SAM Professional over-allocated – passive discovery CIs inflating the count

[Community Alums]

Problem
Subscription Management showed SAM Professional allocated at about 5 times the purchased count. We needed to know if this was a counting bug or real, before renewal.

Step 1: Find the meter
- Our entitlement table was license_details (not ua_subscription).
- Each subscription record shows its quota definition and meter type.
- Open the definition in ua_stats_defn and note the table, filter and the column it sums.
- Some instances have two SAM definitions: one counts raw devices, the other counts subscription units. Check which one your subscription uses.

Step 2: Reproduce the number
- The count comes from itam_licensing_resource_counts (servers and end user computers).
- Reproduce it with a background script. If it matches, the count is real, not a bug.

Step 3: Find what feeds it
- Group the devices that have software install records (cmdb_sam_sw_install) by CI class and discovery source.
- Check the last discovered and last scanned dates.

Root cause
A passive network discovery connector (Service Graph Connector for Armis) had loaded tens of thousands of devices: phones, IoT, OT, cameras. It also created software install records for them. SAM counted many of them as computers, and most were stale (not seen for more than 180 days).

Fix options
1. Limit which CI classes or sources create software install records.
2. Retire stale CIs and exclude non-corporate device classes.
3. Let the daily SAM licensing job recount, then check the portal again.

Script tips
- GlideAggregate cannot group dates by month. Group them in JavaScript.
- Encoded queries use stored values, not display labels.
- Print totals only. Logging every record floods the log.

Hope this helps anyone reviewing licences before renewal. Happy to share more details if needed.