Jan.christoffels

How Snow metering of windows application usage works.

Blog Post created by Jan.christoffels Employee on Mar 19, 2018

Why are we metering windows application usage? The primary focus is to measure the usage of desktop applications. If a user is using Microsoft Office 2016 Excel and then locks the computer, we know that the application will not be used until the computer is unlocked again. Since we are not interested in the time that we know Microsoft Office 2016 Excel is not used, we disregard that time. The main drawback with this approach is that we will not measure scheduled tasks and other background processes, such as anti-virus software, as used during the time that the computer is locked, although these processes might be executing in the background. 

 

To deliver this information, our agent gathers the necessary raw data. To enable Snow License Manager to calculate a combined duration of use for an application, the agent subscribes to start and stop events in the operating system, collecting the open and close timestamps for running applications. Deeper analysis of the user’s activity within a running process is not collected. So, a user can open Adobe Photoshop, for example, without doing anything within the application – the start and stop timestamps will be gathered by the agent anyway. However, the times that a computer is locked, in sleep mode, or hibernating are not included in the usage calculation.

The Snow License Manager web interface is currently the place where metering information is shown and below are three examples of what it can look like:

(The green boxes have been added to highlight where the metering details are shown)

We are looking at Jimmy Hill’s computer, COMPUTER01583.

By clicking the small arrow next to "Microsoft Office 2016 Excel", we expand this product to see the usage details:

Name, the name of the user that was using the application.

Last used, the date and time of the last known usage of the application, using the date/time settings (time zone, etc.) of the local computer.

Run, a "Snow interpretation" of how many times the application has been run. I will explain further down what we mean by Application usage (the "run count").

Total time (days:hh:mm), the total duration that the application has been run. This time does not include time when the screen is locked, in sleep mode, or hibernated. Multiple instances of the same application are disregarded. For example, if a user has 10 windows of Microsoft Word open for an hour, the total time is 1 hour, not 10 hours.

(The green boxes have been added to highlight where the metering details are shown)

We are looking at the specific application " Microsoft Office 2016 Excel " and the computers that have this application installed, with the following information from metering:

Last usedthe date and time of the last known usage of the application, using the date/time settings (time zone, etc.) of the local computer.

Runa "Snow interpretation" of how many times the application has been run. I will explain further down what I mean by "Snow interpretation".

Per run (hh:mm), the average time per run. For example, the average time per run is 44 min if the total time is 22 hours and the application has been run 30 times.

(The green boxes have been added to highlight where the metering details are shown)

We are looking at the "Application per user" report with report criteria Application like Microsoft Office 2016 Excel, via the Column selector we removed the columns Organisation and Application manufacturer and we added the columns Per day (hh:mm) and Total time (days:hh:mm): 

First usedthe date and time of the First known usage of the application, using the date/time settings (time zone, etc.) of the local computer.

Last usedthe date and time of the last known usage of the application, using the date/time settings (time zone, etc.) of the local computer.

Runhow many times the application has been run. I will explain further down what we mean by Application usage (the "run count").

Per run (hh:mm), the average time per run. For example, the average time per run is 44 min if the total time is 22 hours and the application has been run 30 times.

Per day (hh:mm), the average time per day. 

Total time (days:hh:mm), the total duration that the application has been run. This time does not include time when the screen is locked, in sleep mode, or hibernated. Multiple instances of the same application are disregarded. For example, if a user has 10 windows of Microsoft Word open for an hour, the total time is 1 hour, not 10 hours.

 

Application usage (the "run count") is calculated as follows:

  • The agent will check for events every 5 seconds (default value). Use the wmi.poll_interval setting in the agent configuration file to change the interval; 5 seconds is minimum and 120 seconds is maximum.
  • The agent increases the run count of an application only when it gets notified of a start event. If an application is started before the agent is running, that application will get a run count of "0".
  • When a scan is performed and the inventory result file is created, the run count will be set to "1" if the run counts reported from the agent sum up to "0".
  • When multiple instances of the same application are started, the agent counts all individual run starts during that session. However, the total duration will be counted from when the first instance is started until the last instance is closed.
  • A scheduled scan will contain all metering information that has been gathered since the last scheduled scan. A scheduled scan will clear all temporary metering files stored on disk, and new ones will be created after the scan with a run count of "0".
  • A manual scan will contain all metering information that has been created since the last scheduled scan. During the manual scan, the metering files stored on disk will be deleted, but their content is kept in memory. After the manual scan, the agent will recreate all metering files as they were before the scan.
  • At midnight local time, the agent will finalize the metering files for the currently running processes with an end time of 23.59.59. New metering files will be created with a start time of 00.00.00 on the next day

 

The primary focus of metering is desktop applications.

Metering of usage is performed whenever a Windows process is running. Processes are measured whether the application is open on the desktop or running in the background The following meta data is uniquely gathered per process:

  • File name
  • if the process is local
  • if the process is virtual
  • virtual app package name
  • username
  • date
  • File version info
  • usage data type (web, RDP, or VDI).

 

Criteria for showing application metering.

The criteria for the inventory client/agent to be able to track and display metering is that the application itself is recognized using a main executable file and the executable needs to create a service upon start, so that the client/agent can meter a start- and stop time of that application.

Keep in mind is that the client/agent might sometimes not pick up applications that are automatically started when booting the system if the application, and then also the service, is started BEFORE the inventory client/agent is, then the client/agent will not be able to get the start time of the service, which is criteria for it to be able to display metering data.

Outcomes