Audit Utility Dsreport

Novell Audit Utility - DSReport

In order to accurately assess all Novell products installed in a customer environment there are a number of tools which can be used to conduct this audit. Some tools are better suited to gathering information than other tools. DSReport can extract any information from NDS, given that the operator has sufficient rights in NDS to query the objects. NDIR is required to determine the date that a directory on a volume was last accessed. NWAdmin is used to determine Licenses installed in the NDS Organisational Units.

NetWare Novell licenses are based on a combination of active users and active printers or print servers. Most sites run with one print queue per printer. It is difficult to determine which printers are active since there is no property which reflects the last date a printer was used. Since printers use queues for storing files before they are actually printed, the queue directory will indicate the last time the directory was accessed – a file was printed. By analysing the Print Queue object and identifying the queue directory, active printers can be determined.

ZENworks If the customer has installed ZENworks then it will be necessary to count the number of active users in the network. Active users does not include printers as is the case for NetWare licenses.

NDS for NT and Corporate Edition NDS for NT and Corporate Edition are typically licensed on a Managed User basis – that is the user hasn an entry in the NT Domain or has a Unix (Solaris) or a Linux Profile. These are properties are defined in the User Object as IWS:Domain Membership for NT Domain users, UNIX:UID is used for Unix and Linux. If one of these properties has a value, then this indicates the user is consuming a license of NDS Corporate Edition.

BorderManager If the customer has BorderManager, it may involve a Server License and Client licenses or it may be on a Node License Basis. If a License has been installed, it will appear as an object in the NDS and NW Admin has a Novell License Reporting option under the Tools Menu selection. (License objects are typically stored in the same Organisation Unit as the Server they are installed on.) If Nodal licensing is used, then the Active User count (without printers) is the measure of licenses. (BorderManager VPN does not update the date last logged in property of the user object, so users who only use VPN will have to be identified and counted as active users.)

ManageWise and ZENworks If customers have ManageWise and ZENworks, ManageWise is measured on the number of NetWare and NT servers running ManageWise agents and the total number of installed ManageWise consoles. View|All| NetWare Servers and |NT Servers, will indicate how many servers have agents running.

If ManageWise is used, by not ZENworks, then the total number of workstation objects and printer objects is the measure of licenses.

GroupWise GroupWise is based on the number of Mailboxes in use. This can often be much higher than the active users on a network due to alternate mailboxes, eg [email protected], corporate governances requiring that email must be retained for a certain number of years after a user has left. Use NWAdmin, with GroupWise administration snap-ins installed. Go to Tools| GroupWise View|. Select GroupWise System, and choose Information. This will display the User Count – the total number of users of the GroupWise System.

Running the DSReport Utility The DSReport Utility can be used to extract NDS information to a CSV file, which may then be manipulated with MS Excel. These reports will need to be run for each NDS tree in a customer network.

DSReport requires Admin access to the tree in order to get access to all attributes of the User Objects, Printer objects, Print Queue objects.

Setting Context in DSReport Searches Run DS Report and select the Context to start the query from. It may be that in a very large tree, you want to break the information gathering up into a number of geographical areas. Searching can take some time depending on replica placement in the network. The search will run fastest if the user has access to all replicas, locally. Selecting Object Type in DSReport DSReport highlights all the base and extended object classes in the middle window – Having selected an object type in the left side list, the properties of that object will be displayed in the right side list. Highlight which properties you wish to report on. In order to make multiple property selections, hold the key while clicking one each property.

Selecting Report Output format The report output may be in a CSV (Comma-Separated-Variable), TSV (Tab-Separated Variable), Excel Spreadsheet Format or Text Format. Select which option you prefer. Press the button in order to start your query. Output Results It is possible to check that there were results from a query by looking at the Output Screen. Once you are happy with the results the data can be saved from the Multi-Object Report window.

Saving Data After the extract has completed, control will be returned to DSReport and you may save the data to file. Data is saved based on the Object type you queried. User Object Data A query of user objects will return all users in the selected contexts and sub-contexts. Select the following properties of the user object  CN – Common Name  Last Login Time– Date the user last logged in  Full Name – optional and may not always have data  OU – optional and helpful to identify users

After extracting the data, it is preferable to sort the data based on the Date Last Logged In field.

There are 4 totals required for Novell Audit purposes: 1. Total number of Users Total Users This is the total number of rows in the extracted data

2. Users who have never logged in Never Logged In This is the total number of rows with no entry in the Date Last Logged in field

3. Users who have not logged in in 60 Days Inactive Users This is the total number of rows where the Date Last logged in is greater than 60 days from the date the report was extracted

4. Users who have logged in in the last 60 Days Active Users This is the total number of rows where the Date Last logged in is less than or equal to 60 days from the date the report was extracted

All these fields need to be recorded on the Audit Finding Sheets. The most important group of users are the Active Users. Scan the data in the Active Users list specifically looking for Administrative User-Ids, Duplicates, Test User-Ids and shiftworkers. Please refer to the Audit Documentation for information relating to these different User-Ids and where to record the information.

Printer and Print Server Object Data The Audit Worksheets ask that Printers and Print Server numbers be recorded. The higher of Printers or Print Servers is used to determine the Total MLA Connections. Because printers and Printservers are not always removed from the tree when they are decommissioned, there will often be many more printers defined than there are printed in operation. The following procedures will help identify these inactive devices.

Printer Objects Select the following properties:  CN=Common Name Printer name as defined in NDS  OU=the Context the printer is defined in Helps to identify the location of the printer

This information should be recorded on the Audit Worksheet for each tree.

Print Server Objects Select the following properties:  CN=Common Name Printerserver name as defined in NDS  OU=the Context the printerserver is defined in Helps identify the location of the printserver

This number must be recorded on the Audit Worksheet for each NDS Tree. Excessive numbers of Printers – What to do… If there are excessive numbers of Printers or PrintServers, the following information may be gathered to help assess how many printers are active – that is those printers which have been used in the last 60 days.

PrintQueue Objects Most printers connected to NetWare networks use Print Queues for spooling of jobs prior to printing. Instead of printing directly to a printer, as is the case with a printer connected to a workstation’s serial or parallel ports, the workstation stores the print job in a queue on the server. When the printer is ready, it will print the printjob from the file stored on the server. By examining the dates in the Queue directory, it is possible to determine the last time a print queue was used.

Note: This is a fairly imprecise science since there can be more than one printer using a print queue and there can be more than one print queue used by a printer. If you divide the number of Print Queues by the number of printers One can make an assumption that this is the average number of print queue per printer. By using the following procedure, you will be able to determine how many printers to reduce the count by in order to come up with the Total MLA Connections.

Extract the following properties of the Print Queue object  OU Identifies printer location in NDS  CN Print Queue Name  Device Multi-valued field listing all printer on this queue  Queue Directory Directory on a NetWare Volume for this queue  Volume Server and Volume name to query

Having identified this information, it is best to sort the data by Volume and Queue Directory. It is now necessary to map a drive to the server and volume in order to query the dates. Queues are typically stored in the Queues directory off the root of the volume.

Change Directories to the directory the queues are stored in.

CD QUEUES as an example

NDIR *.QDR /UP BEF 04/20/2000 /c /s > C:INACT-PQ.TXT will output all queue directories which have not been updated (used) since 5th April 2000, and will store the results in a file called INACT- PQ.TXT on the C Drive.

NDIR *.QDR /UP AFT 03/20/2000 /c /s > C:ACTIVE-PQ.TXT will output all queue directories which have been updated (used) since 5th April 2000, and will store the results in a file called ACTIVE-PQ.TXT on the C Drive.

This process needs to be repeated for each server listed in the Volume column of the Print Queue data extract.

It is then necessary to check the entries in the INACT-PQ.TXT file against those listed in the Print Queue list to determine how many print queues are inactive. This figure should then be divided by the average number of print queues per printer, to determine how many printers to reduce the count by. License Objects Various Novell packages use the Novell Licensing Services to record the licenses in use. Licenses are usually recorded in the same Organisation Unit as the server they are installed on. NWAdmin has a utility under Tools|Novell Licensing Services|Novell License Report, which allows you to extract the license objects in an NDS tree and save them to file or print the list out.

Note: you will have to do this from an administrator’s workstation which has the necessary snap-ins to NWAdmin for Novell Licensing Services. Novell BorderManager is one such product which uses Licensing Services to define the Servers which have BorderManager components loaded.

This is not an area which is covered in the Novell MLA Audit process – it is here to help customers determine what Novell Products they have installed in their environment and hence what they should be licensed to use.

Disclaimer This document has been prepared by Novell Australia, Enterprise Business Unit to assist MLA customers to determine what is the correct number of licenses they should have installed.

Comments on these procedures, may be made to Ross Ford, [email protected] or mobile +61-417-450585