Every computer on which you install KeyAccess will appear in the Computers window. Once a client computer is Discovered you can change how it is treated by the Sassafras Platform, what level of information is gathered, and which licenses the computer may access.
19. Install and test the KeyAccess client on a second computer
On a second computer, run the client installer, restart, and login to the computer (i.e., repeat step 2). Since a new record has been added to the computers database, KeyConfigure may highlight the word “Refresh” in red at the bottom of the Computers window – click on Refresh to see the new record.
A new client computer is displayed in the Computers window after KeyAccess first contacts the KeyServer. Restarting a computer and leaving it at the login screen is not enough - KeyAccess will not login to KeyServer until a user logs into the client computer. The default action when new clients are discovered is to assign the Login status of “Dedicated” (brown disk). Dedicated clients have all Sassafras services available to them. These computers are fully audited for installed software, and flexible licensing policies can be assigned and managed.
Dedicated clients will hold a client access license to the KeyServer until the client record is deleted or its dedicated login status is manually revoked by an administrator. At a large site, there will typically be a constant stream of computers being retired over time. Revoking the corresponding dedicated computer records individually may become a significant chore. Changing the computer's Login type to “Leased” will automate the revocation of its client access license. Leased clients, like dedicated, have all Sassafras services available to them. But when a Leased computer does not log in to KeyServer for a long period of time, the computer record will automatically be moved to “Dormant” – its client access license is then free for use by some other computer. Dormant computers will not appear in audit reports, but they will still appear in usage reports where their historical usage data remains relevant. If the Dormant computer returns and attempts to log into KeyServer, it will automatically move back from Dormant to Leased – assuming that the KeyServer is not full (i.e. assuming that all the Sassafras client licenses are not already in use by Dedicated or Leased clients).
Newly discovered Computers can be automatically categorized according to Filters and Rules that you set up. These rules will usually be specific to your site. For example you might decide to direct computers on a certain subnet into a Division. Double click the Discovery rule and click on the expansion to see how it is configured. When privacy is a consideration, you can customize the discovery rule so that auditing for installed software on a new client computer is disabled. For further details check the computers window documentation (right-click in any KeyConfigure window for help documentation relevant to that window).
The final login type, “Excluded”, isn't actually a “login” type at all– Excluded computers are not allowed to login and thus they cannot make any use of Sassafras services. These computers do not consume a client access license, and are not included in the Sassafras audit reports. Usage reports may still include them when there is relevant usage data.
Policy Metrics — Concurrent versus Node
20. Change to Node Policy
In the “Policy Details for Calculator Policy”, use the Metric drop-down to change from “Site” to “Node”. Set the “License Limit” to 1, save changes, and close the window. Launch Calculator (quit first if it is still running from a previous step), let it run for 5 seconds, and quit. Now on a second computer with KeyAccess installed, try to launch Calculator – we are assuming for this step that both computers are Windows or both are Macintosh so we are trying to launch the same program on two computers (actually, we are assuming the "same variant” - the one that is specified in our Product definition).
You will be told that the KeyServer cannot grant you permission to run the program. It does not matter whether Calculator is currently running on the first computer or not. The one available license for Calculator has already been issued to the first computer and that computer has been auto-added to the node list for the Policy. The license has been locked onto the first computer and it cannot float elsewhere. Even though Calculator also has an Observe policy, the Manage policy takes precedence, and has no more licenses available. In our example, the Node Policy dictates that we need a Node Lock in order to run, so the existence of an Observe Policy doesn't matter. In the Policies window next to our Manage policy, you will see 1 in the Issued column, while In Use is blank. For a Node policy, the In Use value is very typically less than (blank means 0) the Issued value, but never greater.
21. Remove a node from Calculator's list of licensed computers
Right-click on the Calculator Policy (in the Policies window), and choose “Show Computers” from the drop down menu. You will see the licensed computer listed in the window, “Computer Node List for Calculator Policy”. With a computer limit of 1, the second computer cannot be added to this list.
Select the one computer in the Node List and delete it. Now go back to the second computer, launch Calculator, let it run for 5 seconds, and then quit. Assuming that the second computer has been refreshed into the Computers window (step 19), now use the refresh button at the bottom of the Node List – you will see that the license has now locked onto the second computer. Calculator usage will be denied on other computers, again this is regardless of whether it is actually running on the licensed computer.
For any Manage policy, KeyServer accumulates a node list of all the distinct computers which have used the policy. When a policy is set to “Node”, new computers can “Auto-add” (if you have selected this option) to the list until the specified limit has been reached. Launch attempts on unlisted computers will then be denied as you just saw in step 18.
As an alternative to letting “Auto-add” build the node list you can explicitly drag items into a Node List from the Computers Window. A named list of computer nodes can also be built in the Groups window and then referenced in several Policy configurations as a common scope restriction, but this has a different effect, since it limits the scope of the policy. The policy simply doesn't apply to computers outside the scope and KeyServer will continue looking for other policies which do apply.
Let’s pause to look at the actual usage events that are being recorded by the KeyServer. The dump of all events is not itself very interesting but it is useful as a diagnostic which can clarify our understanding of KeyServer’s actions.
22. Run the Event Dump Report
From the Reports menu under Miscellaneous, select the Event Dump report and run it on the entire data set. You should be able to trace the history of this demo tour. Now select a computer logon item in the event dump window and right-click to run a sub-report just for the selected computer. You can select other event items and run a separate Event Dump sub-report for each computer, each program, and each policy.
In general, a right-click on an item in any window (computer, program, product, policy, purchase, etc.), will give a context menu listing all sub-reports that make sense when restricted to the selected item. Notice also that whenever you right-click (regardless of where in KeyConfigure's interface you right-click), there is a context sensitive Help item available.
Before moving on to the Concurrent metric, let’s clean up again. Quit all running copies of Calculator on all client computers. Close up all KeyConfigure windows and then click on “Standard View” from the Window menu to re-open the four main windows in standard position.
23. Change to Concurrent Policy
Open the “Policy Details for Calculator Policy” window again, and use the “Metric” drop down menu to change to a “Concurrent” policy. Make sure the License Limit is still 1 and save the changes. Launch Calculator on one computer and leave it running.
Now on a second computer (with KeyAccess installed), if you try to launch Calculator, a dialog will come up offering to put you in a waiting queue. Calculator is managed by one concurrent policy which has a License Limit of one and this one license is in use by the first user. When the first user quits, the waiting user will be notified. Try it.
You can examine the list of current users of a policy by clicking on the “Current User List” button in the Policy Details window. For a Concurrent Policy, the button label will also show the fraction currently in use, e.g., 3/7. When the metric is Node the “Computer List” button shows the fraction of the License Limit that has been allocated (locked to a node). In either case, a fraction equaling 1 (e.g., 7/7) means there are no more licenses available.
Sassafras also has a metric called “Lease”. This is similar to the Leased Login type for KeyServer clients – it is a license which has a node list, but for which computers will be removed from the node list automatically after a period of inactivity. It is designed to automate the reclamation of the licensing rights for programs that have essentially been abandoned. The reclaimed license will then become available for allocation elsewhere. This metric attempts to bridge the gap between the extremes of the node lock and concurrent policies. The default lease renewal period is set to 90 days which fits with the fine print seen in some licensing clauses that restrict how quickly software can be reinstalled or moved to a different computer. We will not configure a Lease Policy in this tour since the functionality cannot be seen immediately – it requires a long period of inactivity.