Common WebSphere audit findings and how to challenge them.

Why WebSphere draws scrutiny

WebSphere Application Server is licensed on processor value units, the core-based metric where PVU per core, roughly 70 for a typical Intel core, is multiplied by the cores allocated to the software. That ties the cost directly to hardware capacity, which means a virtualized WebSphere estate without clean sub-capacity evidence can be charged against the whole physical host rather than the cores it actually uses. The gap between those two numbers is large, which is exactly why WebSphere is a favored target. The example IBM itself uses is stark: WebSphere on 4 of 32 host cores is 480 PVU under sub-capacity against 3,840 PVU at full capacity.

The findings we see again and again

• Full capacity defaulted on a virtual estate. ILMT was missing, broken, or reporting late, so IBM counted every physical core. This is the single largest WebSphere finding and the most reversible one, because corrected sub-capacity evidence drops the count to the virtual cores actually running the software.
• Edition mismatch. A deployment running Network Deployment capability counted, or charged, against a different edition than entitled, or the reverse. The fix is proving what capability was actually configured and used.
• Wrong PVU per core. The PVU rate applied does not match the actual processor. The correct rate for the real chip can change the count materially across every core.
• Bundled rights counted as standalone. A WebSphere entitlement that arrived bundled inside another product or a Cloud Pak counted as a separate license. Proving the bundle scope removes the double count.
• Test and idle environments swept in. Test, development or idle instances counted as production deployments without checking their actual licensing status.

How each one is challenged

The pattern is the same across all of them: the finding rests on an assumption, and proving the assumption wrong reverses every instance of it at once. A full-capacity default falls to corrected ILMT evidence. An edition or PVU error falls to documentation of what was actually configured and which processor it ran on. A bundled-rights miscount falls to the entitlement records that show the coverage. None of this is conceded line by line; it is the methodology behind the count that gets challenged, which is where the largest reductions come from. On one manufacturing estate running WebSphere and Db2, rebuilding the position from clean ILMT evidence and the correct per core rates reduced the claim by 71 percent.