Using Snare Agent Manager
- maria ieropoulos
Each SAM feature license issued provides you with an activation allowance for each feature covered by the license. Let's say that you have ordered a license that allows Standard Logging (Audit / Epilog) for 20 Agents. You'll be able to use SAM to distribute this allowance across all version 5 Agents and pre-version 5 Agents. It's important to note that all pre-version 5 Agents detected by SAM that support the given feature will be counted towards to the allowance. OpenSource Agents are not counted towards your allowance.
Pre-version 5 Agent Feature Allocations
| Agent | Feature | Feature Key |
|---|---|---|
| Snare Enterprise Agent | Standard Logging | IA_LOG |
| Snare Enterprise Epilog | Standard Logging | IA_LOG |
| Snare Enterprise MSSQL | MSSQL Logging | IA_LOG_MSSQL_HOST |
Example 1:
Let's say you have an allowance for 20 Standard Logging (IA_LOG) Agents. Your network consists of 10 version 5 qualifying Agents and 7 pre-version 5 qualifying Agents. This would result in you having used 17 of the available 20 slots for the Standard Logging Agents feature. At any point you'l be able to add three further Agents to bring you up to the allocated allowance.
Example 2:
Let's stay with the allowance for 20 Standard Logging (IA_LOG) Agents. This time however, you've setup SAM and found that you have 30 pre-version 5 Agents installed on the network. At this point, SAM will update the features status to OVERLIMIT. At the point that the feature first becomes OVERLIMIT, SAM will start warning you via messages on the Dashboard and via the Notification Center that the feature is OVERLIMIT. SAM will also commence a 60 day countdown, in which you'll need to either remove enough agents to bring the usage count down to the allocated allowance or install a secondary or obsoleting license that allocates the feature a higher allowance to cover the difference in usage.
In this scenario, should the features usage have not been adjusted to meet the allowance or the allowance not increased to meet the usage, after 60 days all version 5 Agents using the feature would become unlicensed. With these Agents unlicensed, their logging functionality would have ceased.
License Feature Statuses
| Status | Meaning |
|---|---|
| AVAILABLE | License feature allowance has available slots. |
| EXHAUSTED | License feature allowance has been met but not exceeded. |
| OVERLIMIT | License feature allowance has been exceeded. Notifications will be generated on the Dashboard and in the Notification Center. If after 60 days the feature status has not been lowered to AVAILABLE or EXHAUSTED, all licensed version 5 Agents will be unlicensed. |
Licenses Issued By Snare Agent Manager
When using SAM as the tool to license Agents, individual Agents will be provided with licenses of type CONTROLLER-EVALUATION or CONTROLLER-FULL. Whether an Agent is provided with an evaluation or full license is directly dependent on whether the Agent has been licensed using a evaluation or full feature license by SAM.
SAM will issue a new self-generated license every 24 hour period to Agents with an expiry of 30 days. This policy allows for communication between SAM and an Agent to be lost for up to 30 days yet still ensure that the Agent will be licensed and continue function in accordance with the issued license.
If after 30 days communication between the SAM and an Agent has not been re-established, the Agent will become unlicensed and its functionality will cease.
How can I tell if Agent is communicating with Snare Agent Manager?
We have two direct indicators to help you determine any connectivity issues you may have between SAM and Agents:
1) Agent List pages have an indicator on the left side that is either green or red. Green indicates that the agent successfully communicated in the last 10 minutes. Red indicates that the agent has not communicated with SAM in the last 10 minutes. Agent are configured to communicate with its assigned SAM at 10 minutes intervals.
2) We've setup a predefined Agent List filter to display all Agents with a communication issues. From SAM, to access this list simply select Agents then Communication Issue from the sidebar.
Using Standalone Agents
Version 5 or newer Agents can be standalone licensed via the Web Management Interface or via the Command Line Interface. Standalone licenses come in two flavors, EVALUATION and FULL.
Evaluation licenses are not locked to an individual host system however, they have a short expiry which is typically 30 days. Full licenses are always locked to an individual host system by Key ID's. Key ID's are an array of key value pairs that are unique to each individual system. They can be access from the License page of any Agent installed on a given system.
Standalone licensed Agents will, if configured, communicate with SAM at 10 minute intervals, however, as they're licensed separately they will not be issued a license by SAM. In this situation where an Agent is on a network and can see a SAM, we highly recommend to use SAM's licensing functionality.