Monitoring of software licenses 1s. Script to get a list of all licenses

tutorial

Many companies use 1C as the main automation platform. So it happened with us. However, the process of establishing the platform was carried out without a proper approach, in connection with which at first we had 5 protection keys for 95 licenses, then 3 more physical keys appeared to provide another 50 client licenses for 3 legal entities. The situation is stupid, since each key normally requires separate hosts, and there were fewer and fewer servers suitable for this, and the looming increase in the number of users and, consequently, the purchase of new keys, made me think about an alternative solution to avoid unnecessary information load on our servers and in general to make the key system more flexible and, preferably, more stable.

System selection

Virtualization system

Esxi 5.1 was chosen as the visualization system. Chosen for good support for USB device transfer and because, apart from ESX, I only understand Hyper-V, which does not support device transfer.

To transfer USB devices to ESX, the hardware of the guest system must be at least version 7. Then it will be possible to add USB controller and primappit USB device to the guest system. There is also a point about support. Officially, VMware only supports a certain list of devices. And he's not very big. However, Aladdin's ordinary security keys seem to be supported. The list of supported devices is on the official website. And a description of the requirements and provisions for USB barring to the guest system is also on the official website, in the knowledge base.

There are also alternative ways forwarding USB keys to a virtual environment, and to a physical one too. These devices and software are the so-called USB over IP. Software products in this case, it is not very interesting to consider, but in this case, the iron ones show themselves well. The brightest representative, the well-known AnywhereUSB with 14 ports. It is installed in a rack, has two interfaces and two power inputs (whether it really has two power supplies, I don’t know :)). The device is good for everyone, but it costs an average of 60 thousand rubles, which did not fit well into our budget.

So, after tests and trials, the virtualization platform was chosen and the use of other products was abandoned.

Operating system and HASP drivers

I chose Debian as the OS. Why? Just because. In fact, in this configuration, you can take any favorite distribution kit. But I always like Debian for its stability and good repository.

A fairly popular package from Etersoft is taken as drivers. You can get the compiled package for your distribution from FTP server companies: ftp.etersoft.ru/pub/Etersoft/HASP/stable .
After installing the package, the haspd service appears, which controls the operation of the dongle.

Setup and verification

Some additional settings all this is not required. The key starts working almost out of the box.
We check. The haspdemo program is included to check the functionality. Upon successful identification of the key and the start of work, the program will output something like this to the console:

LOCALHASP_ISHASP: Result: 1
Using Passwords 15213 - 28875
LOCALHASP_HASPSTATUS: API version number is 8.0
port number 201
Key type: HASP4 M4
LOCALHASP_HASPGENERATION: OK, HASP4 is connected.
LOCALHASP_HASPNETSTATUS: connected key is HASP4 Net 20
MEMOHASP_HASPID: 436444258 (decimal), 0x1a039c62 (hex)
LOCALHASP_ENCODEDATA: OK.
53 C1 F1AF | EC 16 C3 15 | 35 31 E4 7F | 9B D0 90 9F
AA BA 8C 80 | 1E 22 29 E2 | 92 7E 04 56 | DA 70 7B 63 [.....")..~.V.p(c]
23 B4 9B E6 | 2F 17 | | [#.../.]
NETHASP_READBLOCK: Failed: Return status: 10

Main field: LOCALHASP_ISHASP: Result: 1 . Telling you everything is in order. Further it is written about which key is inserted.

However, if there is some problem, then the message is displayed shorter:

This is a simple demo program for the HASP4 key
Copyright Aladdin Knowledge Systems Ltd.
LOCALHASP_ISHASP: Failed: status = -100

Moreover, in fact, it doesn’t matter what happens to the key, it may not be inserted, the service may not be running, or something else. I have only seen two LOCALHASP_ISHASP values so far. It's either: Result: 1 or: Failed: status = -100 . And the latter always corresponded to inoperability, and the former always meant that everything was OK. I did not find documentation for this package, so I could not find out what other statuses there are.

Done with the key. We must not forget that your newly minted key will appear in the key monitor only when at least one license is taken from it. Then aladdin monitor will show the information that it usually shows: this is the type of key, the number of licenses taken, total licenses, who exactly took the license and timeout.
It is quite simple to force this, it is enough to specify a new license manager in the client nethasp.ini manually. But about setting up the client a little later.

From this point on, the initial task can be considered completed. Now we can create several virtual machines in parallel, in an amount corresponding to the number of physical keys available. Resources such virtualka consume, of course, penny.

Problems and Solutions

Single point of failure

The first problem that is created and in plain sight is the creation of a point of failure. If before that the keys were distributed to different servers and the failure of more than one key is practically excluded, then in this case the failure of the physical server may lead to the failure of the entire 1C system, because. clients will fall off within, in my opinion, 600 seconds and after a short time all will fall off and will not be able to return to the system. What will follow such an incident can not be told. There are two solutions and they are directed in different directions. The first solution is to use a failover ESX configuration. However, this makes sense if your company has already deployed this system and has already met a number of requirements to maintain operability in case of failure of any component. Another solution is more trivial:
We create a group of A records in our company's DNS. For example, key1, key2, key3 and so on. We enter DNS names in nethasp.ini clients, distribute the file using group policy. Thus, we get a fairly flexible access structure. In this case, after discovering a significant problem with virtual server esx, you can quickly move the keys to any other servers, incl. to the workstations of any employees. In parallel, we replace A records with new ones. For some time, the cache on the clients will run out and they will again be able to get a new license and continue working.
I recommend setting reverse DNS records for keys, otherwise aladdin monitor will not show the host name, but will only show the license manager ID, which is not very convenient.
If your company and everything uses a broadcast key delivery method, then everything is simplified and moving the key to another host within the broadcast domain will not affect your work in any way.

Keys fall off

There is a fairly common problem. The keys fall off. However, no particular relationship was observed. This happens on different controllers, even on different host systems. When I moved the keys and temporarily placed them in another place under the control of VMware Player, the keys fell off frequently. This is expressed rather trivially. When requesting haspdemo , the line LOCALHASP_ISHASP: Failed: status = -100 appears. Although the key is inserted and detected. dmseg shows lines that are not fully understood: usb 2-2.1: usbfs: USBDEVFS_CONTROL failed cmd aksusbd rqt 192 rq 139 len 8 ret -110
The problem is solved as trivially as it looks - by restarting the service. But the sediment remains and until this is done, the server will not distribute the keys. Since I want the system to work flawlessly, it was decided to write a script that would restore the license manager itself. So, with the help of a friend, a script was written that runs haspdemo and tries to figure out if the status is returning normal or not:
[ "`haspdemo | sed -n "s/^LOCALHASP_ISHASP.* $\-\?*$$/\1/p"`" == "-100" ] && service haspd restart
Further, this script is inserted into the CRON launch every minute and that's it. Even if your system does not have the problem of falling off ports, this script, I think, will not hurt.

Client Key Discovery Problem

And there is such a problem. It consists in the fact that the client, after losing the key, may not want to take a new key. Also, this problem can be expressed in other manifestations. For example, if you changed the paths to the keys in the nethasp.ini file, then the client application can quite cheerfully continue to report that there are no keys and have never seen them. If you are not ready for such a reaction, then the problem becomes very unpleasant and you begin to frantically check the operation of the entire system and curse 1C nicknames, because everything works, but GlavBukh or, as luck would have it, the General, cannot now enter 1Sku for some unknown reason and you feel like an idiot instead of fixing the problem quickly. However, a fairly simple solution has helped so far. It is necessary to clear the 1C cache from the user profile. At one time I found separate file who is responsible for this information, I forgot which one :(

Keys might just stop working

No one is immune from equipment failure. And those pathetic keys can stop working too. And the most important thing in this case is to find out about it as early as possible. To do this, we will use the Zabbix monitoring system. Of course, deploying it only for monitoring the keys is pointless, but if Zabbix is already installed, then why not attach monitoring of the state of the keys to it.
To do this, we need to write our own script in the agent settings file. We are looking for the configuration file of the installed zabbix_agent, it is called zabbix_agentd.conf. Open it up and add the line

UserParameter=hasp.status,haspdemo | grep "^LOCALHASP_ISHASP" | sed "s/^.* $\-\?*$$/\1/g"

This will allow on command to collect a numeric value in the LOCALHASP_ISHASP field. In zabbix itself, everything is added already primitively, we create item for the desired host or template, as type indicate zabbix agent, specify as the key parameter hasp.status. Value type - float. If desired, we create a trigger by which you will receive a letter or SMS that the key does not work. It is better to configure this trigger in such a way that it would require at least 2 hits and cover the time required by the auto-recovery script described above, otherwise false messages about problems with the key will appear.
With the correct settings, only if the key is completely inoperative, you will receive a notification of problems.

Bonus

It turned out to be a surprise for me, but many people really don’t know that it is possible to force 1C client parts to look for keys at specified IP addresses using a TCP or UDP connection. Indeed, many people set up their infrastructure so that each broadcast domain has a sufficient number of keys. This is wildness. For those who don't know yet, here's a quick guide:
To control access to the hasp key, there is a nethasp.ini file on the client. It is located in the \conf folder of the 1C directory. We are interested in the section In this section, we need to uncomment or create the following options:

NH_SERVER_ADDR. Here we specify a list of DNS names or IP addresses of servers with a license manager separated by commas.
NH_USE_BROADCAST. Set the value to Disabled.
NH_TCPIP_METHOD. The default method is UDP. You can change to TCP, but in general there is no serious need for this.

Another point about the display of keys in the aladdin monitor. Contrary to popular belief, free licenses are not only those licenses that are not used in the aladdin monitor, but also those that have 0 in the Timeout field. Values usually disappear within 36 hours, but licenses are still considered free.

In conclusion

I thought for a long time whether there is any point in such an article, after all, all this can be found on the Internet, however, considering the time that I myself spent to collect all the information, I thought that it would be very good if at least someone this The article will be useful and save time.

tutorial

System selection

Virtualization system

Esxi 5.1 was chosen as the visualization system. Chosen for good support for USB device transfer and because, apart from ESX, I only understand Hyper-V, which does not support device transfer.

To transfer USB devices to ESX, the hardware of the guest system must be at least version 7. Then it will be possible to add a USB controller and map the USB device to the guest system. There is also a point about support. Officially, VMware only supports a certain list of devices. And he's not very big. However, Aladdin's ordinary security keys seem to be supported. The list of supported devices is on the official website. And a description of the requirements and provisions for USB barring to the guest system is also on the official website, in the knowledge base.

There are alternative ways to transfer USB keys to a virtual environment, and to a physical one too. These devices and software are the so-called USB over IP. In this case, software products are not very interesting to consider, but iron products in this case show themselves well. The brightest representative, the well-known AnywhereUSB with 14 ports. It is installed in a rack, has two interfaces and two power inputs (whether it really has two power supplies, I don’t know :)). The device is good for everyone, but it costs an average of 60 thousand rubles, which did not fit well into our budget.

So, after tests and trials, the virtualization platform was chosen and the use of other products was abandoned.

Operating system and HASP drivers

I chose Debian as the OS. Why? Just because. In fact, in this configuration, you can take any favorite distribution kit. But I always like Debian for its stability and good repository.

A fairly popular package from Etersoft is taken as drivers. You can get the compiled package for your distribution on the company's FTP server: ftp.etersoft.ru/pub/Etersoft/HASP/stable .
After installing the package, the haspd service appears, which controls the operation of the dongle.

Setup and verification

It does not require any additional configuration. The key starts working almost out of the box.
We check. The haspdemo program is included to check the functionality. Upon successful identification of the key and the start of work, the program will output something like this to the console:

LOCALHASP_ISHASP: Result: 1
Using Passwords 15213 - 28875
LOCALHASP_HASPSTATUS: API version number is 8.0
port number 201
Key type: HASP4 M4
LOCALHASP_HASPGENERATION: OK, HASP4 is connected.
LOCALHASP_HASPNETSTATUS: connected key is HASP4 Net 20
MEMOHASP_HASPID: 436444258 (decimal), 0x1a039c62 (hex)
LOCALHASP_ENCODEDATA: OK.
53 C1 F1AF | EC 16 C3 15 | 35 31 E4 7F | 9B D0 90 9F
AA BA 8C 80 | 1E 22 29 E2 | 92 7E 04 56 | DA 70 7B 63 [.....")..~.V.p(c]
23 B4 9B E6 | 2F 17 | | [#.../.]
NETHASP_READBLOCK: Failed: Return status: 10

Main field: LOCALHASP_ISHASP: Result: 1 . Telling you everything is in order. Further it is written about which key is inserted.

However, if there is some problem, then the message is displayed shorter:

This is a simple demo program for the HASP4 key
Copyright Aladdin Knowledge Systems Ltd.
LOCALHASP_ISHASP: Failed: status = -100

Problems and Solutions

Single point of failure

The first problem that is created and in plain sight is the creation of a point of failure. If before that the keys were distributed to different servers and the failure of more than one key is practically excluded, then in this case the failure of the physical server may lead to the failure of the entire 1C system, because. clients will fall off within, in my opinion, 600 seconds and after a short time all will fall off and will not be able to return to the system. What will follow such an incident can not be told. There are two solutions and they are directed in different directions. The first solution is to use a failover ESX configuration. However, this makes sense if your company has already deployed this system and has already met a number of requirements to maintain operability in case of failure of any component. Another solution is more trivial:
We create a group of A records in our company's DNS. For example, key1, key2, key3 and so on. We enter DNS names in nethasp.ini clients, distribute the file using group policy. Thus, we get a fairly flexible access structure. In this case, after detecting a significant problem with the esx virtual server, you can quickly move the keys to any other servers, incl. to the workstations of any employees. In parallel, we replace A records with new ones. For some time, the cache on the clients will run out and they will again be able to get a new license and continue working.
I recommend setting reverse DNS records for keys, otherwise aladdin monitor will not show the host name, but will only show the license manager ID, which is not very convenient.
If your company and everything uses a broadcast key delivery method, then everything is simplified and moving the key to another host within the broadcast domain will not affect your work in any way.

Keys fall off

Client Key Discovery Problem

And there is such a problem. It consists in the fact that the client, after losing the key, may not want to take a new key. Also, this problem can be expressed in other manifestations. For example, if you changed the paths to the keys in the nethasp.ini file, then the client application can quite cheerfully continue to report that there are no keys and have never seen them. If you are not ready for such a reaction, then the problem becomes very unpleasant and you begin to frantically check the operation of the entire system and curse 1C nicknames, because everything works, but GlavBukh or, as luck would have it, the General, cannot now enter 1Sku for some unknown reason and you feel like an idiot instead of fixing the problem quickly. However, a fairly simple solution has helped so far. It is necessary to clear the 1C cache from the user profile. At one time, I found a separate file that is responsible for this information, I forgot which one :(

Keys might just stop working

UserParameter=hasp.status,haspdemo | grep "^LOCALHASP_ISHASP" | sed "s/^.* $\-\?*$$/\1/g"

Bonus

NH_SERVER_ADDR. Here we specify a list of DNS names or IP addresses of servers with a license manager separated by commas.
NH_USE_BROADCAST. Set the value to Disabled.
NH_TCPIP_METHOD. The default method is UDP. You can change to TCP, but in general there is no serious need for this.

In conclusion

Question: Monitoring software licenses

Good afternoon.
Windows Server 2008+ SQL server+ Server 1C 8.2.
Software licenses are installed on the server 10 pcs + 5 pcs = 15 pcs.
Maximum number of simultaneously working users - 13 pcs.
Base is one. Accordingly, users run only one instance of the program.
Sometimes some users cannot enter 1s (the program protection key was not found). It turned out by chance that users can log in again if one particular user restarts 1s-ku. Accordingly, as I understand it, this user spends more than one license in the course of his work.
Question: how to track which licenses went where and how to deal with such frozen licenses?

Answer:

good processing needed! But doesn't work)
(ExternalProcessing.MonitoringLicenses.ObjectModule(53)): (ExternalProcessing.MonitoringLicenses.ObjectModule(23)): Error calling constructor (COMObject): -2147221005(0x800401F3): Invalid class string
ThrowException DescriptionError();
Maybe someone could fix it?

Question: Problem with software licenses on 1c server

Hello dear forum users! Please tell me if anyone has come across how to be in such a situation.
Initially: there was a base 1s KA 1.1, 1s 8.2, platform 8.2.19.130, file on the terminal server. On the server itself, a key was installed for 10 user licenses and 5 software licenses (the license file was in C:\ProgramData\1C\1Cv82\conf). Users worked through terminal sessions.
Became: transferred to client-server option(1s x64 server, platform 8.3.8.2054), Postgres subd, users work directly from their workplaces. Computers obtain a license over the network from a server.
The problem is that the 1s server does not see software licenses. The license file was copied to the server conf folder (C:\Program Files\1cv8\conf), to the licenses folder (C:\Program Files\1cv8\8.3.8.2054\licenses - although I understand that the license should not be stored here), and also to the platform folder along the same paths (C:\Program Files (x86)\1cv8\conf, C:\Program Files (x86)\1cv8\8.3.8.2054\licenses).
As far as I read on the Internet, the software keys are searched for and picked up in the first place, so it should work ...
But sad thoughts visit me that when installing a software license for 5 users, something "sewn" into the register, which connects it with the original scheme, on 1s 8.2, and that the 8.3 server does not see. Since you will have to activate a new pin code on the software license, please help, tell me if this is really the case ??

Answer:

When activating software licenses, more than one file is created. It is best to write to the address, they answered me within half an hour on the issue of deactivating the license. They suggested finding and deleting all 2*.lic files and all conn8211.pfl files (or 1Сv8conn.pfl if version 8.3). Accordingly, at least you need to move all these files, but no one will tell if it will help, so I would write them a letter. Due to incorrect actions, the license package may be blacklisted.

Question: Software license and COM connection

A software license has been installed.
When I try to start 1C over a Com connection, it says:
-----------
No free license found!
Finding licenses on the client:
Software Licensing Error
Exceeded maximum amount users allowed by the software license file.
Source: V82.COMConnector.1
-----------
What is the problem?

Answer: The maximum number of users allowed by the software license file has been exceeded.

Question: How can I find out which file (.lic) corresponds to which software license?

Hello. There are two software licenses installed on the server (must be installed). But I see that only one is distributed. In C:\Users\1C_admin.1C8\AppData\Local\1C\1cv82\conf there are 3 files: 2014*****.lic in one of them, if you open it through a text viewer, it is written at the top (the software licenses themselves are numbered 8100** ***):
Server1 uses two copies of the same software license file: file://C:/ProgramData/1C/1Cv82/conf/2014*****.lic and file://C:/Users/1C_admin.1C8 /AppData/Local/1C/1Cv82/conf/2014*****.lic
Although this folder is empty.
The C:\Users\All Users\1C\1Cv82\conf folder is also empty.
Can this inscription be removed then everything will start to be heard?
And most importantly, I look through the administration console, the key server 8100 is a software key. And what is the key ORGL8 Set 20 - what is this key? Software or hardware? I think software, but why then the Server and not the client?

Answer:

Does no one know how to find out what license it is from the .lic file (corresponds to the license.lic number from the registration card)?

Question: Tricks of issuing software licenses by the 1C server

Hi all!
Friends, please tell me about the licenses, there are some things that are not clear to me.
A software license for 10 users is activated on the server. The server has a 1C server, a SQL database and a terminal server.
The issuance of licenses occurs as follows (maybe this is not accurate, correct if it is not right).
1. If the user has on his local computer there is a platform and it connects over the network to the 1c database on the server, then for each running instance of the program, the server gives it one license. That is, if a user launches 10 databases, then there will be no licenses left on the server.
2. If the user connects via RDP, then the server gives him one client license and the user will be able to run an unlimited number of program instances (bases).
The main question is whether the second point will work if the user connects to terminal server via RDP, software licenses will be activated there, but there will be no 1c server? In the terminal, he will have a platform but without a 1c server. Whether it is obligatory that item two worked, on the server of terminals there has to be a server 1s?

Answer:

such issuance of licenses works with any local launch of 1C (RDP is a local launch) if the license is not distributed by the 1C server

Question: Client software licenses are not distributed

Good afternoon.
Created a 1C cluster (8.3.7.1759) and a licensing server. Acted according to this instruction. (). Activated a multi-user software license on the license server. If I run the 1C client directly on the licensing server, then it normally receives a software license. From any other places, if we connect to the base on this cluster, a hardware license is issued. The license file is located here C:\ProgramData\1C\licenses

Answer:

There is read access. Assignment functionality added to the licensing server. The checkbox to use a hardware key is not worth it .. And it still gets an iron license ...
--- An association messages, Dec 28, 2015 ---

Okarlov said:

Check another logged bug
If the properties of the working server of the cluster set a limit on the number of information bases to a worker process, then functionality that is prohibited by the functionality assignment requirements may begin to be distributed to this server.
Click to reveal...

The cluster is new - there is only 1 base on it so far. Nobody works. The setup is now 8 bases, 128 connections per process.

Question: Problem with transferring a 1C 8.3 software license to a new server

Good afternoon.

The company had one physical server 1C 8.3 with accounting file databases. It had software licenses on it.

Purchased licenses for 1c ERP:

1.per platform for 20 people
2. to configuration 3. to server 1 s We also bought a new rack server, installed the 1C 8.3 platform on it, deployed the ERP test database, installed software licenses - everything is ok.

There was a problem with transferring file databases, or rather, I copied the databases themselves, but when starting 1C, it does not offer to enter a license, but says that the license was not found and suggests using a hardware protection key.

Tell me how to make 1C suggest introducing a software license for accounting file databases on a new server?

Answer: Super thank you!

Question: v7: 1C 7.7 TiS - could there be a software license?

Faced TiS 7.7 local without a hardware security key. As far as I remember, TiS 7.7 did not have deliveries with a software license? I remember on 7-ke there were some products with activation according to the words from the book - you had to find a word on such and such a page and then activation took place, that is, without a security key. But it seems that these were some industry decisions, as far as I remember. There is a box with a questionnaire, floppy disks and books, but there is no key anywhere. True, there is no LPT port on the PC, which is probably why they didn’t install it at the time, and lost it somewhere. But still, I would like to make sure that there was no TIS with software activation, only with hardware? Suddenly, I just always encountered hardware before.

Answer:

Good afternoon
The server has 2 software licenses for 20 connections each. The licenses ran out for no apparent reason, although I look through the monitor of connected users - there are only 19 connections.
How can I find out how many licenses are in use. From Aladdin, the program is good, but it only works with USB keys.
Thank you.

Answer:

"I look through the monitor of connected users - only 19 connections" - through which monitor do you see the issued software licenses?