jng1 Absent Member.
Absent Member.
956 views

Licensing query: device count

for arcsight express 3.0/ESM 5, understand that licensing is based on event and device count, ie 1000EPS and 750 devices.

does anyone know how is the device count determined, say by IP address? or is there some unique device ID which is maintained and tracked internally by the appliance to determine the total device count, which is used for licensing purposes?

for those interested, this value of device number can be obtained when you perform a query on license:101 on arcsight esm console.

Labels (1)
0 Likes
9 Replies
Jurgen
Visitor.

Re: Licensing query: device count

Hi,

For arcsight express 3.0/ESM 5 the device count is calculated wrong (known bug), i think it counts all unique dns names + (dynamic) ip's all in the past which makes for a high number of devices (while in reality you only have a small amount of devices logging).

Kind regards,

Jurgen

0 Likes
jng1 Absent Member.
Absent Member.

Re: Licensing query: device count

Hi Jurgen,

with your explanation, it seems that ESM is counting the devices by IP. by device IP, i believe? for devices which have their IP changed (ie. DHCP or static IP modification) will likely register as a new device, which in fact is not.

reason for this is that we are sizing up for an upgrade.. hopefully someone who have did this before could shed some light on this.

0 Likes
Acclaimed Contributor.. balahasan.v1 Acclaimed Contributor..
Acclaimed Contributor..

Re: Licensing query: device count

Hi Jack,

Do u have Vulnerability Scanners in ur ArcSight Environment ? Which also creates the device/asset entry.

0 Likes
Jurgen
Visitor.

Re: Licensing query: device count

Hi,

We also did a recent migration, but we ignored this datapoint for our sizing. we're not yet fully migrated so i can't say what the difference is between both device counts.

Kind regards,

Jurgen

0 Likes
jng1 Absent Member.
Absent Member.

Re: Licensing query: device count

no Vulnerability scanners yet, but good reminder there. thanks!

0 Likes
jng1 Absent Member.
Absent Member.

Re: Licensing query: device count

no problem. I'm still trying to find out more, perhaps you might be able to share more when you have completed the migration.

thanks for your help!

0 Likes
Jurgen
Visitor.

Re: Licensing query: device count

Hi,

According to thread:

it's the following:

--------------

I got the information from support that this issue is confirmed as a bug.

It is related to both versions ESM 5.0 SP2 and ESM 5.2 GA - and it's not fixed jet.

Support is recording it with the bug ID ESM-47082.

So if you want to show ArcSight your interest, create a support case and let the engineers attach your case to the bug. Maybe then it will get more attention.

Regards

Tobias

----------------

Kind regards,

Jurgen

0 Likes
Highlighted
Samour Absent Member.
Absent Member.

Re: Licensing query: device count

Also:

This bug still persists in the latest versions as well.

The 1,000 is the max and not how many are actually reporting.

Currently it does not seem that ArcSight tracks devices from a licensing perspective although they will charge you for them

0 Likes
victorpichler Absent Member.
Absent Member.

Re: Licensing query: device count

I still have a problem with this in ArcSight ESM 6.5 SP1. Anyone else had the same problem and solved it?

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.