Intel® Business Client Software Development
Support for Intel® vPro™ software development and technologies associated with Intel vPro platforms.

Tracking hardware changes

valantinaa
Beginner
781 Views
Hi everyone,
By which way AMT will help me in tracking the hardware changes in managed system ??
One way which i found is via WS-Eventing feature ( but finally not helpful :( !!! ), as alerts are generated for hardware changes also ( like "Memory DIMM %1s Added on Memory Subsystem %2s","Device added" etc..)as specified in WSEventAndPETTableReplacement.xls sheet provided in SDK.
I am able to subscribe succesfully to AMT to deliver 'All Events' ( subscribed for CIM_FilterCollection.InstanceID= "Intel AMT:All") .
But alerts are not received when any hardware changes is undergone in system.
Steps which i followed to receive the event for adding new DDR RAM ( PLAT0128 :Memory DIMM %1s Added on Memory Subsystem %2s )
1. Powered off the host system whereas AMT is powered on.
2. Inserted new RAM in available slots.
3. Powered on host system.
One thing noted is , am able to receive alerts for events like "LAN Connected", "Password attack" etc.. !!!
---------
Can any one suggest what i am missing above to receive alert for hardware changes ?
Is there any other way which will help me to do keep track of hrdware canges in managed system ?
Thanks
Valantina
0 Kudos
1 Solution
Gael_H_Intel
Moderator
781 Views
Only those events documented in the AMT documentation will be captured by AMT. You are right about tracking hardware changes - you would have to capture the "current" state of your hardware periodically and then compare to make sure that there weren't any changes. The kind of things AMT is used for out-of-band (or when the system is off) would be "reading" what you may have stored in the 3rd Party Data Store (you could store your HW state there, for example - but again, it may not be current) and you can power up your system and you can have SOL/IDE-R sessions, for example. But AMT is not running, polling all the sensors when the sytsem is not powered on, and does not keep a record of the differences in hardware - you would have to add that capability to your application as you noted in your last response.

AMT does not know if/when the memory was physically removed, or if the chassis was tampered with - it simply reports the current hardware inventory.

View solution in original post

0 Kudos
10 Replies
RBens2
Valued Contributor I
781 Views
Hi Valantina,

As a HW engineer, I can tell you that you should completly unplug and power off a system before you change out the memory. I also think that this may be the source of your issue about AMT not reporting the change in memory.

Regards,
Roger
0 Kudos
valantinaa
Beginner
781 Views
Thanks Roger.
I inserted RAM after completely powering off the system and then powered on the system.
CIM_PhysicalMemory class instances reflect the newly added RAM.
But still didn't get any alerts !!!
Regards
Valantina
0 Kudos
Jeffrey_R_Intel
Employee
781 Views
Valantina,
By completely powering off, did you actually unplug the power cord?

Jeff
0 Kudos
valantinaa
Beginner
778 Views
Jeffrey,
Yes, I unplugged the power cord also.


Thanks
Valantina
0 Kudos
Jeffrey_R_Intel
Employee
778 Views
Valantina,
I just wanted to make sure that we all were on the same page about powering down. We'll keep working on trying to figure out your RAM situation.

Jeff
0 Kudos
valantinaa
Beginner
778 Views
Thanks Jeffrey!

i was just looking into Event Manager feature in Intel AMT SDK 6.0 .
oops!!! i could see the following under Event Manger.
"AMT Generated Events:
This section describes the Platform Event Traps which can be generated by an Intel AMT device.
For more information, see the following:
Link Up Event
Watchdog Events
Password Attack Event
Circuit Breaker Event
Agent Presence Event
Firmware Update Event
Network Adapter State Tampered
Bringup Events
Circuit Breaker Heuristics Notification
User Notification Alert
AMT Notification Alert
Auditor Notification Alert
Host Wake Up Notification Alert "
So, AMT generates only these PET traps. Thats'y i am able to receive alerts forLink Up Event &Password Attack Event and not for anyhardware insert/removed ..


BUT WS-Eventing Feature of AMT SDK shows this :

"WS-Eventing Event Groups

An event can belong to one of the following groups:

Platform events Events defined by DSP 8007.

Proprietary events Defined specifically for Intel AMT

The WSEventAndPetTableReplacement.xls file contains information about each WS-Eventing event and its PET equivalent (as shown in the following example of the PET fields)."

Above statement represents that WS-Events corresponding to all PET events will be generated. Moreover, WSEventAndPetTableReplacement.xls sheet contains all the PET Events ( including hardware insertion or removal events )..

-----------------------------------------

i think , some contradictory info is presented in SDK.

My doubt is, Will AMT generate only few PET events as listed under "Event Manager"ORALL PET(correspondingws-events) events as represented under "WS-Eventing Feature" ??

But, in practical , it generates only the events as listed under"Event Manager".

If that is the case, how AMT can help in tracking the hardware changes ?

Should the end appln enumeratethe hardware detailseverytime& cross verify with old data (stored somewhere ) and list the hardware changes ??
Any other way to track hardware??


Thanks
Valantina
0 Kudos
Gael_H_Intel
Moderator
782 Views
Only those events documented in the AMT documentation will be captured by AMT. You are right about tracking hardware changes - you would have to capture the "current" state of your hardware periodically and then compare to make sure that there weren't any changes. The kind of things AMT is used for out-of-band (or when the system is off) would be "reading" what you may have stored in the 3rd Party Data Store (you could store your HW state there, for example - but again, it may not be current) and you can power up your system and you can have SOL/IDE-R sessions, for example. But AMT is not running, polling all the sensors when the sytsem is not powered on, and does not keep a record of the differences in hardware - you would have to add that capability to your application as you noted in your last response.

AMT does not know if/when the memory was physically removed, or if the chassis was tampered with - it simply reports the current hardware inventory.
0 Kudos
valantinaa
Beginner
778 Views
Thanks Gael for the detailed explanation and confirming that " AMT simplyreports the current hardwrae inventory"


actually, iwas confused after reading belowlinks.

1. http://software.intel.com/en-us/articles/intel-active-management-technology-amt-in-the-small-business/

some content fromthis link :

Event log and alerts. Management software can read a log of recent hardware events that occurred including failures, reboots, case intrusion, and more. Management software can also subscribe to be notified as soon as an event occurs.

2. ftp://download.intel.com/intelpress/articles/Solving_End_User_Problems_with_Intel_AMT.pdf

some content from this pdf:

Intel AMT also supports the case intrusion switch and can send an alert to the administrator each time a computer case is open. Even if the computer is not connected at the time of the theft, the next time power and network is connected back, the computer will send the case intrusion alert to the administrator console.


Thanks Again !!!
0 Kudos
valantinaa
Beginner
778 Views
One suggestion !!!

Intel AMT SDKcan edit 'WSEventAndPetTableReplacement.xls' spreadsheet to contain only the list of events genarated by AMT ( as speciifed under 'Event Manger->AMT generated Events' section)and remove all other events.
0 Kudos
Gael_H_Intel
Moderator
778 Views
Hi - there is some sensor events (in ASF format) that are received by Intel AMT. Temperature, Fan, Voltage, and Case Intrusion.
0 Kudos
Reply