How does the ProxySG appliance calculate the number of Websense user licenses in use?

Products

• ProxySG Software - SGOS

Issue/Introduction

What does the licenses in use subcommand in the show content-filter websense command indicate?

Resolution

The licenses in use subcommand under the show content-filter websense command is calculated based on a high watermark of total users on a daily basis. This value is the count of unique source IP addresses of Websense users during a 24-hour period (starting at midnight UTC or when a restart occurs). The proxy then sends the maximum high watermark to WebSense. The current high watermark reflected as License in use is the maximum high watermark over the last 7 days.

 

Here is an example that explains this concept. The following data depicts the high watermark of unique source IP addresses seen on a daily basis for the last 7 days:

 

 Sun    Mon    Tues    Wed    Thur   Fri    Sat

 2000   7213   7354    6892   7045   7222   3000

 

Here, the WebSense license in use value will display as 7354, as this is the current highest value over the last 7 days. It is not the current day's high watermark or an instantaneous count of users.

 

Now let's imagine that we have just rolled from Thursday midnight to Friday 00:00.

 

 Sun    Mon    Tues    Wed    Thur   Fri    Sat

 2000   7213   7354    6892   7045   0      3000

 

At the start of Friday 00:00:00, the Friday counter will be reset to zero so now we no longer have the prior 7222 value. However, there is no change to the value of licenses in use because the max highwater mark is still Tuesday's 7354.  Now as each new source IP for an HTTP request is categorized, the  counter in the table of licenses in use increments by 1.

 

So now at 00:05 on Friday the WebSense license table  may look something like below.

 

 Sun    Mon    Tues    Wed    Thur   Fri    Sat

 2000   7213   7354    6892   7045   200    3000

 

Because WebSense uses the source IP address to count users, even if you have only 1000 users or even 1000 PCs/Laptops, you may have 2000 different IP addresses that WebSense counts. For example, if a laptop user roams on DHCP (on a wired and wireless network), WebSense will count the same user many times based on the IP addresses on the laptop. Therefore, WebSense licensing will count your licenses in use as 2000.

 

When the license limit is exceeded, say you get the 9001 new source IP and you have a 9000 user license, then that 9001'st source IP request doesn't get categorized, and policy rules matching the category "none" get applied to this request. If the administrator configured the ProxySG to deny access to the category "none", the user will be denied access to the URL. If the administrator allows access to category none, then the source IPs that exceed the license limit have unfiltered access to the Web.

 

Note: You cannot reset the 7-day high watermark. If, in the example above, the usage dropped considerably on Friday and the maximum number of licenses in use that day was 1500, the count will not reflect the change until after the counter on Thursday is reset. Thus, a full 7 days must pass after usage drops before the lower traffic statistics are reflected.

 

As we cannot track current count of users on each day on ProxySG, we have an alternative to track the number of unique IP addresses everyday from access log by using Reporter 9.x. Please refer to KB#3891 for details.