show how to retriee the information for computers that are associated with sha1 folders: (id of it, hostname of it, name of it, ip addresses of it, operating system of it) of bes computers whose (id of it mod 100 = name_of_sha1_subdirectory_moed) returns the following when "name_of_sha1_subdirectory_moed" is replaced with "14": , nc tilab.austin.ibm.com, nc , , Linux Red Hat Enterprise Serer 6.4 ( el6.x86_64) (id of it, hostname of it, name of it, ip addresses of it, operating system of it) of bes computers whose ((id of it mod 100 = name_of_sha1_subdirectory_moed) or (id of it mod 100 = name_of_sha1_subdirectory_moed)) returns the following when "name_of_sha1_subdirectory_moed" is replaced with "14" and "5": , nc tilab.austin.ibm.com, nc , , Linux Red Hat Enterprise Serer 6.4 ( el6.x86_64) , nc tilab.raleigh.ibm.com, NC038067, , Win Verify that new rows are created in the BFEnterprise tables after copying the sha1 folders back to the original location. SQL Serer: use BFEnterprise select * from dbo.uploads where (FileName LIKE %itsitsearch% OR FileName LIKE %citsearch% ) select * from dbo.uploads_aailability where (FileName LIKE %itsitsearch% OR FileName LIKE %citsearch% ) DB2: connect to BFENT select * from dbo.uploads where (FileName LIKE %itsitsearch% OR FileName LIKE %citsearch% ) select * from dbo.uploads_aailability where (FileName LIKE %itsitsearch% OR FileName LIKE %citsearch% ) IBM PVU considerations 8. Run a Software Use Analysis import to load endpoint data into Software Use Analysis. 9. Repeat steps 5 and 6 until all of the original sha1 folders hae been imported into Software Use Analysis. 10. Restart all fixlets that were stopped in step 1. If you need to generate PVU reports for an IBM compliance purposes, the best practice is to generate the report at least monthly. 16

23 REST API considerations For organizations that span continents, from IBM compliance perspectie, the License Metric Tool Regions must be applied requiring separate Software Use Analysis deployments. For more information, see Virtualization Capacity License Counting Rules. You can use REST API for software licensing information to retriee large amounts of data that is related to computer systems, software instances, and license usage in your enironment. Such information can then be passed to other applications for further processing and analysis. Although using single API requests to retriee data only from a selected subset of computers does not greatly impact the performance of Software Use Analysis, this is not true when retrieing data in bulk for all your computer systems at the same time. Such an action requires the processing of large amounts of data and it always influences the application performance. In general, the API requests should not be used together with other performance intensie tasks, like software scans or data imports. Each user that is logged in to the application, as well as the number of actions that are performed in the web user interface during the REST API calls also decrease the performance. Important: Each time you want to retriee data through REST API, ensure that the use of Software Use Analysis at a moderate leel, so that the extra workload resulting from REST API does not oerload the application and create performance problems. When you retriee data in bulk, you can also make seeral API requests and use the limit and offset parameters to paginate your results instead of retrieing all the data at the same time: Use the limit parameter to specify the number of retrieed results: If you limit the first request to results, append the next request with the offset= parameter to omit the records that you already retrieed: Note: The limit and offset parameters can be omitted if you are retrieing data from up to about 50 endpoints. For enironments with approximately endpoints, you are adised to retriee data in pages of rows for computer systems, rows for software instances, and rows for license usage. Improing user interface performance If you experience problems with the performance of the user interface while working with reports, increase the number of rows that are loaded into the user interface. Adjust the number of rows to the size of your enironment. About this task When you open a report, 50 rows of data are loaded to the user interface by default. When you scroll past those 50 rows, next 50 rows must be loaded. To improe the response time of the user interface, you can increase the number of rows that are loaded to the user interface. Scalability Guidelines 17

24 Procedure 1. Stop thesoftware Use Analysis serer. 2. On the computer where the Software Use Analysis serer is installed go to the sua_installation_dir\tema\work\tema\webapp\jaascripts\report_components directory and open the grid.js file. 3. Find the following lines: $.widget("bigfix.grid", {options: {pagesize: 50, gridoptions: {} } 4. Increase the alue of the pagesize parameter according to the size of your enironment. Table 2. Number of rows loaded into Software Use Analysis user interface Enironment size Value of the pagesize parameter computers computers 1600 oer computers Start the Software Use Analysis serer. 6. Clear the cache in the web browser. Using relays to increase the performance of IBM Endpoint Manager 18 To take adantage of the speed and scalability that is offered by IBM Endpoint Manager, it is often necessary to tune the settings of the Endpoint Manager deployment. A relay is a client that is enhanced with a relay serice. It performs all client actions to protect the host computer, and in addition, deliers content and software downloads to child clients and relays. Instead of requiring eery networked computer to directly access the serer, relays can be used to offload much of the burden. Hundreds of clients can point to a relay for downloads, which in turn makes only a single request to the serer. Relays can connect to other relays as well, further increasing efficiency. Reducing the Endpoint Manager serer load For all but the smallest Endpoint Manager deployments (< 500 Endpoint Manager clients), a primary Endpoint Manager relay should be set for each Endpoint Manager client een if they are not in a remote location. The reason for this is that the Endpoint Manager serer performs many tasks including: Gathering new Fixlet content from the Endpoint Manager serer Distributing new Fixlet content to the clients Accepting and processing reports from the Endpoint Manager clients Proiding data for the Endpoint Manager consoles Sending downloaded files (which can be large) to the Endpoint Manager client, and much more. By using Endpoint Manager relays, the burden of communicating directly with eery client is effectiely moed to a different computer (the Endpoint Manager

25 relay computer), which frees the Endpoint Manager serer to do other tasks. If the relays are not used, you might obsere that performance degrades significantly when an action with a download is sent to the Endpoint Manager serer (you might een see errors). Setting up Endpoint Manager relays in appropriate places and correctly configuring clients to use them is the most important change that has highest impact on performance. To configure a relay, you can: Allow the clients to auto-select their closest Endpoint Manager relay. Manually configure the Endpoint Manager clients to use a specific relay. For more information, see Managing relays. Scalability Guidelines 19

26 20

27 Appendix. Executie summary Table 3. Summary of the scalability best practices Step Actiities 1. Enironment planning Reiew the summary information that matches your enironment size: Small Up to endpoints Software Use Analysis and DB2 installed on the same serer Scan groups (optional) Medium endpoints Scan groups (adisable) Software Use Analysis and DB2 installed on separate computers It is possible to use irtual enironments for this deployments size, howeer it is adisable to hae dedicated resources for processor, memory, and irtual disk allocation. Large endpoints Scan groups (required) Software Use Analysis and DB2 installed on separate computers, dedicated storage for DB2 Fine-tuning might be required 2 Good practices for creating scan groups Plan the scan group size Create a benchmark scan group Check the import time and decide whether it is satisfactory When you achiee an import time that is satisfactory, decide whether you want to hae a shorter scan cycle. When you are satisfied with the performance of the benchmark scan group, create the remaining groups. 3 Good practices for running scans, imports and uploads Run the initial import before scanning the enironment Plan the scanning schedule Aoid scanning when it is not needed Limit the number of computer properties to the ones that are releant for software inentory management Ensure that scans and imports are scheduled to run at night Disable gathering of usage data in the initial rollout phase Carefully plan for gathering of usage data in large enironments. Testing is required. Configure regular imports (Daily imports are adisable.) Reiew import logs Maintain frequent imports Ensure that scans and imports are run at night Run imports once a day Configure upload schedule (daily) 4 End of cycle actiities Regularly import a new software catalog, for example monthly Periodically import data from SmartCloud Control Desk through IBM Tioli Integration Composer, for example at the end of the 1 or 2-week cycle Generate audit snapshot Copyright IBM Corp. 2002,

28 22

29 Notices This information was deeloped for products and serices offered in the U.S.A. IBM may not offer the products, serices, or features discussed in this document in other countries. Consult your local IBM representatie for information on the products and serices currently aailable in your area. Any reference to an IBM product, program, or serice is not intended to state or imply that only that IBM product, program, or serice may be used. Any functionally equialent product, program, or serice that does not infringe any IBM intellectual property right may be used instead. Howeer, it is the user's responsibility to ealuate and erify the operation of any non-ibm product, program, or serice. IBM may hae patents or pending patent applications coering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drie Armonk, NY U.S.A. For license inquiries regarding double-byte character set (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: Intellectual Property Licensing Legal and Intellectual Property Law IBM Japan, Ltd , Shimotsuruma, Yamato-shi Kanagawa Japan The following paragraph does not apply to the United Kingdom or any other country where such proisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are proided for conenience only and do not in any manner sere as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. Copyright IBM Corp. 2002,

30 IBM may use or distribute any of the information you supply in any way it beliees appropriate without incurring any obligation to you. Licensees of this program who wish to hae information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/ Burnet Road Austin, TX U.S.A Such information may be aailable, subject to appropriate terms and conditions, including in some cases, payment of a fee. The licensed program described in this information and all licensed material aailable for it are proided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equialent agreement between us. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly aailable sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of indiiduals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and serice names might be trademarks of IBM or other companies. A current list of IBM trademarks is aailable on the Web at Copyright and trademark information at Jaa and all Jaa-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. Linux is a registered trademark of Linus Toralds in the United States, other countries, or both. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. UNIX is a registered trademark of The Open Group in the United States and other countries. 24