Correct SQL-Server Licensing for IMC

[Simon Andrä]

Hello everybody.

We are being audited by Microsoft for software licenses compliance.

We use SQL-Server 2005 for the IMC database. Our reseller told us that we only need one SQL-Server License and one SQL-CAL for the IMC-Server-Software, but the SAM-Partner says that monitoring and managing network devices means you do what Microsoft calls multiplexing.

An employee of HP wrote me in an e-mail that she thinks that you only need one license. But no one can prove this.

Has anybody the same constellation or can point me to a substantiated statement?

Simon.

[NeilR]

You will probably not find any kind of definitive statement from vendors such as HP in this regard. In my experience vendors prefer to  leave it to users to determine how they want to comply and so avoid any confrontation with MS. And as MS does change its licensing over time, they would not want to be stuck with any outdated advice.

So you can evaluate on you own - from this doc sqlserver2005licensingv1.1.doc - google to download from MS

"Use of such multiplexing or pooling hardware and/or software does not reduce the number of CALs required to access or use SQL Server software. A CAL is required for each distinct device or user that is connected to the multiplexing or pooling software or hardware front end. This is true no matter how many tiers of hardware or software exist between the SQL Server and the client devices that ultimately use its data, services or functionality. "

This is a bit vague but further elaborated on in the SQL 2014 Licensing Guide:

"When licensing SQL Server software under the Server+CAL licensing model, users and devices that indirectly access SQL Server data through another application or hardware device still require SQL Server CALs.

- Multiplexing does not reduce the number of Microsoft licenses required. Users are required to have the appropriate licenses, regardless of their direct or indirect connection to SQL Server.

- Any user or device that accesses the server, files, data or content provided by the server that is made available through an automated process requires a SQL Server CAL.

- The number of tiers of hardware or software between the SQL Server and the user or devices that ultimately use its data, services, or functionality does not affect the number of CALs required.

SQL Server CALs are required for users or devices that directly input into, query, or view data from a SQL Server database. Similarly, SQL Server CALs are required for users or devices that input data into, query, or view data from a SQL Server database through a pooling device (such as the CRM Server in the figure above). This includes users who view data through web-based applications or enter information into a database through an intermediary product."

So if it could be concluded that imc managed end nodes "enter information into a database through an intermediary product." then you would be required to buy a device CAL for every managed device.  Possible that every user who is managed through UAM also needs to be considered as needing a CAL, although the authenticating device could be argued to be the level of management requiring license.

I'm using MySQL to avoid having to consider these potential SQL server license requirements. If you had already deployed SQL server prior to your audit then you may not have much choice, other than to argue that you acted on advice from your resller or the HP employee in good faith and negotiate a compromise with MS. The SAM partner would certainly argue the more restrictive case. 

[Simon Andrä]

Hi NeilR,

thanks for your research.

I know the arguement that you might need one license per managed device. On the other hand you could say that theese devices don't enter any information on themselves, but are object of beeing written into the database by one application. As an example you can compare this to a customer database. Let's say an employee maintains this database an writes information about the customers of a company into this database. You would only need one user license and not one license for every customer that has a dataset in the database.

Of course UAM works a bit different, but in the end IMC checks if the user is online or offline. You do not configure any device to tell IMC if somebody logs in or so.

So Microsoft argues on the one side, customers and HP on the other one. My hope was that there is already some legal dispute to which you can refer. I heard that some companies already argue about this with Microsoft, but I dindn't get any judgment.

[NeilR]

MS does make a distinction between information obtained by the user of the application/database and manually entered (not needing a CAL) versus that conveyed through some automated process (needing a CAL). They do have some examples in the 2014 license guide that attempt to clarify this.

I could support the argument in favor of the one license if it was totally clear that the end devices never actively read from or directly transferred information to the application/database. Talking to the application is considered the same thing if the data is R/W to the DB. SNMP traps, sflow data, and LLDP seem potentially applicable to the machine as client to me. 

BTW my understanding of UAM when it is managing authentication - the access device is taking the 802.1x request and sending it up to IMC using RADIUS - IMC (which is my RADIUS server) is responding to a request from the access device as to whether to permit the user or not and if so, assigning resources. Access device is a client of the RADIUS server?

I agree with your frustration that HP and others continue to dodge this issue and leave it to us to deal with it. Having been audited myself, I'm only trying to point out that we are caught in a grey area, and the outcome is dependent on how MS is interpreting this in context of the relationship with MS and its license agreements.

Of course I would prefer to minimize my SW cost and certatinly MS is going to want to maximize its revenues. In my case I chose a different product, so they lost some revenue.

The decision to use SQL server should be discussed with them and agreed to prior to implementation to avoid issues down the road. Any advice or interpretation I or others (including unfortunately resellers) might offer, without a written declaration from MS (which is what you are asking us for) is just an opinion.