1IPMI-SEL(8)                     System Commands                    IPMI-SEL(8)
2
3
4

NAME

6       ipmi-sel - display SEL entries
7

SYNOPSIS

9       ipmi-sel [OPTION...]
10

DESCRIPTION

12       Ipmi-sel is used to view and manage System Event Log (SEL) entries. SEL
13       records store system event information and may be useful for  debugging
14       problems.   Ipmi-sel  does  not inform the user if an event is particu‐
15       larly good or bad, just that the event occurred. Users may wish to  use
16       the --output-event-state option to output the analyzed state.
17
18       Listed  below  are general IPMI options, tool specific options, trouble
19       shooting  information,  workaround  information,  examples,  and  known
20       issues.  For a general introduction to FreeIPMI please see freeipmi(7).
21       To perform some advanced SEL management, please see bmc-device(8).
22

GENERAL OPTIONS

24       The following options are general options for configuring IPMI communi‐
25       cation and executing general tool commands.
26
27       -D IPMIDRIVER, --driver-type=IPMIDRIVER
28              Specify  the  driver type to use instead of doing an auto selec‐
29              tion.  The currently available outofband  drivers  are  LAN  and
30              LAN_2_0,  which  perform IPMI 1.5 and IPMI 2.0 respectively. The
31              currently available inband  drivers  are  KCS,  SSIF,  OPENIPMI,
32              SUNBMC, and INTELDCMI.
33
34       --disable-auto-probe
35              Do not probe in-band IPMI devices for default settings.
36
37       --driver-address=DRIVER-ADDRESS
38              Specify  the  in-band  driver  address to be used instead of the
39              probed value. DRIVER-ADDRESS should be prefixed with "0x" for  a
40              hex value and '0' for an octal value.
41
42       --driver-device=DEVICE
43              Specify the in-band driver device path to be used instead of the
44              probed path.
45
46       --register-spacing=REGISTER-SPACING
47              Specify the in-band  driver  register  spacing  instead  of  the
48              probed  value. Argument is in bytes (i.e. 32bit register spacing
49              = 4)
50
51       --target-channel-number=CHANNEL-NUMBER
52              Specify the in-band driver target channel number  to  send  IPMI
53              requests to.
54
55       --target-slave-address=SLAVE-ADDRESS
56              Specify  the  in-band  driver  target  slave number to send IPMI
57              requests to.
58
59       -h      IPMIHOST1,IPMIHOST2,...,      --hostname=IPMIHOST1[:PORT],IPMI‐
60       HOST2[:PORT],...
61              Specify  the  remote host(s) to communicate with. Multiple host‐
62              names may be separated by comma or may be specified in  a  range
63              format;  see  HOSTRANGED  SUPPORT below. An optional port can be
64              specified with each host, which may be useful in port forwarding
65              or  similar situations.  If specifying an IPv6 address and port,
66              use the format [ADDRESS]:PORT.
67
68       -u USERNAME, --username=USERNAME
69              Specify the username to use when authenticating with the  remote
70              host.   If  not  specified,  a null (i.e. anonymous) username is
71              assumed. The user must have atleast USER privileges in order for
72              this tool to operate fully.
73
74       -p PASSWORD, --password=PASSWORD
75              Specify the password to use when authenticationg with the remote
76              host.  If not specified, a null  password  is  assumed.  Maximum
77              password length is 16 for IPMI 1.5 and 20 for IPMI 2.0.
78
79       -P, --password-prompt
80              Prompt  for  password  to  avoid  possibility  of  listing it in
81              process lists.
82
83       -k K_G, --k-g=K_G
84              Specify the K_g BMC key to  use  when  authenticating  with  the
85              remote  host  for  IPMI  2.0.  If  not  specified, a null key is
86              assumed. To input the key in hexadecimal form, prefix the string
87              with  '0x'.  E.g.,  the key 'abc' can be entered with the either
88              the string 'abc' or the string '0x616263'
89
90       -K, --k-g-prompt
91              Prompt for k-g to avoid possibility of  listing  it  in  process
92              lists.
93
94       --session-timeout=MILLISECONDS
95              Specify  the  session timeout in milliseconds. Defaults to 20000
96              milliseconds (20 seconds) if not specified.
97
98       --retransmission-timeout=MILLISECONDS
99              Specify  the  packet  retransmission  timeout  in  milliseconds.
100              Defaults  to  1000 milliseconds (1 second) if not specified. The
101              retransmission timeout cannot be larger than the  session  time‐
102              out.
103
104       -a AUTHENTICATION-TYPE, --authentication-type=AUTHENTICATION-TYPE
105              Specify  the  IPMI 1.5 authentication type to use. The currently
106              available authentication types are NONE,  STRAIGHT_PASSWORD_KEY,
107              MD2, and MD5. Defaults to MD5 if not specified.
108
109       -I CIPHER-SUITE-ID, --cipher-suite-id=CIPHER-SUITE-ID
110              Specify the IPMI 2.0 cipher suite ID to use. The Cipher Suite ID
111              identifies a set of authentication, integrity, and confidential‐
112              ity  algorithms to use for IPMI 2.0 communication. The authenti‐
113              cation algorithm identifies the algorithm  to  use  for  session
114              setup,  the  integrity algorithm identifies the algorithm to use
115              for session packet signatures, and the confidentiality algorithm
116              identifies the algorithm to use for payload encryption. Defaults
117              to cipher suite ID 3 if  not  specified.  The  following  cipher
118              suite ids are currently supported:
119
120              0 - Authentication Algorithm = None; Integrity Algorithm = None;
121              Confidentiality Algorithm = None
122
123              1 - Authentication Algorithm = HMAC-SHA1; Integrity Algorithm  =
124              None; Confidentiality Algorithm = None
125
126              2  - Authentication Algorithm = HMAC-SHA1; Integrity Algorithm =
127              HMAC-SHA1-96; Confidentiality Algorithm = None
128
129              3 - Authentication Algorithm = HMAC-SHA1; Integrity Algorithm  =
130              HMAC-SHA1-96; Confidentiality Algorithm = AES-CBC-128
131
132              6  -  Authentication Algorithm = HMAC-MD5; Integrity Algorithm =
133              None; Confidentiality Algorithm = None
134
135              7 - Authentication Algorithm = HMAC-MD5; Integrity  Algorithm  =
136              HMAC-MD5-128; Confidentiality Algorithm = None
137
138              8  -  Authentication Algorithm = HMAC-MD5; Integrity Algorithm =
139              HMAC-MD5-128; Confidentiality Algorithm = AES-CBC-128
140
141              11 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm  =
142              MD5-128; Confidentiality Algorithm = None
143
144              12  - Authentication Algorithm = HMAC-MD5; Integrity Algorithm =
145              MD5-128; Confidentiality Algorithm = AES-CBC-128
146
147              15 - Authentication Algorithm = HMAC-SHA256; Integrity Algorithm
148              = None; Confidentiality Algorithm = None
149
150              16 - Authentication Algorithm = HMAC-SHA256; Integrity Algorithm
151              = HMAC_SHA256_128; Confidentiality Algorithm = None
152
153              17 - Authentication Algorithm = HMAC-SHA256; Integrity Algorithm
154              = HMAC_SHA256_128; Confidentiality Algorithm = AES-CBC-128
155
156       -l PRIVILEGE-LEVEL, --privilege-level=PRIVILEGE-LEVEL
157              Specify  the privilege level to be used. The currently available
158              privilege levels are USER,  OPERATOR,  and  ADMIN.  Defaults  to
159              OPERATOR if not specified.
160
161       --config-file=FILE
162              Specify an alternate configuration file.
163
164       -W WORKAROUNDS, --workaround-flags=WORKAROUNDS
165              Specify  workarounds to vendor compliance issues. Multiple work‐
166              arounds can be specified separated by commas. A special  command
167              line flag of "none", will indicate no workarounds (may be useful
168              for overriding configured defaults). See WORKAROUNDS below for a
169              list of available workarounds.
170
171       --debug
172              Turn on debugging.
173
174       -?, --help
175              Output a help list and exit.
176
177       --usage
178              Output a usage message and exit.
179
180       -V, --version
181              Output the program version and exit.
182

IPMI-SEL OPTIONS

184       The following options are specific to ipmi-sel.
185
186       -v     Output  verbose output. This option will output event direction.
187              Event direction may be useful to differentiate severity  between
188              some  events.  For example, some motherboards may issue an event
189              both when a temperature exceeds a threshold  and  when  it  goes
190              back down below it.
191
192       -vv    Output  very  verbose output. This option will output additional
193              information than verbose output. Most  notably  it  will  output
194              additional  hex  codes  to  given  information  on ambiguous SEL
195              entries, such as OEM codes. For example, it will output  Genera‐
196              tor ID hex codes for sensors without names, event type codes for
197              OEM events, and record types for OEM records.  This  information
198              may be useful if you are writing a parser outside of ipmi-sel to
199              interpret OEM information.
200
201       -i, --info
202              Show general information about the SEL.
203
204       --display=RECORD-IDS-LIST
205              Display SEL records by record id. Accepts space or  comma  sepa‐
206              rated lists.
207
208       --exclude-display=RECORD-IDS-LIST
209              Exclude  display  of  SEL records by record id. Accepts space or
210              comma separated lists.
211
212       --display-range=START-END
213              Display SEL records from record id START to END.
214
215       --exclude-display-range=START-END
216              Exclude display of SEL records from record id START to END.
217
218       --date-range=DATE-DATE
219              Display SEL records with events occurring in the specified  date
220              range.   Dates may be specified in MM/DD/YYYY or MM-DD-YYYY for‐
221              mat. The month may be specified as a numeral or its  abbreviated
222              string name. The current local system time can be specified with
223              "now". Note that non-timestamped records will not  be  displayed
224              automatically because they do not possess a timestamp.
225
226       --exclude-date-range=DATE-DATE
227              Exclude  display  of  SEL  records  with events occurring in the
228              specified date range. Dates may be specified  in  MM/DD/YYYY  or
229              MM-DD-YYYY  format.  The  month may be specified as a numeral or
230              its abbreviated string name. The current local system  time  can
231              be  specified with "now". Note that non-timestamped records will
232              be displayed automatically because they do not possess  a  time‐
233              stamp.
234
235       -t SENSOR-TYPE-LIST, --sensor-types=SENSOR-TYPE-LIST
236              Specify  sensor types to show SEL events for. Multiple types can
237              be separated by commas or spaces. A special command line type of
238              "all",  will  indicate  all types should be shown (may be useful
239              for overriding configured defaults). Users  may  specify  sensor
240              types  by  string  (see  --list-sensor-types below) or by number
241              (decimal or hex).
242
243       -T SENSOR-TYPE-LIST, --exclude-sensor-types=SENSOR-TYPE-LIST
244              Specify sensor types to not show SEL events for. Multiple  types
245              can  be  separated  by  commas or spaces. A special command line
246              type of "none", will indicate no types should be  excluded  (may
247              be useful for overriding configured defaults). Users may specify
248              sensor types by string (see  --list-sensor-types  below)  or  by
249              number (decimal or hex).
250
251       -L, --list-sensor-types
252              List sensor types.
253
254       --tail=count
255              Display  approximately  the  last count SEL records. The display
256              count is calculated by approximating the record ids of the  last
257              SEL  records.  It's correctness depends highly on the SEL imple‐
258              mentation by the vendor.
259
260       --clear
261              Clear SEL.
262
263       --post-clear
264              Identical to --clear, except the SEL clearning will be performed
265              after SEL event records are displayed. This option is useful for
266              scripting if users intend to log SEL events to another log, then
267              immediately  clear SEL. Unlike calling --clear in another execu‐
268              tion of ipmi-sel, this  option  will  use  SEL  reservations  to
269              notify  the  user  if a SEL change has occurred while displaying
270              and clearing the SEL. This can protect users from a race,  where
271              a  new  SEL  event  is unknowingly generated before clearing the
272              SEL. Note that SEL reservations are  optionally  implemented  by
273              vendors and may not be available on all machines.
274
275       --delete=RECORD-IDS-LIST
276              Delete  records  by record id in the SEL. Accepts space or comma
277              separated lists.
278
279       --delete-range=START-END
280              Delete record ids from START to END in the SEL.
281
282       --system-event-only
283              Output  only  system  event  records  (i.e.  don't  output   OEM
284              records).
285
286       --oem-event-only
287              Output  only  OEM  event records (i.e. don't output system event
288              records).
289
290       --output-manufacturer-id
291              For OEM SEL record types, output the manufacturer ID along  with
292              event data when available.
293
294       --output-event-state
295              Output event state in output. This will add an additional output
296              reporting if an event should be viewed as NOMINAL,  WARNING,  or
297              CRITICAL.   The event state is an interpreted value based on the
298              configuration  file   /etc/freeipmi//freeipmi_interpret_sel.conf
299              and the event direction.  See freeipmi_interpret_sel.conf(5) for
300              more information.
301
302       --event-state-config-file=FILE
303              Specify an alternate  event  state  configuration  file.  Option
304              ignored if --output-event-state not specified.
305
306       --hex-dump
307              Hex-dump SEL entries.
308
309       --interpret-oem-data
310              Attempt  to interpret OEM data, such as event data, sensor read‐
311              ings, or general extra info, etc. If an  OEM  interpretation  is
312              not available, the default output will be generated. Correctness
313              of OEM interpretations cannot be  guaranteed  due  to  potential
314              changes OEM vendors may make in products, firmware, etc. See OEM
315              INTERPRETATION below for confirmed supported motherboard  inter‐
316              pretations.
317
318       --output-oem-event-strings
319              Some motherboards support an IPMI OEM extension that returns the
320              string output for a system event. Such string output may be ben‐
321              eficial  for determining the meaning behind OEM specific events.
322              This option will use the OEM event string to describe all system
323              events in the ipmi-sel output. This option differs from --inter‐
324              pret-oem-data option in that all system events will  output  the
325              vendor  supplied event string, not just events that are OEM spe‐
326              cific. The event string may be very different  from  the  normal
327              FreeIPMI  event  string  output.  If an OEM event strings is not
328              available, the default output will be output.   This  option  is
329              confirmed to work for Fujitsu iRMC S1 and iRMC S2 systems.
330
331       --entity-sensor-names
332              Output  sensor  names prefixed with their entity id and instance
333              number when appropriate. This may be necessary on  some  mother‐
334              boards  to help identify what sensors are referencing. For exam‐
335              ple, a motherboard may have multiple sensors named  'TEMP'.  The
336              entity  id  and  instance  number  may help clarify which sensor
337              refers to "Processor 1" vs. "Processor 2".
338
339       --no-sensor-type-output
340              Do not show sensor type output for each entry. On many  systems,
341              the sensor type is redundant to the name of the sensor. This can
342              especially be true if --entity-sensor-names  is  specified.   If
343              the  sensor  name  is sufficient, or if the sensor type is of no
344              interest to the user, this option can be specified  to  condense
345              output.
346
347       --comma-separated-output
348              Output fields in comma separated format.
349
350       --no-header-output
351              Do not output column headers. May be useful in scripting.
352
353       --non-abbreviated-units
354              Output  non-abbreviated  units (e.g. 'Amps' instead of 'A'). May
355              aid  in  disambiguation  of  units  (e.g.  'C'  for  Celsius  or
356              Coulombs).
357
358       --legacy-output
359              Output  in legacy format. Newer options may not be applicable to
360              legacy output.
361

SDR CACHE OPTIONS

363       This tool requires access to the sensor data repository (SDR) cache for
364       general  operation.  By default, SDR data will be downloaded and cached
365       on the local machine. The following options apply to the SDR cache.
366
367       --flush-cache
368              Flush a cached version  of  the  sensor  data  repository  (SDR)
369              cache. The SDR is typically cached for faster subsequent access.
370              However, it may need to be flushed and re-generated if  the  SDR
371              has been updated on a system.
372
373       --quiet-cache
374              Do  not output information about cache creation/deletion. May be
375              useful in scripting.
376
377       --sdr-cache-recreate
378              If the SDR cache is out of date or invalid, automatically recre‐
379              ate  the  sensor data repository (SDR) cache. This option may be
380              useful for scripting purposes.
381
382       --sdr-cache-file=FILE
383              Specify a specific sensor data repository (SDR) cache file to be
384              stored  or read from. If this option is used when multiple hosts
385              are specified, the same SDR cache file  will  be  used  for  all
386              hosts.
387
388       --sdr-cache-directory=DIRECTORY
389              Specify  an alternate directory for sensor data repository (SDR)
390              caches to be stored or read from. Defaults to the home directory
391              if not specified.
392
393       --ignore-sdr-cache
394              Ignore  SDR  cache related processing. May lead to incomplete or
395              less useful information being  output,  however  it  will  allow
396              functionality  for  systems without SDRs or when the correct SDR
397              cannot be loaded.
398

TIME OPTIONS

400       By IPMI definition, all IPMI times and timestamps are stored in  local‐
401       time. However, in many situations, the timestamps will not be stored in
402       localtime. Whether or not a  system  truly  stored  the  timestamps  in
403       localtime varies on many factors, such as the vendor, BIOS, and operat‐
404       ing system.  The following options will allow the user  to  adjust  the
405       interpretation of the stored timestamps and how they should be output.
406
407       --utc-to-localtime
408              Assume  all  times are reported in UTC time and convert the time
409              to localtime before being output.
410
411       --localtime-to-utc
412              Convert all localtime timestamps to UTC before being output.
413
414       --utc-offset=SECONDS
415              Specify a specific UTC offset in seconds to be  added  to  time‐
416              stamps.   Value can range from -86400 to 86400 seconds. Defaults
417              to 0.
418

HOSTRANGED OPTIONS

420       The following options manipulate hostranged output. See HOSTRANGED SUP‐
421       PORT below for additional information on hostranges.
422
423       -B, --buffer-output
424              Buffer  hostranged output. For each node, buffer standard output
425              until the node has completed its IPMI operation. When specifying
426              this  option, data may appear to output slower to the user since
427              the the entire IPMI operation must complete before any data  can
428              be output.  See HOSTRANGED SUPPORT below for additional informa‐
429              tion.
430
431       -C, --consolidate-output
432              Consolidate hostranged output. The complete standard output from
433              every  node  specified  will  be consolidated so that nodes with
434              identical output are not output twice. A header will list  those
435              nodes  with  the consolidated output. When this option is speci‐
436              fied, no output can be seen until the  IPMI  operations  to  all
437              nodes  has  completed.  If  the  user  breaks out of the program
438              early, all currently consolidated output  will  be  dumped.  See
439              HOSTRANGED SUPPORT below for additional information.
440
441       -F NUM, --fanout=NUM
442              Specify  multiple  host  fanout.  A "sliding window" (or fanout)
443              algorithm is used for parallel IPMI communication so that slower
444              nodes or timed out nodes will not impede parallel communication.
445              The maximum number of threads available at the same time is lim‐
446              ited by the fanout. The default is 64.
447
448       -E, --eliminate
449              Eliminate  hosts  determined  as undetected by ipmidetect.  This
450              attempts to remove the common issue of hostranged execution tim‐
451              ing  out  due  to  several nodes being removed from service in a
452              large cluster. The ipmidetectd daemon must  be  running  on  the
453              node executing the command.
454
455       --always-prefix
456              Always prefix output, even if only one host is specified or com‐
457              municating in-band. This option is primarily useful for  script‐
458              ing  purposes.  Option  will be ignored if specified with the -C
459              option.
460

HOSTRANGED SUPPORT

462       Multiple hosts can be input either as an explicit comma separated lists
463       of  hosts  or  a  range of hostnames in the general form: prefix[n-m,l-
464       k,...], where n < m and l < k, etc. The later form should not  be  con‐
465       fused  with  regular expression character classes (also denoted by []).
466       For example, foo[19] does not represent foo1 or foo9, but rather repre‐
467       sents a degenerate range: foo19.
468
469       This  range  syntax  is  meant only as a convenience on clusters with a
470       prefixNN naming convention and specification of ranges  should  not  be
471       considered  necessary -- the list foo1,foo9 could be specified as such,
472       or by the range foo[1,9].
473
474       Some examples of range usage follow:
475           foo[01-05] instead of foo01,foo02,foo03,foo04,foo05
476           foo[7,9-10] instead of foo7,foo9,foo10
477           foo[0-3] instead of foo0,foo1,foo2,foo3
478
479       As a reminder to the reader, some shells will interpret brackets ([ and
480       ])  for  pattern matching. Depending on your shell, it may be necessary
481       to enclose ranged lists within quotes.
482
483       When multiple hosts are specified by the user, a thread  will  be  exe‐
484       cuted  for each host in parallel up to the configured fanout (which can
485       be adjusted via the -F option). This will allow communication to  large
486       numbers of nodes far more quickly than if done in serial.
487
488       By  default,  standard  output  from each node specified will be output
489       with the hostname prepended to each line. Although this output is read‐
490       able  in  many  situations, it may be difficult to read in other situa‐
491       tions. For example, output from multiple nodes may be  mixed  together.
492       The -B and -C options can be used to change this default.
493
494       In-band  IPMI  Communication  will be used when the host "localhost" is
495       specified. This allows the user to add  the  localhost  into  the  hos‐
496       tranged output.
497

GENERAL TROUBLESHOOTING

499       Most often, IPMI problems are due to configuration problems.
500
501       IPMI  over  LAN  problems  involve  a  misconfiguration  of  the remote
502       machine's BMC.  Double check to make sure the following are  configured
503       properly  in  the remote machine's BMC: IP address, MAC address, subnet
504       mask, username, user enablement, user privilege, password,  LAN  privi‐
505       lege,  LAN enablement, and allowed authentication type(s). For IPMI 2.0
506       connections, double check to make sure the  cipher  suite  privilege(s)
507       and  K_g  key  are  configured properly. The ipmi-config(8) tool can be
508       used to check and/or change these configuration settings.
509
510       Inband IPMI problems are  typically  caused  by  improperly  configured
511       drivers or non-standard BMCs.
512
513       In  addition  to the troubleshooting tips below, please see WORKAROUNDS
514       below to also if there are any vendor specific bugs that have been dis‐
515       covered and worked around.
516
517       Listed  below  are  many  of the common issues for error messages.  For
518       additional support, please e-mail the <freeipmi-users@gnu.org>  mailing
519       list.
520
521       "username  invalid"  - The username entered (or a NULL username if none
522       was entered) is not available on the remote machine.  It  may  also  be
523       possible the remote BMC's username configuration is incorrect.
524
525       "password  invalid"  - The password entered (or a NULL password if none
526       was entered) is not correct. It may also be possible the  password  for
527       the user is not correctly configured on the remote BMC.
528
529       "password  verification timeout" - Password verification has timed out.
530       A "password invalid" error (described  above)  or  a  generic  "session
531       timeout" (described below) occurred.  During this point in the protocol
532       it cannot be differentiated which occurred.
533
534       "k_g invalid" - The K_g key entered (or a NULL  K_g  key  if  none  was
535       entered)  is  not  correct.  It may also be possible the K_g key is not
536       correctly configured on the remote BMC.
537
538       "privilege level insufficient" - An IPMI command requires a higher user
539       privilege  than  the one authenticated with. Please try to authenticate
540       with a higher privilege. This may require authenticating to a different
541       user which has a higher maximum privilege.
542
543       "privilege  level  cannot  be  obtained  for this user" - The privilege
544       level you are attempting to authenticate with is higher than the  maxi‐
545       mum  allowed for this user. Please try again with a lower privilege. It
546       may also be possible the maximum privilege level allowed for a user  is
547       not configured properly on the remote BMC.
548
549       "authentication  type  unavailable for attempted privilege level" - The
550       authentication type you wish to authenticate with is not available  for
551       this privilege level. Please try again with an alternate authentication
552       type or alternate privilege level. It may also be possible  the  avail‐
553       able  authentication  types you can authenticate with are not correctly
554       configured on the remote BMC.
555
556       "cipher suite id unavailable" - The cipher suite id you wish to authen‐
557       ticate  with  is not available on the remote BMC. Please try again with
558       an alternate cipher suite id. It may also  be  possible  the  available
559       cipher suite ids are not correctly configured on the remote BMC.
560
561       "ipmi  2.0  unavailable"  -  IPMI  2.0 was not discovered on the remote
562       machine. Please try to use IPMI 1.5 instead.
563
564       "connection timeout" - Initial IPMI communication failed. A  number  of
565       potential errors are possible, including an invalid hostname specified,
566       an IPMI IP address cannot be resolved,  IPMI  is  not  enabled  on  the
567       remote  server,  the network connection is bad, etc. Please verify con‐
568       figuration and connectivity.
569
570       "session timeout" - The IPMI session has timed out.  Please  reconnect.
571       If this error occurs often, you may wish to increase the retransmission
572       timeout. Some remote BMCs are considerably slower than others.
573
574       "device not found" - The specified device could not  be  found.  Please
575       check configuration or inputs and try again.
576
577       "driver  timeout"  -  Communication with the driver or device has timed
578       out. Please try again.
579
580       "message timeout" - Communication with the driver or device  has  timed
581       out. Please try again.
582
583       "BMC  busy"  - The BMC is currently busy. It may be processing informa‐
584       tion or have too many simultaneous sessions to manage. Please wait  and
585       try again.
586
587       "could  not  find inband device" - An inband device could not be found.
588       Please check configuration or specify specific device or driver on  the
589       command line.
590
591       "driver timeout" - The inband driver has timed out communicating to the
592       local BMC or service processor. The BMC or  service  processor  may  be
593       busy or (worst case) possibly non-functioning.
594
595       "internal  IPMI  error" - An IPMI error has occurred that FreeIPMI does
596       not know how  to  handle.  Please  e-mail  <freeipmi-users@gnu.org>  to
597       report the issue.
598

IPMI-SEL TROUBLESHOOTING

600       Some  timestamps  in the SEL may report a date of 1-Jan-1970, the epoch
601       for SEL timestamps. This timestamp is  not  necessarily  incorrect.  It
602       usually  indicates a hardware event that occurred before a timestamp in
603       firmware has been initialized. For example, certain hardware components
604       will have their internal clocks reset during a power cycle.
605
606       However,  if  the  internal  clock  of  the SEL appears to be regularly
607       incorrect, you may need to set the SEL time. This  can  be  done  using
608       bmc-device(8).
609
610       The following are common SEL related messages.
611
612       "sel  config  file  parse  error"  - A parse error was found in the sel
613       event interpretation configuration  file.  Please  see  freeipmi_inter‐
614       pret_sel.conf(5).
615

WORKAROUNDS

617       With  so  many different vendors implementing their own IPMI solutions,
618       different vendors may implement their IPMI protocols  incorrectly.  The
619       following describes a number of workarounds currently available to han‐
620       dle discovered compliance issues. When possible, workarounds have  been
621       implemented so they will be transparent to the user. However, some will
622       require the user to specify a workaround be used via the -W option.
623
624       The hardware listed below may only indicate the hardware that a problem
625       was  discovered  on.  Newer  versions  of hardware may fix the problems
626       indicated below. Similar machines from vendors may or may  not  exhibit
627       the  same  problems.  Different vendors may license their firmware from
628       the same IPMI firmware developer, so it may be worthwhile to try  work‐
629       arounds listed below even if your motherboard is not listed.
630
631       If  you  believe  your hardware has an additional compliance issue that
632       needs a workaround to be implemented, please contact the FreeIPMI main‐
633       tainers on <freeipmi-users@gnu.org> or <freeipmi-devel@gnu.org>.
634
635       assumeio  - This workaround flag will assume inband interfaces communi‐
636       cate with system I/O rather than being memory-mapped.  This  will  work
637       around  systems  that report invalid base addresses. Those hitting this
638       issue may see "device not supported" or "could not find inband  device"
639       errors.  Issue observed on HP ProLiant DL145 G1.
640
641       spinpoll  -  This workaround flag will inform some inband drivers (most
642       notably the KCS driver) to spin while polling rather than  putting  the
643       process to sleep. This may significantly improve the wall clock running
644       time of tools because an operating system scheduler's  granularity  may
645       be  much larger than the time it takes to perform a single IPMI message
646       transaction. However, by spinning, your system may be  performing  less
647       useful work by not contexting out the tool for a more useful task.
648
649       authcap  -  This  workaround  flag  will skip early checks for username
650       capabilities, authentication capabilities, and K_g  support  and  allow
651       IPMI  authentication  to  succeed.  It  works around multiple issues in
652       which the remote system does not properly report username capabilities,
653       authentication  capabilities,  or  K_g status. Those hitting this issue
654       may  see  "username  invalid",  "authentication  type  unavailable  for
655       attempted privilege level", or "k_g invalid" errors.  Issue observed on
656       Asus  P5M2/P5MT-R/RS162-E4/RX4,  Intel  SR1520ML/X38ML,  and  Sun  Fire
657       2200/4150/4450 with ELOM.
658
659       nochecksumcheck  - This workaround flag will tell FreeIPMI to not check
660       the checksums returned from IPMI command  responses.  It  works  around
661       systems that return invalid checksums due to implementation errors, but
662       the packet is otherwise valid. Users are cautioned on the use  of  this
663       option,  as  it  removes  validation of packet integrity in a number of
664       circumstances. However, it is unlikely to be an issue  in  most  situa‐
665       tions.  Those hitting this issue may see "connection timeout", "session
666       timeout", or "password verification timeout" errors. On IPMI  1.5  con‐
667       nections,  the  "noauthcodecheck" workaround may also needed too. Issue
668       observed on Supermicro X9SCM-iiF, Supermicro  X9DRi-F,  and  Supermicro
669       X9DRFR.
670
671       idzero  -  This  workaround  flag  will  allow  empty session IDs to be
672       accepted by the client. It works around IPMI sessions that report empty
673       session  IDs  to  the client. Those hitting this issue may see "session
674       timeout" errors. Issue observed on Tyan S2882 with M3289 BMC.
675
676       unexpectedauth - This workaround flag will  allow  unexpected  non-null
677       authcodes  to  be checked as though they were expected. It works around
678       an issue when packets contain non-null authentication  data  when  they
679       should  be  null due to disabled per-message authentication. Those hit‐
680       ting this issue may see "session timeout"  errors.  Issue  observed  on
681       Dell PowerEdge 2850,SC1425. Confirmed fixed on newer firmware.
682
683       forcepermsg  -  This workaround flag will force per-message authentica‐
684       tion to be used no matter what is advertised by the remote  system.  It
685       works  around an issue when per-message authentication is advertised as
686       disabled on the remote system, but it is actually required for the pro‐
687       tocol.  Those  hitting  this  issue  may  see "session timeout" errors.
688       Issue observed on IBM eServer 325.
689
690       endianseq - This workaround flag will flip the endian  of  the  session
691       sequence  numbers  to  allow the session to continue properly. It works
692       around IPMI 1.5 session sequence numbers that  are  the  wrong  endian.
693       Those  hitting  this  issue  may  see  "session  timeout" errors. Issue
694       observed on  some  Sun  ILOM  1.0/2.0  (depends  on  service  processor
695       endian).
696
697       noauthcodecheck  - This workaround flag will tell FreeIPMI to not check
698       the authentication codes returned from IPMI 1.5 command  responses.  It
699       works  around  systems  that return invalid authentication codes due to
700       hashing or implementation errors. Users are cautioned  on  the  use  of
701       this option, as it removes an authentication check verifying the valid‐
702       ity of a packet. However, in most organizations, this is unlikely to be
703       a  security  issue.  Those hitting this issue may see "connection time‐
704       out", "session timeout", or  "password  verification  timeout"  errors.
705       Issue  observed  on  Xyratex FB-H8-SRAY, Intel Windmill, Quanta Winter‐
706       fell, and Wiwynn Windmill.
707
708       intel20 - This workaround flag will work around several Intel IPMI  2.0
709       authentication issues. The issues covered include padding of usernames,
710       and password  truncation  if  the  authentication  algorithm  is  HMAC-
711       MD5-128. Those hitting this issue may see "username invalid", "password
712       invalid", or "k_g invalid" errors. Issue observed  on  Intel  SE7520AF2
713       with Intel Server Management Module (Professional Edition).
714
715       supermicro20 - This workaround flag will work around several Supermicro
716       IPMI 2.0  authentication  issues  on  motherboards  w/  Peppercon  IPMI
717       firmware.  The issues covered include handling invalid length authenti‐
718       cation codes. Those hitting  this  issue  may  see  "password  invalid"
719       errors.   Issue  observed on Supermicro H8QME with SIMSO daughter card.
720       Confirmed fixed on newerver firmware.
721
722       sun20 - This workaround flag will work work around several Sun IPMI 2.0
723       authentication issues. The issues covered include invalid lengthed hash
724       keys, improperly hashed keys, and invalid cipher suite  records.  Those
725       hitting  this  issue  may see "password invalid" or "bmc error" errors.
726       Issue observed on Sun Fire 4100/4200/4500 with ILOM.   This  workaround
727       automatically includes the "opensesspriv" workaround.
728
729       opensesspriv - This workaround flag will slightly alter FreeIPMI's IPMI
730       2.0 connection protocol to workaround an invalid hashing algorithm used
731       by  the remote system. The privilege level sent during the Open Session
732       stage of an IPMI 2.0 connection is used for hashing keys instead of the
733       privilege  level  sent during the RAKP1 connection stage. Those hitting
734       this issue may see "password invalid", "k_g invalid", or "bad  rmcpplus
735       status  code"  errors.   Issue observed on Sun Fire 4100/4200/4500 with
736       ILOM, Inventec 5441/Dell Xanadu II, Supermicro X8DTH, Supermicro X8DTG,
737       Intel S5500WBV/Penguin Relion 700, Intel S2600JF/Appro 512X, and Quanta
738       QSSC-S4R/Appro GB812X-CN. This workaround  is  automatically  triggered
739       with the "sun20" workaround.
740
741       integritycheckvalue  - This workaround flag will work around an invalid
742       integrity check value during an IPMI  2.0  session  establishment  when
743       using  Cipher Suite ID 0. The integrity check value should be 0 length,
744       however the remote motherboard responds with a non-empty  field.  Those
745       hitting  this  issue  may  see  "k_g invalid" errors. Issue observed on
746       Supermicro X8DTG, Supermicro X8DTU, and Intel  S5500WBV/Penguin  Relion
747       700, and Intel S2600JF/Appro 512X.
748
749       assumemaxsdrrecordcount  -  This  workaround will inform SDR reading to
750       stop reading after a known maximum numer of SDR records have been read.
751       This  will  work  around  systems that have mis-implemented SDR reading
752       functions that. Those hitting this issue  may  see  "SDR  record  count
753       invalid" errors. Issue observed on unspecified Inspur motherboard.
754
755       assumesystemevent  -  This  workaround  option  will assume invalid SEL
756       record types are system event records. Records may  be  formatted  cor‐
757       rectly  but  report  invalid record types. Those hitting this issue may
758       see "Unknown SEL Record Type" errors. Output may be unknown,  pray  for
759       the best. This option is confirmed to work around compliances issues on
760       HP DL 380 G5 motherboards.
761
762       No IPMI 1.5 Support - Some motherboards that support IPMI 2.0 have been
763       found  to  not support IPMI 1.5. Those hitting this issue may see "ipmi
764       2.0 unavailable" or "connection timeout"  errors.  This  issue  can  be
765       worked  around  by  using  IPMI  2.0  instead of IPMI 1.5 by specifying
766       --driver-type=LAN_2_0. Issue observed on HP Proliant DL 145.
767

OEM INTERPRETATION

769       The following motherboards are confirmed to have atleast  some  support
770       by  the --interpret-oem-data option. While highly probable the OEM data
771       interpretations would work across other motherboards by the same  manu‐
772       facturer,  there  are no guarantees. Some of the motherboards below may
773       be rebranded by vendors/distributors.
774
775       Dell Poweredge 2900, Dell Poweredge 2950,  Dell  Poweredge  R610,  Dell
776       Poweredge   R710,  Fujitsu  iRMC  S1  and  iRMC  S2  systems,  Gigabyte
777       MD90-FS0-ZB,  Intel  S5500WB/Penguin  Computing   Relion   700,   Intel
778       S2600JF/Appro  512X,  Intel  S5000PAL,  Intel  Windmill, Intel S2600KP,
779       Intel S2600KPR, Intel  S2600WT2,  Intel  S2600WTT,  Inventec  5441/Dell
780       Xanadu  II,  Inventec  5442/Dell  Xanadu III, Quanta S99Q/Dell FS12-TY,
781       Quanta QSSC-S4R/Appro GB812X-CN, Quanta Winterfell, Sun X4140  Supermi‐
782       cro  X7DBR-3, Supermicro X7DB8, Supermicro X8DTN, Supermicro X7SBI-LN4,
783       Supermicro  X8DTH,  Supermicro  X8DTG,  Supermicro  X8DTU,   Supermicro
784       X8DT3-LN4F, Supermicro X8DTU-6+, Supermicro X8DTL, Supermicro X8DTL-3F,
785       Supermicro X8SIL-F,  Supermicro  X9SCL,  Supermicro  X9SCM,  Supermicro
786       X8DTN+-F,  Supermicro  X8SIE, Supermicro X9SCA-F-O, Supermicro H8DGU-F,
787       Supermicro  X9DRi-F,  Supermicro  X9DRI-LN4F+,  Supermicro   X9SPU-F-O,
788       Supermicro X9SCM-iiF, Wiwynn Windmill, Wistron/Dell Poweredge C6220.
789

EXAMPLES

791       # ipmi-sel
792
793       Show all SEL records on the local machine.
794
795       # ipmi-sel -h ahost -u myusername -p mypassword
796
797       Show all SEL records of a remote machine using IPMI over LAN.
798
799       # ipmi-sel -h mycluster[0-127] -u myusername -p mypassword
800
801       Show all SEL records across a cluster using IPMI over LAN.
802
803       # ipmi-sel --delete=44,82
804
805       Delete SEL records 44 and 82 on the local machine.
806
807       # ipmi-sel --delete-all
808
809       Delete all SEL entries on the local machine.
810
811       # ipmi-sel --delete-range=12-42
812
813       Delete SEL entries in the range 12 to 42 on the local machine.
814

DIAGNOSTICS

816       Upon  successful  execution, exit status is 0. On error, exit status is
817       1.
818
819       If multiple hosts are specified for communication, the exit status is 0
820       if  and  only  if  all targets successfully execute. Otherwise the exit
821       status is 1.
822

KNOWN ISSUES

824       On older operating systems, if you input your username,  password,  and
825       other  potentially  security  relevant information on the command line,
826       this information may be discovered by other users when using tools like
827       the  ps(1) command or looking in the /proc file system. It is generally
828       more secure to input password information with options like the  -P  or
829       -K  options.  Configuring security relevant information in the FreeIPMI
830       configuration file would also be an appropriate way to hide this infor‐
831       mation.
832
833       In  order  to  prevent  brute force attacks, some BMCs will temporarily
834       "lock up" after a number of remote authentication errors. You may  need
835       to  wait awhile in order to this temporary "lock up" to pass before you
836       may authenticate again.
837

REPORTING BUGS

839       Report bugs to <freeipmi-users@gnu.org> or <freeipmi-devel@gnu.org>.
840
842       Copyright © 2003-2015 FreeIPMI Core Team.
843
844       This program is free software; you can redistribute it and/or modify it
845       under  the  terms of the GNU General Public License as published by the
846       Free Software Foundation; either version 3 of the License, or (at  your
847       option) any later version.
848

SEE ALSO

850       freeipmi(7),      bmc-device(8),      ipmiseld(8),      ipmi-config(8),
851       freeipmi_interpret_sel.conf(5)
852
853       http://www.gnu.org/software/freeipmi/
854
855
856
857ipmi-sel 1.6.1                    2018-02-02                       IPMI-SEL(8)
Impressum