Deciphering Event Log messages

[adrianfreemantle]

Hi,

Im trying to retrieve the event logs from an AMT system using the AMT DTK and then display the logs in a meaningful manner to the end user, however this appears to be more complex than it seems.

When you open the AMT web interface and select the event log view, the event logs are displayed with an event number, time, source and, most importantly, a description.

However with the AMT DTK I cant seem to be able to retrieve this description.

As an example, on my test system, event 1s source is the BIOS and the description is Starting operating system boot process, but when I run the amt DTKs Amt Commander the display shows the source is the BIOS, but the best description it can give me is that the value is a System firmware progress.

This is the problem I run into when using the DTK library, there seems to be no way to access the description that was displayed in the web interface. Is there a way to map one of the return codes to a meaningful string and if so where do I obtain this information?

[Ylian_S_Intel]

You raise a great question,

The Intel AMT DTK does not display the log like the web page does. At first, I just displayed everything that Intel AMT would give me, but I ran into a interesting question... why is the web page displaying so much better messages and why doesnt Intel AMT give me a really nice message like on the web page.

With the help of friends, we figured out that the "event data" field contains the extra data needed to convert the event into nice looking text. I have not done the conversion yet, but I will have to sometime. Apparently, there is a conversion in some IPMI document that takes the event data number and turned it into nice text.

I am sick today and staying home, but once I am back at the office, I will dig up the specific info.

Ylian (Intel AMT Blog)

[Gael_H_Intel]

You can get the IPMI Specifications at the following link: (Intelligent Platform Management Interface)

http://www.intel.com/design/servers/ipmi/spec.htm

Gael

[adrianfreemantle]

I went through the IPMI document, its quite large with much information but i eventually found what I was looking for. For anyone else looking for this information it can be found in section 4.2 Sensor and Event Code Tables. It seems as though Intel AMT only uses the "system firmware progress" sensor type as I'm unable to generate any other type of message. If anyone else has expereience to the contrary please let me know.

Anyone using the DTK who wishes to get a more detailed error message such as shown in theweb interfacecan achieve this by modifying the AmtEventManager.cs file as shown below. Hope this helps anyone with the same problem as me :)

=======================================================

 public class AmtEventData
 {
 private static string[] SystemFirmwareError =
 {
 "Unspecified.",
 "No system memory is physically installed in the system.",
 "No usable system memory, all installed memory has experienced an unrecoverable failure.",
 "Unrecoverable hard-disk/ATAPI/IDE device failure.",
 "Unrecoverable system-board failure.",
 "Unrecoverable diskette subsystem failure.",
 "Unrecoverable hard-disk controller failure.",
 "Unrecoverable PS/2 or USB keyboard failure.",
 "Removable boot media not found",
 "Unrecoverable video controller failure",
 "No video device detected",
 "Firmware (BIOS) ROM corruption detected",
 "CPU voltage mismatch (processors that share same supply have mismatched voltage requirements)",
 "CPU speed matching failure"
 };
 private static string[] m_SystemFirmwareProgress = 
 {
 "Unspecified.",
 "Memory initialization.",
 "Hard-disk initialization",
 "Secondary processor(s) initialization",
 "User authentication",
 "User-initiated system setup",
 "USB resource configuration",

 "PCI resource configuration",
 "Option ROM initialization",
 "Video initialization",
 "Cache initialization",
 "SM Bus initialization",
 "Keyboard controller initialization",
 "Embedded controller/management controller initialization",
 "Docking station attachment",
 "Enabling docking station",
 "Docking station ejection",
 "Disabling docking station",
 "Calling operating system wake-up vector",
 "Starting operating system boot process",
 "Baseboard or motherboard initialization",
 "reserved",
 "Floppy initialization",
 "Keyboard test",
 "Pointing device test",
 "Primary processor initialization"
 };

 public static string GetEventDetailStr(byte eventSensorType, byte eventOffset, byte[] eventDataField)
 {
 if (15 != eventSensorType) return "Unknown Event Type";
 
 try
 {
 if (0 == eventOffset) return SystemFirmwareError[eventDataField[1]];
 else return m_SystemFirmwareProgress[eventDataField[1]];
 }
 catch (IndexOutOfRangeException)
 {
 return "Unknown Event Type";
 }
 }
===========================================================

 public class AmtEvent
 {
 private EventLogRecordType e
vt;

 public string EventDetailStr{ get { return AmtEventData.GetEventDetailStr(evt.EventSensorType, evt.EventOffset, evt.EventData); } }

===========================================================

[Ylian_S_Intel]

Excellent work AdrianFreemantle,

I am glad you are dived into my code like that, I bet there are many other things you would improve :) I am so focused on new features. By the way, if you end up building a nice application as a result, feel free to post it on the forum, commertial or not.I would really like to see what people can do with Intel AMT.

Thanks,
Ylian (Intel AMT Blog)