Shadow denials

To review license capping events from shadow license policies, open the Shadow denials report. It covers all license capping events where application usage was restricted based on defined shadow license policies. It tracks each instance of capping with user, system, and application-level details, so you can monitor and validate license enforcement behavior.

In OpenLM Platform this report is the Shadow Denials sheet of the System Monitoring dashboard. To open it, open Reporting Dashboard, then select System Monitoring, then Shadow Denials.

The policies that produce these events are configured in Shadow Licenses. Process Manager embeds this sheet as the Shadow Denials tab of its own Dashboard page.

The following screenshot shows the Shadow Denials sheet with its totals, charts, and event-level table:

The Shadow Denials sheet shows capping events, the denial rate, and event-level detail.

Key performance indicators

The sheet reports the following key performance indicators (KPIs):

• Total Capping Events: Total number of shadow denial events recorded.
• Total Successful Sessions: Total number of sessions that were not denied.
• Denial Rate (%): The percentage of checkout attempts that were capped: capping events divided by total checkout attempts, multiplied by 100. Total checkout attempts are successful sessions plus denials.

Visualizations

The report has the following visualizations:

• Top Impact Analysis: Use it to see which software or providers are most affected by license restrictions and might need optimization or policy adjustments. It shows the top impacted vendors and applications based on the number of capping events.
• Capping Distribution Charts: Use them to see where enforcement is most frequently applied. They show how capping events are distributed across different consumption policy types, such as Process, Workstation, and User at Workstation.
• Time-Series Analysis: Use it to detect spikes, recurring patterns, or anomalies in license enforcement behavior across selected periods. It shows the trend of capping events over time.
• Denial Rate per User Chart: Use it to find the users most impacted by license capping, which helps with troubleshooting access issues and improving user experience. It shows the percentage of denied sessions for each user.
• User & Workstation Charts: Use them to pinpoint specific users or machines that frequently encounter license restrictions. They compare capping events across users and workstations.
• Detailed Capping Table: Use this table for deep analysis, auditing, and validation of individual capping events. It shows event-level data including user, workstation, application, vendor, policy type, and denial status. Values displayed:
  • Username: The user account for which the license capping was enforced.
  • Workstation: The machine or host from which the application was accessed.
  • IP Address: The IP address of the workstation at the time of the capping event.
  • Capping Timestamp: The date and time when the capping action occurred.
  • Application Name: The application that triggered the capping event.
  • Vendor Name: The software vendor associated with the application.
  • Tracking Type: The method used to detect usage (Process, File, or Directory).
  • Consumption Policy Type: The level at which the cap was applied (Process, Workstation, or User at Workstation).
  • Shadow License Policy: The policy or rule responsible for enforcing the cap.
  • Denial Status: Whether the session was denied due to capping.
  • Limit: The configured threshold for license usage under the applied policy.

To narrow the report, use these filters:

• Date: Select a specific time range to analyze capping events.
• User: Select specific users to track individual capping behavior.
• Workstation: Select any workstation.
• Application Name: Select any application name.
• Vendor: Select any vendor.
• Tracking Type: Filter by usage detection method (Process, File, Directory).
• Consumption Policy Type: Filter by how the capping policy is applied.
• Denial Status: Filter to view true and false denials.

Interpreting this report

Use these points to read the report:

• A shadow denial is OpenLM Platform enforcing your policy, not a license server refusing a license. The Denial Rate is capping events against total checkout attempts, so it measures how often your own limits apply. A rising rate means demand is pressing against a configured cap, not exhaustion of a vendor pool.
• Denial Rate at 0% with a high session count means the policies are not limiting current demand. This is headroom, not malfunction. The default 14-day window often shows exactly this, and the history appears when you widen the Date filter.
• Capping distribution by Consumption Policy Type shows where enforcement applies (per process, per workstation, or per user at workstation). If one policy type produces nearly all events, that is the limit to revisit first.
• The per-user denial-rate chart separates broad pressure (many users capped occasionally) from a few users hitting limits constantly. The second pattern is a policy-fit conversation with those users, not a capacity problem.

Note

Capping events accumulate slowly. Over the default Last 14 days this report often shows zero capping events against a high count of successful sessions. Widen the Date filter to see the history.