Ellipse 8 Licence Audit. Contents

Transcription

1 Licence Audit Guide

2 Ellipse 8 Licence Audit Contents Ellipse 8 Licence Audit 2 Commercial In Confidence 3 Introduction 4 Purpose 4 Scope 4 Compliance with Licence Restrictions 4 Audit Process Description 5 Process Definition 5 Ellipse 8 Audit Process 5 Session Auditing 5 Method 1 - Session Auditing Using HTTP Access Logs 5 Method 2 - Session Auditing Using the ABB Audit Service Daemon 6 Audit Period 7 Audit Report 7 Audit Algorithm, Parameters and Assumptions 7 Named Users 7 Impact of the ABB Audit Service on Running System(s) 7 Audit Deliverables 7 Instructions for Using an Audit Script 8 Preparing the Audit Script 8 List of Scripts Provided 8 Operating Instructions 8 Execution of ABB Audit Service/Daemon 8 Collect and Transfer the Logs to ABB 9 Appliance Method 9 1. Identify Guest VMs 9 2. Identify EFS path 9 3. Collect Logs 9 4. Save the Files and Provide to ABB 10 Non Appliance Method Identify Guest VMs Identify EFS path Collect Logs Save the Files and Provide to ABB 11

3 Commercial In Confidence Copyright 2018 ABB All Rights Reserved Confidential and Proprietary Legal Disclaimer The product described in this documentation may be connected to, and/or communicate information and data via, a network interface, which should be connected to a secure network. It is your sole responsibility to ensure a secure connection to the network and to establish and maintain appropriate measures (such as but not limited to the installation of firewalls, application of authentication measures, encryption of data, installation of antivirus programs, etc.) to protect the product, the network, your systems, and the interface against any kind of security breach, unauthorised access, interference, intrusion, leakage, damage, or corruption or theft of data. We are not liable for damages or losses related to any such security breach, unauthorised access, interference, intrusion, leakage, damage, or corruption or theft of data.

4 Introduction ABB Enterprise Software will, from time to time, exercise its rights to audit its customers for licence and software usage compliance as provided for in the contractual documents between the parties. After conducting a compliance audit, ABB Enterprise Software will provide an audit report documenting its findings. A copy of the audit report will be provided to the customer. The parties will then meet and discuss the contents of the audit report, including any remediation required to ensure compliance with the licence agreements in place. Purpose The purpose of the compliance audit is to determine if the customer is utilising ABB Enterprise Software as per the terms and conditions detailed within software licence agreements with ABB Enterprise Software. Compliance is determined by the collection and reporting of statistics generated from the customers production system logs. The log information is generated by the Ellipse online transaction system and accurately represents user access and application usage. This log information will form the basis of an audit report for consideration by ABB Enterprise Software and the customer in light of the current contracted terms and conditions. Scope The scope of the compliance audit covers two separate parts. 1. Compliance with licence restrictions based on Concurrent Users and Named Users. 2. Ellipse Software Usage based on modules enabled within the Ellipse 8 system. Compliance with Licence Restrictions Regardless of the licence restrictions defined within the contract between the parties, log data captured by the Ellipse transaction system logs will provide the necessary information that represents user access and will form the basis of the Ellipse user licence compliance report over a sample period of 32 days.

5 Audit Process Description The method with which the customer production environment is deployed will determine the method used to perform the compliance audit. The audit process itself involves the following steps: Review of the customer contract, customer production environment and business cycle with the customer is required to determine the parameters of the audit process and identify if any technical component upgrades are necessary. Installation and operation of an ABB provide audit service to be executed on all operating systems cooperating to provide the Ellipose runtime environment. The most typical server types are Ellipse Online, Ellipse Batch and Ellipse Web Services. The ABB audit service is non-intrusive to a customer s production system. The ABB audit service executes over a 32 day period. The ABB audit service produces log files that need to be collected and aggregated via a standard compression utility like zip/gzip. The collected logs are sent to ABB for analysis and reporting of user licence compliance and application usage. The customer should keep the logs for possible reanalysis should it be required. Preparation of the audit results such as user licence compliance report (concurrent or named user) and the application usage report. Review of the audit reports with the customer. Process Definition The following describes the overall audit process: 1. Installation of the abbauditd service. 2. Starting the abbauditd service on all the operating systems cooperating to provide the logical Ellipse environment. This includes ensuring the service (1) starts automatically on server restart (in case it occurs unplanned) and (2) continues to record session data. 3. Collect the abbauditd service log files from each of the running application operating systems (gests / VMs). 4. Collect module information from the production system. 5. Collect the last logged on user information from the production system. 6. Forward the logs to ABB for analysis. Customers may have more than one online application server running in support of production. The logs from each of application servers must be collected and forwarded to ABB. In some installations this may translate to multiple application servers across multiple Appliances. Ellipse 8 Audit Process The Ellipse 8 audit process involves extracting session statistics from each Application Server instance cooperating to provide a logical Ellipse environment, in nearly all cases this will be the live system, usually called Production. A more detailed description of the process is provided following. Session Auditing The audit is initially carried out by analysing concurrent users through the HTTP access logs which are held on the Command/Control VM in var/log/httpd (method 1). If the number of concurrent users is near to or more than the licence allows then a detailed assessment of concurrent users is done using method 2. Method 1 - Session Auditing Using HTTP Access Logs Concurrent user usage is assessed by reviewing any log that starts with audit_log existing in the var/log/httpd directory. The log needs to contain 32 or more days of usage. Steps 1. Go to var/log/httpd directory. 2. Extract copies of logs starting with audit_log. This may require performance multiple times to collect the required logs. 3. Send logs to ABB Enterprise Software (in zipped format). 4. ABB analyses logs for concurrent user levels.

6 5. ABB reviews Concurrent User licence agains concurrent user levels. 6. ABB reponds either indicating that either: a. concurrent users levels fit within licence and that concludes the Ellipse Audit. b. there is a requirement investigate the usage further, such as method 2 below. The session length is calculated to the last time user activity is recorded, even though they may still be logged in. Method 2 - Session Auditing Using the ABB Audit Service Daemon This section describes a more thorough approach to assessing concurrent users. The diagram below shows a typical Ellipse 8 environment showing the use of several servers cooperating to provide an Ellipse environment. Figure 1: Ellipse 8 Production Environment There are several types of servers that make up a running Ellipse 8 system which ABB is interested in when it comes to an Ellipse 8 audit. These include: Online (usually two or more instances in production). Ellipse Web Services (EWS). All of the above Ellipse 8 server types should have the abbauditd service installed and started. Install and start abbauditd service Task Customer Responsible

7 Collect abbauditd log files Attach ZIP file Salesforce case Process log files and produce audit report Customer Customer ABB The server types Batch and MIB do not run workloads that are the subject of an Ellipse 8 audit and therefore do NOT require installation of any services nor collection of any data. Audit Period An Ellipse licence audit should run for at least 32 days and should include at least one business month end period of processing. The abbauditd service, assuming it was installed correctly, is configured to restart automatically if the system running JBoss happens to restart for any reason. It should be noted that on restart, the abbauditd service will create new a audit directory and resume logging into the new directory. This means that at the end of the audit period, there may be several audit log folders containing valid audit data. ABB recommends that ALL audit log folders present are aggregated in the final zip sent to ABB. Audit Report ABB will analyse the log files and produce a report outlining the audit findings. A sample report titled Ellipse Sample Licence Audit Report is included with the documentation. Audit Algorithm, Parameters and Assumptions The abbauditd service collects JMX mbean attributes relating to HTTP sessions active in the JBoss server. At 30 minute intervals, a Jboss utility is used to query a JMX mbean tracking HTTP session data and the result recorded to a service log file. User log offs reduce the JMX mbean active session counter, user logons increase the JMX mbean active session counter. High values for session inactivity timeout (MSEPRF controlled) coupled with users that do not logoff will have the effect of increasing the number of concurrent users the system records. After a period of user session inactivity (MSEPRF controlled) the system will terminate a user from the system. User timeouts as a result of inactivity will have the effect of reducing the JMX mbean active session counter. Named Users The following SQL is requested to be executed on completion of the ABB audit service log data collection and included in the final bundle provided to ABB. The SQL will produce a listing of all named users that have accessed the Ellipse system and their last logged in date. The query will have no impact on the production system performance or integrity. SET PAGESIZE 50 SELECT entity, TO_CHAR(TO_DATE(MAX(last_acc_date), 'YYYYMMDD'), 'DD-MON-YYYY') AS last_login FROM msf020 WHERE entry_type = 'S' AND last_acc_date > '19%' GROUP BY entity ORDER BY max(last_acc_date); SPOOL OFF; Impact of the ABB Audit Service on Running System(s) The abbauditd service is configured to collect a small group of very specific runtime statistics using a standard JBoss utility at an sampling interval (30mins) well below any rate of sampling that might impact system operations. The abbauditd service can therefore be started at any time and will not cause any adverse system performance. The abbauditd service will accumulate approximately 2MB per day per operating system running the service. Audit Deliverables An audit report will be produced and will contain the following information. 1. Audit log details, period of capture, and various audit file statistics. 2. A table of the Maximum Concurrent users for each day of the audit period.

8 3. A graph showing a typical day during the audit period. 4. A list of all the users who have used the system during the audit period. 5. A list of the software modules that are active during the period. Instructions for Using an Audit Script This section outlines the installation and usage of the Ellipse session audit script. Do not attempt to upgrade any appliance during the audit period. Maintenance activities on the Appliance should be limited to restarting the virtual machines (VM) only. Preparing the Audit Script List of Scripts Provided audit.sh abbauditd Operating Instructions 1. Copy the audit.sh and abbauditd script to each Appliance host. 2. Set the APPLIANCE_HOST_FQDN variable to the fully qualified hostname of the appliance. Any string that uniquely identifies one Appliance from another is all that is required here. Figure 1: Set the Appliance Host 3. Copy the updated script for each of the Appliance VM to the following location: scp audit.sh [target_vm]:/usr/local/bin/ scp abbauditd [target_vm]:/etc/init.d/ 4. Execute the following command for each of the Appliance VM. ssh [target_vm] 'chmod +x /usr/local/bin/audit.sh' ssh [target_vm] 'chmod +x /etc/init.d/abbauditd' ssh [target_vm] 'chkconfig --add abbauditd && chkconfig abbauditd on' Execution of ABB Audit Service/Daemon Using SSH, login to each Ellipse guest VM associated with the Ellipse environment to be audited. In a clustered Appliance topology (more than one physical Appliance serving production workload), this typically translates to anywhere from 2-4 guests / operating systems (eg. ellipse01, ellipse02, ellips03 and ews01) per Appliance. To start the ABB audit service, issue the following command as root: service abbauditd start To verify that the ABB audit service is running, issue the following command as root: service abbauditd status

9 Collect and Transfer the Logs to ABB The following approach is used to collect and forward the log files from each Ellipse environment (in-stance) to ABB for analysis. 1. Identify Guest VMs. 2. Identify EFS path. 3. Collect Logs. This step needs to be done for each environment. 4. Save the files and provide to ABB. ABB are then able to produce a licence auditing report that can be provided to customers. All of these files will be found either in the Ellipse file system directory, or in the JBoss server directory. These need to be collected for each environment that is created. Appliance Method To locate the Ellipse log files for an appliance based installation running a Linux/JBoss deployment use the following information. 1. Identify Guest VMs Each environment (instance) created requires logs to be collected. For example: Development Test Support Production 2. Identify EFS path The EFS path can be in the following directories depending on the appliance version. For an Ellipse 8.4+ appliance, ellipse.fs.root will be: /appliance/data/efs. For an Ellipse 8.3 appliance, ellipse.fs.root will be: /mincom/data/efs. ellipse.fs.root is a JVM system property defined for every Ellipse online, batch and EWS server instance. The hostname is the fully qualified host name of the instance and is of the form servertypeservertypeseq.environmentname.domain..note:: servertype and servertypeseq have no delimiter between them in the formation of the host-name. domain is internal for Ellipse 8.3 and ventyxinternal for Ellipse You will need to iterate through all occurrences of servertype and servertypeseq for the target envi-ronmentname. For example the support environment. ellipse01.el83sup.internal. 3. Collect Logs The required audit logs are located in: <ELLIPSE_FS_ROOT>/<ENVIRONMENT_NAME>/log/<HOSTNAME>-ports-default/ For example: /mincom/data/efs/el83sup/log/ellipse01.el83sup.internal-ports-default The required monitoring logs are located in:

10 <ELLIPSE_FS_ROOT>/<ENVIRONMENT_NAME>/monitoring/<HOSTNAME>/ For example: /mincom/data/efs/el83sup/monitoring/ellipse01.el83sup.internal 4. Save the Files and Provide to ABB To save the log files: 1. From the environmentname directory create a compressed file containing the relevant hostname subdirectories. 2. Ensure that you select the subdirectories of log and monitoring for the Ellipse instances that are to be analysed: [root@ellipse01 efs]# zip -r /tmp/el83sup_logs.zip \ log/ellipse01.el83sup.internal-ports-default \ monitoring/ellipse01.el83sup.internal 3. Zip the monitoring and log files for that environment. 4. Go to the next environment and perform steps 1 to 3 until all environments are collected. 5. When all compressed files have been created, ship them to ABB using the following information: Subject: Licence Audit Logs for Review < address> Text: The attached zip file contains the Licence Audit logs for <company name> and has been virus checked prior to sending Non Appliance Method To locate the Ellipse log files for a non-appliance based installation running a Linux/JBoss deploy-ment use the following information. 1. Identify Guest VMs The following VM s require logs to be collected: Ellipse Online Ellipse Batch Ellipse EWS 2. Identify EFS path The EFS path is in the following directory in the appliance version. For an Ellipse 8.5+ non appliance, refer to ellipse.conf: /etc/jboss-as/ellipse.conf For an Ellipse 8.3 and Ellipse 8.4 non appliance, refer to run.conf within the JBoss install directory: <INSTALL_DIR>/jboss GA/bin/run.conf ellipse.fs.root is a JVM system property defined for every Ellipse online, batch and EWS server instance. You will need to iterate through all hosts within each environment. For example the support environment is el83sup. 3. Collect Logs The required audit logs are located in: <ELLIPSE_FS_ROOT>/<ENVIRONMENT_NAME>/log/<HOSTNAME>-ports-default/ For example: /mincom/data/efs/el83sup/log/ellipse01.el83sup.internal-ports-default The required monitoring logs are located in:

11 <ELLIPSE_FS_ROOT>/<ENVIRONMENT_NAME>/monitoring/<HOSTNAME>/ For example: /mincom/data/efs/el83sup/monitoring/ellipse01.el83sup.internal 4. Save the Files and Provide to ABB To save the log files: 1. From the environmentname directory create a ZIP file containing the relevant hostname sub-directories. 2. Ensure that you select the subdirectories of log and monitoring for the Ellipse instances that are to be analysed: [root@ellipse01 efs]# zip -r /tmp/el83sup_logs.zip \ log/ellipse01.el83sup.internal-ports-default \ monitoring/ellipse01.el83sup.internal 3. Zip the monitoring and log files for that environment. 4. Go to the next environment and perform steps 1 to 3 until all environments are collected. 5. When all compressed files have been created, ship them to ABB using the following information: Subject: Licence Audit Logs for Review < address> Text: The attached zip file contains the Licence Audit logs for <company name> and has been virus checked prior to sending.