[nn2]

I considered splunk at some point until I read the EULA review of theirs at http://blog.hacker.dk/

" Upon at least ten (10) days prior written notice, Splunk may audit your use” …. ” Any such audit will be conducted during regular business hours at your facilities“ … “You will provide Splunk with access to the relevant records and facilities“ "

More or less they screw their customers.

[wpietri]

Why is that them screwing their customers? They sell licenses. Customers agree to use only what they're paying for. This language gives them the right to check and see how many licenses the customers use just to make sure everything's square. Seems fair to me.

The only clause I see worth objecting to is the bit that forbids publishing benchmarks or reviews. That part's BS, but I imagine that it's BS that they would drop rather than lose a sale.

[davidu]

This is entirely par for the course, and quite reasonable if you understand how it happens in practice and why it exists.

There are Splunk customers who do not allow outbound connections to the Internet and so Splunk can't use automated means of auditing license compliance. So they reserve the right to audit you on site. So if you're the CIA and you are paying for 1 petabyte and you are using 2, they want to know and charge you appropriately.

As a matter of good corporate governance, they are actually doing you a favor and preventing you from being a thief. :-)

[nn2]

Are you serious? I would never give some random supplier unlimited access to my server and internal network. Such a requirement is an absolute show-stopper.

[davidu]

Fortunately, you are not like other people.

Fortunately, customers of Splunk don't view them as a random supplier.

[josephcooney]

I thought the server tracked the number of infractions, and fell back to a reduced feature set when you went over the limit a certain # of times.

[MichaelGG]

Is that really screwing their customers? They license by GB/day usage. As expensive as Splunk is, an audit if they think you're really underreporting usage doesn't seem too far fetched.

[Karunamon]

There's a free version of Splunk that does an internal count (something like 100mb/day) for demo purposes. If one is savvy enough to override that, then I'd also assume one is savvy enough to fake the records when the license police come calling.

I can't be the only one that finds it very disquieting that you have to give a company access to your internal network so they can perform antipiracy checks.