Manual license utilization reporting

Manual license utilization reporting allows you to export, review, and send license utilization data to IBM without relying on automated reporting functionality.

Manual license utilization reporting is intended primarily for air-gapped environments or organizations that require manual review of license utilization data before submission.

Review the terms of your license agreement to confirm whether you may opt out of automated reporting and, if so, at what cadence you must otherwise report license utilization data.

Opt out

There are two ways to opt out of automated license utilization reporting:

• HCL configuration (recommended)
• Environment variable (requires restart)

Apply the same configuration or environment variable to all nodes in a Vault cluster. After leadership changes, the new leader node settings take effect.

If your HCL configuration file and environment variable differ, the environment variable setting takes precedence.

HCL configuration

Add the following to your Vault HCL configuration file. You can push the change to a currently running Vault instance by sending a SIGHUP signal to the Vault process.

reporting {
  license {
    enabled = false
  }
}

Vault logs the following message in its server logs:

[DEBUG] reporting: automated reporting is disabled; license utilization data will not be exported unless triggered manually

Environment variable

Set the following environment variable for the Vault process. You must restart the Vault process for the change to take effect.

OPTOUT_LICENSE_REPORTING=true

Vault logs the following message in its server logs:

[INFO]  core: automated reporting disabled via environment variable: env=OPTOUT_LICENSE_REPORTING
[DEBUG] reporting: automated reporting is disabled; license utilization data will not be exported unless triggered manually

How to manually send data reports

Generate a reporting payload

You must first retrieve a license utilization payload from Vault.

You can retrieve a license utilization payload by running the operator utilization CLI command or by querying the sys/utilization API endpoint.

In either case, you must authenticate to Vault and have update permission to the sys/utilization path:

path "sys/utilization" {
    capabilities = ["update"]
}

Both the CLI command and API endpoint support the following parameters:

• today_only - When set, the endpoint returns only snapshots from the last 24 hours.
• message - Optional message to include in the server logs.

In addition, the CLI command supports an -output parameter to specify where to write the license utilization bundle. By default, the CLI uses a timestamped filename, vault-utilization-[timestamp].json.

$ vault operator utilization \
    -today-only \
    -output="vault-utilization.json"
Success! License utilization reporting bundle written to: vault-utilization.json

$ curl -X PUT -H "X-Vault-Token: $VAULT_TOKEN" \
    -d '{"today_only": true}' \
    "${VAULT_ADDR}/v1/sys/utilization" \
  | jq -r '.data.utilization_bundle' \
  | base64 -d -i - -o "vault-utilization.json"

Send the reporting payload to IBM

You can send the license utilization reporting payload using a web browser or directly to the API:

$ curl -X POST -w "%{http_code}\n" \
    -d @vault-utilization.json \
    "https://reporting.hashicorp.services/v3/"
{}202

$ curl -X POST -w "%{http_code}\n" \
    -d @vault-utilization-tampered.json \
    "https://reporting.hashicorp.services/v3/"
{"message": "error processing v3 bundle"}
500