PLEASE NOTE: This article does not apply to Cloud Web Metering.  If you are using Cloud Web Metering please use the guide : Technical Description: Cloud Application Metering for Snow Inventory

Requirements

Web metering requires:

1. Windows inventory client 3.5 or later
2. IDR 2.0 or later
3. LM 6.2.or later

General

How does web metering support HTTP/HTTPS?

• Web metering supports HTTP/HTTPS by mapping TCP/IP tables to DNS records Privacy.
  • Whether the traffic is encrypted or not does not matter.
  • We don’t care about the application layer (the actual HTTP/HTTPS traffic)

Is URL filtering possible?

• URL filtering is not applicable/possible
  • URLs are specific to the application layer (HTTP) and not visible to Inventory
  • We recommending using distinct DNS records (CNAMEs or A/AAAA with unique IPs per application) when necessary.

Where does the DNS Monitor Driver show?

• The Snow Software DNS Monitor Driver (DNS packet filter driver) will show in the Event Viewer, under System when Snow Inventory is configured to track specific web usage

Configuration files

• The Client.config file contains web application patterns, these patterns are applied to identify which connection to meter.  The IDX allows us to configure Snow Inventory from within Snow License Manager.
• IDXEndPoint needs to be configured in client.ini. When changes are made in Snow License Manager it can take up to 24h before they propagate to all clients. This is otherwise normally updated when a scan is run or inventory services is restarted.
• The presence of the following files constitutes the IDX (these files are located in the \bin folder)
  • Autofac.Configuration.dll
  • Autofac.dll
  • Autofac.Integration.Web.dll
  • SnowSoftware.Inventory.Server.dll
  • SnowSoftware.Inventory.Server.pdb
  • SnowSoftware.Inventory.Server.WebHost.dll
  • SnowSoftware.Inventory.Server.WebHost.pdb

Web Patterns

• The DNS patterns to be monitored are configured in License Manager web. 
• The patterns cannot contain port numbers, specific pages or subdirectories.
• Port 80 and port 443 is monitored by default. Any other required ports must be added to the system setting WEB_PORTS. Separate multiple port entries using comma.

Example: 80,443,8080

Supported patterns

• www.sitename.com

Unsupported patterns

• www.sitename.com:8080
• www.sitename.com/subdir
• www.sitename.com/mypage.html
• sitename

Patterns on client computer

Patterns and ports are locally stored on each client computer in the client.config file. 

Metering

• All web metering usage is stored in the .MET file connected to the application that accessed the web site. (Chrome or IE for example.) 

• Details regarding web metering is also written to the log, if loglevel is set to 5. 

Example of client verifying the configured patterns: 
12:55:31 : DEBUG: client64 Web app 'c60c8f1f-33a3-4165-9d95-e06ec62f15ca' has the following patterns. 
12:55:31 : DEBUG: client64 www.reddit.com

Example a matching webpattern found: 
12:59:17 :  : client64 Process 5556 connection www.reddit.com (23.3.90.137) matches application 'c60c8f1f-33a3-4165-9d95-e06ec62f15ca'.

Result in INV-file

• The web metering will be added to the inventoryfile at scan. Use iview to examine the inventory files. 
• Only metering rows will be added, no software rows. Look for the tag IsWebApp="1" to identify the webapplications.

<Metering Manufacturer="Google Inc." UserName="EUSE\marchr" Name="Google Chrome" PathName="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" Version="32.0" DomainName="EUSE" LanguageName="English (United States)" FullVersion="32.0.1700.107" IsLocal="1" LastUsed="2014-02-08 12:37:00" WebAppHostList="www.reddit.com" UsageMask="4096" Minutes="1" WebAppName="c60c8f1f-33a3-4165-9d95-e06ec62f15ca" Day="2014-02-08 00:00:00" RegularAverage="0" IsVirtualized="0" RegularCount="1" FirstUsed="2014-02-08 12:37:00" IsWebApp="1" Counter="1" DeviceId= IsRemoteDesktop="0"/>

Troubleshooting

Known issues and limitations

• Proxies will hide the target URL from inventory client. All sites to be monitored must be excluded from the proxy.
• The autoproxy setting is NOT applied when fetching webapp patterns from Snow Inventory Server.
• Web metering does not work if SLM is configured to use SSO without additional configuration in IIS
• Partner platforms cannot have a data source configured with site name %
• Partner customers cannot have web patterns with site name %
• No support for WINS or IPv6
• No support for Windows 2000

Verifying the IDX

• Make sure that you can browse to the IDX endpoint configured in the client.ini: 

http://localhost:8080/v1/Inventory.ashx/

• Add parameters site name, config and section to retrieve the patterns. 
• The value % is encoded in all URL:s, replace % with %25. 

http://localhost:8080/v1/Inventory.ashx/config?site=%25&config=%25&section=WebApps&section=WebPorts

• IDR is requesting the patterns from License Manager Web. The URL to LM IDX is located in web.config of IDR. 

<add key="SnowSoftware.LicenseManagerConfigEndPoint" value="http://localhost/IDX/InventoryConfigUpdate.ashx"/>

• If you cannot retrieve the patterns from IDR, try querying License Manager web directly: 

http://localhost/IDX/InventoryConfigUpdate.ashx/config/?site=sitename&config=configname&section=WebApps

• If the IDR is unable to retrieve the patterns it might be an authorization problem. Any customer running SLM with SSO will run in to this problem. Check the IDR log.
• You may need to change the Authentication settings on the IDX folder in IIS manager to allow Anonymous Authentication and disable all the others. Restart the SLM web-server after making this change.
• System.Net.WebException: The remote server returned an error: (401) Unauthorized.
• The License Manager website must be configured to allow anonymous access.

Client.config exists, still no metering reported

• Raise log level to 5
• Make sure client.config contains the expected patterns and ports
• Clear browser cache
• Browse to a monitored website, let it be open for 10-30 sec.
• See if client.log has catched the DNS entry:

12:59:17 :  : client64 Process 5556 connection www.reddit.com (23.3.90.137) matches application 'c60c8f1f-33a3-4165-9d95-e06ec62f15ca'.

• Examine metering files from browser using iview

• List all active TCP/IP connections

netstat -n -p TCP > tcp.log

• List all DNS cache entries

• Check for Snow Software Dns Monitor Driver

You should find a note in the windows system log when the swpcap64.sys is loaded as a kernel driver.