You sent the ILMT Audit Snapshot to IBM. Do you know what is in it?

An IBM audit letter rarely surprises anyone with its content. The list of requests always looks much the same, and near the top sits one item: Audit Snapshot reports from ILMT for the whole period under review. The ILMT administrator logs in to the console, opens the All Metrics report, sets the quarter, clicks Audit Snapshot, downloads a ZIP and passes it on. The file is a few dozen kilobytes. The whole thing takes a quarter of an hour.

The question comes after the file has gone: what exactly was in it? The auditor received data that nobody on your side has read, because in practice it is hard to read. Unpacked, the archive holds a dozen or so CSV files, with columns whose names no manual explains, and in those columns values such as "Recalculation Needed", "Incomplete virtualization hierarchy" or a date in a field called "End of Eligibility". The auditor knows what each of them means. You will find out from the preliminary findings.

This article shows what an Audit Snapshot contains, which fields an auditor checks first, and how to review the file before you send it: in two minutes, without uploading anything anywhere.

What an ILMT Audit Snapshot contains

An Audit Snapshot is a ZIP archive that IBM License Metric Tool generates from the All Metrics report. The exact set of files depends on the data in your environment and on the report settings, but a typical snapshot from ILMT 9.2 looks like this:

• data_condition.txt: the snapshot's metadata. ILMT version, who generated it and when, the period, the computer group, the filters applied, the software catalog and PVU table versions. At the end, the column list of every CSV file. An auditor starts here, because this file shows whether the snapshot covers the whole environment and whether the catalog is a year old.
• audit_snapshot_summary.csv: peak usage in the period, per product and metric. These are the numbers that end up in the auditor's spreadsheet.
• bundling_definitions.csv: every detected instance of IBM software. Computer, product, component, bundle, metric, installation path, first and last contact of the agent, whether the instance is confirmed, excluded or bundled manually, and the End of Eligibility date of the operating system. The longest file in the snapshot and the most read.
• pvu_sub_capacity.csv and, when present, pvu_full_capacity.csv: hosts and virtual machines with core counts, the PVU rate and a flag saying whether the virtualization hierarchy is complete. This is where you see which machines ILMT counts at the default rate because it does not know the physical host.
• vpc_capacity.csv: the same for the Virtual Processor Core metric.
• products_daily_*.csv: the value of every product for every day of the period. From this file an auditor sees gaps in measurement and one-day spikes.
• part_numbers.csv: the part numbers imported into ILMT, which is everything ILMT knows about your entitlements.
• audit_trails.csv: the log of changes in ILMT during the period. Who classified, excluded or changed what, and when.
• checksums.txt, signature.rsa, pub_key.pem: SHA-256 checksums of every file and the RSA signature of the ILMT server. They let the auditor verify that nobody corrected a CSV in a spreadsheet after generation.

Add readme.txt, the comment entered at generation and a few smaller files, for example cloud_paks.csv or the list of instances suppressed from reports.

What the auditor reads first

An auditor does not read the snapshot cover to cover. They have a list of fields to check first, because each of them opens the way to a finding. These are the ones that most often turn into a question for the client.

Used filters in data_condition.txt. A snapshot generated with a filter, or from a group other than All Computers, shows a slice of the environment. The auditor will ask about the rest and request another file.

Catalog Version and PVU Table Version. An old catalog means ILMT may not have recognized newer product versions. The auditor will recognize them with a current catalog and count them at full capacity, because ILMT has no history for them.

Computer Last Seen. A computer that last reported two months ago but still lists DB2 as installed is, to an auditor, a gap in the data. A gap in the data means full capacity for the period ILMT did not document.

End of Eligibility. A date in the past means the operating system of that machine lost its eligibility for sub-capacity licensing. From that day on the machine counts at the full capacity of its host, however many cores it has assigned.

Incomplete virtualization hierarchy in the PVU file. ILMT does not know the physical host of this machine, so it applies the default rate. The auditor will take the vCenter export and count for themselves, usually not in the client's favor.

Unconfirmed Product Instance. Instances nobody confirmed in ILMT are treated by an auditor as installed and in use. The argument "it is only a component of another product" works only when it is recorded in ILMT, not in an email after the fact.

Imported Part Numbers. A product with usage but no part number is a product for which you will have to produce a Proof of Entitlement. Sometimes the document turns up, sometimes it does not.

Recalculation Needed. A snapshot generated without recalculation shows numbers that ILMT itself does not consider current. The auditor sees that and may ask for a new file or count conservatively.

None of these fields is hidden. They are all in the file you sent. The difference is that the auditor knows where to look, while on the client's side there is usually nobody whose working day includes reading tens of thousands of CSV rows.

How to check an Audit Snapshot before you send it

This problem is where Audit Snapshot Validator came from. It is a free tool that reads the same ZIP and in two minutes shows what the auditor will see: a score from 0 to 100 and a list of problems and warnings in seven areas, from file integrity, server configuration, scans, virtualization and classification to part numbers and usage over the period. Every item is described in plain language, with the computer and product names from your file, and explains why an auditor will notice it. The report can be downloaded as an HTML file and discussed with the team.

The file never leaves your computer. The whole analysis runs in the browser, and there is no server behind the page that would accept snapshots. If your organization's security policy does not allow loading the report on an external website anyway, Audit Snapshot Validator Offline is available on request: a single HTML file that runs locally, with no installation and no internet access, issued by name and free of charge. Access to the offline version is requested through the contact form.

The tool is for orientation only and is provided without warranty. The score is not an official IBM measure and does not decide the outcome of an audit. Details are in the terms of use.

How to generate a snapshot that passes this check

Most of the warnings the tool raises in the configuration area come from how the file was generated. Five steps that put this in order:

1. In the ILMT console open the Reports menu and the All Metrics report.
2. Set the period: the last full quarter. Generate the snapshot only after the quarter has ended, otherwise the peak values are not final.
3. Leave the group on All Computers and apply no filters.
4. If the report shows a notice that recalculation is needed, run it first and wait for it to finish.
5. Click Audit Snapshot in the report bar, add a comment if you need one, click Generate and download the ZIP.

Archive snapshots for at least two years. IBM's sub-capacity terms require it, and that is how far back an auditor will ask.

What to do with the result

The validator's report is a list of symptoms. The causes sit in the ILMT configuration, in the agents, in the VM Managers and in decisions made several quarters ago, none of which the snapshot shows. If the list is short and the score high, send the file. If not, there are two further steps: a free 30-minute call, where we go through the list and I tell you what the options are, and if it makes sense to go further, an ILMT Health Check, a paid review of the environment with access to ILMT, ending in a diagnosis of the causes and a remediation plan.

If the audit letter is already on your desk and the snapshot has gone out, read the IBM license audit guide or see what help during an active audit looks like.

Frequently asked questions