Over 50 percent of enterprises have adopted virtualization to one degree or another, according to a study by research firm TheInfoPro, making it one of the most rapidly adopted technologies in recent years. But while virtualization opens up an entirely new world of possibilities for organizations that embrace it, the benefits do not come without old world legal risk. Specifically, few organizations have begun to grasp the software licensing implications of deploying virtual servers and software, not to mention the subsequent challenges of upholding the terms of their existing license agreements. Read on to ensure you can develop the necessary processes and controls to effectively track and manage your software compliance status in a virtualized world.

The Virtues of Virtualization
Virtualization, at the most basic level, involves maximizing the capabilities of a PC or server. New server environments can be implemented without new hardware, thousands of machines can be supported by a single physical server, and applications can easily be streamed from server to desktop—with potentially huge savings in hardware costs and energy consumption.

Within virtualization itself, there are two overarching categories: hardware virtualization and software virtualization.

Hardware virtualization pertains to a single machine configured to simultaneously run multiple "virtual machines" or "virtual servers," each of which acts as if it were a stand-alone hardware device with its own operating system. The benefit of a virtual server relates to its ability to run autonomously, eliminating many of the complexities associated with running multiple applications on a single server. For example, one may choose to isolate a CRM system from an accounting program because they have vastly different system requirements. Furthermore, if one application causes issues with a shared system (a SQL server, for example), the other application won't be negatively impacted. Yet another advantage of virtual servers is that if one malfunctions, it's not necessary to re-install a new one—you can simply bring up another virtual server.

Software virtualization, on the other hand, is quite different. It includes such subcategories as application virtualization, desktop virtualization, network virtualization, storage virtualization and more. The common element within these subcategories is the pooling of information at a central source and its distribution to other sources as needed, effectively conserving resources, memory and bandwidth. For example, application virtualization allows an application to be streamed from server to desktop without first installing the application on the desktop itself. Applications can subsequently be managed from a central location, simplifying and expediting maintenance and upgrades.

The Licensing Conundrum
It's easy to see the endless possibilities of virtualization and its promise for organizations that choose to adopt it. It's also easy to imagine how such a significant paradigm shift inevitably challenges old assumptions and breeds new uncertainties. One concern regularly overlooked by those swept up in the virtualization craze is the ambiguity surrounding software license agreements, most of which do not provide specific guidelines for applications running on virtual machines. To further complicate matters, most traditional license management tools have not yet evolved to the point where they can simultaneously and comprehensively support licensing schemes for both virtualized and non-virtualized environments.

To illustrate, consider the following scenario: Dave works at XYZ Corporation, and has implemented several virtual servers to isolate applications. Like most IT professionals, he understands that every instance of software being run on a virtual machine must have its own separate license, as does every desktop to which virtualized software is streamed. Dave has also deployed the Microsoft Windows 2003 R2 Enterprise Edition operating system (OS) to one of his physical servers. Microsoft's End User License Agreement (EULA) specifically permits four virtual instances for each physical license, two of which Dave has deployed to virtual servers running on the licensed machine. Dave is very conscientious about software compliance and had previously implemented a license management tool that periodically inventories all software installed across his network. So far, so good.

But here is where things get tricky. Dave's license management tool, which offers comprehensive support for software installed in traditional non-virtualized environments, can identify the presence of every virtual server license. But Dave is not aware that in order to "detect" and account for the applications residing on each virtual server, he needs to deploy the tool's inventory client to each virtual machine.

In addition, Dave's license management technology does not allow him to distinguish between applications running on physical machines and their associated copies residing on virtual machines. This creates a Catch-22 in terms of license compliance; if he tries to monitor compliance by deploying an inventory client to all virtual machines, any applications that allow multiple instances to be run on virtual servers under a single license will be over-counted—and will therefore likely appear to be out of compliance. Under this scenario, Dave's reports will indicate he is running three unique copies of 2003 R2 Enterprise OS, two of which are incorrectly flagged as unlicensed, or non-compliant. Paradoxically, if he deploys the inventory client only to physical machines, the applications running on the virtual servers will likely not be properly inventoried or accounted for from a licensing perspective, leading to the false conclusion that they are compliant with their license agreements.

Finally, although Dave knows that in order to remain compliant with his software contracts, physical desktops must have individual licenses for any virtualized applications they access, his license management tool is not able to report on virtual software usage. In order to ensure the applications are properly licensed, he needs to find and deploy yet another piece of technology that allows him to "meter" or collect usage data on virtual applications streamed to physical desktops.

The good news is that a few vendors in the license management space, such as Express Metrix, are already well down the path of supporting virtualized environments. Express Metrix's IT asset management solution, Express Software Manager, can detect virtual machines, inventory and meter all software installed on those machines, and reconcile discovered files with purchasing data. The next release of the product, slated for late 2008, will offer metering for applications delivered via software virtualization. The company expects that as independent software vendors (ISVs) begin introducing license agreements that specifically address software running in virtualized environments, its product line will evolve to include comprehensive compliance reporting for any conceivable licensing scenario.


Licensing 101 for Virtual Novices
While Dave waits for his license management technology to incorporate broader support for virtualized environments, how can he stay out of hot water with his software publishers? The following tips will help IT professionals ensure their virtualization strategy doesn't put their organizations at risk of costly license compliance violations.

Know thy EULA. You must manage licenses residing on virtual servers as conscientiously and according to the same criteria as those deployed on physical servers. Read your software manufacturers' license agreements carefully to determine whether or not virtual licenses are specifically addressed in your contract. If software is licensed "per seat," and virtual licenses are NOT specifically addressed in the EULA, you should verify with the manufacturer that each virtual machine requires its own license, as well as any machine that accesses it.

Stay true or be sued. In order to stay true to your license agreements, you must adapt current license management practices to properly monitor software compliance within your virtual environment.

• Make sure your inventory tool can automatically detect software installations installed on virtual machines and reconcile discovered applications with purchasing information to identify any copies that are out of compliance.
• Manually track OS deployments on virtual servers and map them back to their licensed physical machine.
• Meter the use of virtualized software residing on remote servers to ensure no more copies are being used than are properly licensed (unless you are restricting access to those applications or servers). Most likely, you will need a license for each computer (physical or virtual) that accesses any given virtualized application.

The bottom line: Until license management technologies catch up with the reality of an increasingly virtualized world and more software publishers offer licensing models consistent with this new paradigm, the onus is on IT professionals to find ways to navigate the ambiguities. In the meantime, it is important to tread carefully into virtualized territory, so as not to run afoul of your existing license agreements.



Jeff Kelsey is Vice President of Products and Services and one of the original founders of Express Metrix. He is a skilled software and systems engineer with many years experience in various development and managerial roles. Prior to founding Express Metrix in September 2000, Kelsey managed WRQ's North American systems engineering unit where he worked closely with customers and aided the future releases of Express and other WRQ product lines.