ILMT works by collecting scan data from agents across your estate and rolling it into the quarterly sub-capacity report. The report only covers what the scanners can see. When a scanner loses contact with the ILMT server, or never reaches a host in the first place, that capacity falls out of the report. IBM does not treat a missing host as a host that happened to be idle. It treats it as a host without evidence, and the default for missing evidence is full-capacity charging.
What a disconnected scanner actually means.
A disconnected scanner is any case where the data path from a monitored host back to the ILMT server is broken for a period. The host may still be running the IBM software the whole time. What is missing is the proof. IBM measures continuity, so a scanner that reported cleanly for eleven months and went silent for one still leaves a one month hole, and that hole sits in whichever quarter it touches.
The scenarios that break coverage.
Disconnected scanner gaps rarely announce themselves. They show up later, in the lookback, as quarters that cannot be evidenced. The recurring causes:
- Network segmentation. A host moves behind a firewall rule or into an isolated VLAN, and the agent can no longer reach the server.
- Air-gapped or disconnected environments. Secure enclaves where the scanner cannot phone home need a deliberate disconnected scan workflow, and without it the capacity is invisible.
- Agent failure after a patch or rebuild. A host is reimaged or patched and the agent is not reinstalled, so a live workload runs uncovered.
- New hosts never enrolled. Capacity added between scans, especially fast moving virtual estates, that nobody registered with ILMT.
- Server side outages. The ILMT server itself is down or storage fills, so scans arrive but are never processed into a report.
Why a gap becomes a full-capacity bill.
Sub-capacity is a conditional entitlement. One of the conditions is that the tracking tool runs continuously. A disconnected scanner breaks continuity, and IBM is contractually entitled to charge the affected period as though every physical core on the host runs the software. The arithmetic is unforgiving. A workload using four cores of a thirty two core host is 480 PVU under sub-capacity and 3,840 PVU at full-capacity. A single uncovered quarter on a large host can carry a back-charge out of all proportion to the workload that actually ran.
Closing the gap before the audit.
The fix starts with knowing where the gaps are. That means reconciling the scanner inventory against the full host inventory, finding hosts that report intermittently or not at all, and confirming a clean report exists for every quarter in scope. Where a host was genuinely sub-capacity, corrected scans and clean supporting evidence can support reinstating the sub-capacity position rather than conceding full-capacity. The work is the same the auditor will do. Doing it first is what keeps control of the outcome.