Tracking hardware changes

[valantinaa]

Hi everyone,

By which way AMT will help me in tracking the hardware changes in managed system ??

One way which i found is via WS-Eventing feature ( but finally not helpful :( !!! ), as alerts are generated for hardware changes also ( like "Memory DIMM %1s Added on Memory Subsystem %2s","Device added" etc..)as specified in WSEventAndPETTableReplacement.xls sheet provided in SDK.

I am able to subscribe succesfully to AMT to deliver 'All Events' ( subscribed for CIM_FilterCollection.InstanceID= "Intel AMT:All") .

But alerts are not received when any hardware changes is undergone in system.

Steps which i followed to receive the event for adding new DDR RAM ( PLAT0128 :Memory DIMM %1s Added on Memory Subsystem %2s )

1. Powered off the host system whereas AMT is powered on.

2. Inserted new RAM in available slots.

3. Powered on host system.

One thing noted is , am able to receive alerts for events like "LAN Connected", "Password attack" etc.. !!!

---------

Can any one suggest what i am missing above to receive alert for hardware changes ?

Is there any other way which will help me to do keep track of hrdware canges in managed system ?

Thanks

Valantina

[RBens2]

Hi Valantina,

As a HW engineer, I can tell you that you should completly unplug and power off a system before you change out the memory. I also think that this may be the source of your issue about AMT not reporting the change in memory.

Regards,
Roger

[valantinaa]

Thanks Roger.

I inserted RAM after completely powering off the system and then powered on the system.

CIM_PhysicalMemory class instances reflect the newly added RAM.

But still didn't get any alerts !!!

Regards

Valantina

[Jeffrey_R_Intel]

Valantina,
By completely powering off, did you actually unplug the power cord?

Jeff

[valantinaa]

Jeffrey,

Yes, I unplugged the power cord also.

Thanks

Valantina

[Jeffrey_R_Intel]

Valantina,
I just wanted to make sure that we all were on the same page about powering down. We'll keep working on trying to figure out your RAM situation.

Jeff

[valantinaa]

Thanks Jeffrey!

i was just looking into Event Manager feature in Intel AMT SDK 6.0 .

oops!!! i could see the following under Event Manger.

"AMT Generated Events:

This section describes the Platform Event Traps which can be generated by an Intel AMT device.

For more information, see the following:

Link Up Event

Watchdog Events

Password Attack Event

Circuit Breaker Event

Agent Presence Event

Firmware Update Event

Network Adapter State Tampered

Bringup Events

Circuit Breaker Heuristics Notification

User Notification Alert

AMT Notification Alert

Auditor Notification Alert

Host Wake Up Notification Alert "

So, AMT generates only these PET traps. Thats'y i am able to receive alerts forLink Up Event &Password Attack Event and not for anyhardware insert/removed ..

BUT WS-Eventing Feature of AMT SDK shows this :

"WS-Eventing Event Groups

An event can belong to one of the following groups:

Platform events Events defined by DSP 8007.

Proprietary events Defined specifically for Intel AMT

The WSEventAndPetTableReplacement.xls file contains information about each WS-Eventing event and its PET equivalent (as shown in the following example of the PET fields)."

Above statement represents that WS-Events corresponding to all PET events will be generated. Moreover, WSEventAndPetTableReplacement.xls sheet contains all the PET Events ( including hardware insertion or removal events )..

-----------------------------------------

i think , some contradictory info is presented in SDK.

My doubt is, Will AMT generate only few PET events as listed under "Event Manager"ORALL PET(correspondingws-events) events as represented under "WS-Eventing Feature" ??

But, in practical , it generates only the events as listed under"Event Manager".

If that is the case, how AMT can help in tracking the hardware changes ?

Should the end appln enumeratethe hardware detailseverytime& cross verify with old data (stored somewhere ) and list the hardware changes ??

Any other way to track hardware??

Thanks

Valantina

[Gael_H_Intel · Accepted solution]

Only those events documented in the AMT documentation will be captured by AMT. You are right about tracking hardware changes - you would have to capture the "current" state of your hardware periodically and then compare to make sure that there weren't any changes. The kind of things AMT is used for out-of-band (or when the system is off) would be "reading" what you may have stored in the 3rd Party Data Store (you could store your HW state there, for example - but again, it may not be current) and you can power up your system and you can have SOL/IDE-R sessions, for example. But AMT is not running, polling all the sensors when the sytsem is not powered on, and does not keep a record of the differences in hardware - you would have to add that capability to your application as you noted in your last response.

AMT does not know if/when the memory was physically removed, or if the chassis was tampered with - it simply reports the current hardware inventory.

[valantinaa]

Thanks Gael for the detailed explanation and confirming that " AMT simplyreports the current hardwrae inventory"


actually, iwas confused after reading belowlinks.

1. http://software.intel.com/en-us/articles/intel-active-management-technology-amt-in-the-small-business/

some content fromthis link :

Event log and alerts. Management software can read a log of recent hardware events that occurred including failures, reboots, case intrusion, and more. Management software can also subscribe to be notified as soon as an event occurs.

2. ftp://download.intel.com/intelpress/articles/Solving_End_User_Problems_with_Intel_AMT.pdf

some content from this pdf:

Intel AMT also supports the case intrusion switch and can send an alert to the administrator each time a computer case is open. Even if the computer is not connected at the time of the theft, the next time power and network is connected back, the computer will send the case intrusion alert to the administrator console.

Thanks Again !!!

[valantinaa]

One suggestion !!!

Intel AMT SDKcan edit 'WSEventAndPetTableReplacement.xls' spreadsheet to contain only the list of events genarated by AMT ( as speciifed under 'Event Manger->AMT generated Events' section)and remove all other events.

[Gael_H_Intel]

Hi - there is some sensor events (in ASF format) that are received by Intel AMT. Temperature, Fan, Voltage, and Case Intrusion.