Tracking hardware changes

Tracking hardware changes

Imagen de valantinaa
valantinaa
Jue, 11/11/2010 - 06:37
Hi everyone, By which way AMT will help me in tracking the hardware changes in managed system ?? One way which i found is via WS-Eventing feature ( but finally not helpful :( !!! ), as alerts are generated for hardware changes also ( like "Memory DIMM %1s Added on Memory Subsystem %2s","Device added" etc..)as specified in WSEventAndPETTableReplacement.xls sheet provided in SDK. I am able to subscribe succesfully to AMT to deliver 'All Events' ( subscribed for CIM_FilterCollection.InstanceID= "Intel AMT:All") . But alerts are not received when any hardware changes is undergone in system. Steps which i followed to receive the event for adding new DDR RAM ( PLAT0128 :Memory DIMM %1s Added on Memory Subsystem %2s ) 1. Powered off the host system whereas AMT is powered on. 2. Inserted new RAM in available slots. 3. Powered on host system. One thing noted is , am able to receive alerts for events like "LAN Connected", "Password attack" etc.. !!! --------- Can any one suggest what i am missing above to receive alert for hardware changes ? Is there any other way which will help me to do keep track of hrdware canges in managed system ? Thanks Valantina
RSS Superior
publicaciones de 11 / 0 nuevos
Último envío
Para obtener más información sobre las optimizaciones del compilador, consulte el aviso sobre la optimización.
Imagen de rogerb
rogerb
Jue, 11/11/2010 - 06:45

Hi Valantina,

As a HW engineer, I can tell you that you should completly unplug and power off a system before you change out the memory. I also think that this may be the source of your issue about AMT not reporting the change in memory.

Regards,
Roger

Superior
Imagen de valantinaa
valantinaa
Vie, 12/11/2010 - 04:19

Thanks Roger. I inserted RAM after completely powering off the system and then powered on the system. CIM_PhysicalMemory class instances reflect the newly added RAM. But still didn't get any alerts !!! Regards Valantina

Superior
Imagen de Jeffrey Rott (Intel)
Jeffrey Rott (Intel)
Vie, 12/11/2010 - 09:15

Valantina,
By completely powering off, did you actually unplug the power cord?

Jeff

Superior
Imagen de valantinaa
valantinaa
Dom, 14/11/2010 - 22:55
Jeffrey,

Yes, I unplugged the power cord also.

Thanks Valantina

Superior
Imagen de Jeffrey Rott (Intel)
Jeffrey Rott (Intel)
Dom, 14/11/2010 - 23:12

Valantina,
I just wanted to make sure that we all were on the same page about powering down. We'll keep working on trying to figure out your RAM situation.

Jeff

Superior
Imagen de valantinaa
valantinaa
Lun, 15/11/2010 - 03:24

Thanks Jeffrey!
i was just looking into Event Manager feature in Intel AMT SDK 6.0 . oops!!! i could see the following under Event Manger. "AMT Generated Events:
This section describes the Platform Event Traps which can be generated by an Intel AMT device. For more information, see the following: Link Up Event Watchdog Events Password Attack Event Circuit Breaker Event Agent Presence Event Firmware Update Event Network Adapter State Tampered Bringup Events Circuit Breaker Heuristics Notification User Notification Alert AMT Notification Alert Auditor Notification Alert Host Wake Up Notification Alert " So, AMT generates only these PET traps. Thats'y i am able to receive alerts forLink Up Event &Password Attack Event and not for anyhardware insert/removed ..

BUT WS-Eventing Feature of AMT SDK shows this :
"WS-Eventing Event Groups

An event can belong to one of the following groups:

Platform events Events defined
by DSP
8007.

Proprietary events Defined
specifically for Intel AMT

The WSEventAndPetTableReplacement.xls
file contains information about each WS-Eventing event and its PET equivalent
(as shown in the following example of the PET fields)."

Above statement represents that WS-Events corresponding to all PET events will be generated. Moreover, WSEventAndPetTableReplacement.xls sheet contains all the PET Events ( including hardware insertion or removal events )..
-----------------------------------------
i think , some contradictory info is presented in SDK.
My doubt is, Will AMT generate only few PET events as listed under "Event Manager"ORALL PET(correspondingws-events) events as represented under "WS-Eventing Feature" ?? But, in practical , it generates only the events as listed under"Event Manager". If that is the case, how AMT can help in tracking the hardware changes ? Should the end appln enumeratethe hardware detailseverytime& cross verify with old data (stored somewhere ) and list the hardware changes ?? Any other way to track hardware??

Thanks Valantina

Superior
Imagen de Gael Hofemeier (Intel)
Gael Hofemeier (Intel)
Lun, 20/12/2010 - 11:57
Best Reply

Only those events documented in the AMT documentation will be captured by AMT. You are right about tracking hardware changes - you would have to capture the "current" state of your hardware periodically and then compare to make sure that there weren't any changes. The kind of things AMT is used for out-of-band (or when the system is off) would be "reading" what you may have stored in the 3rd Party Data Store (you could store your HW state there, for example - but again, it may not be current) and you can power up your system and you can have SOL/IDE-R sessions, for example. But AMT is not running, polling all the sensors when the sytsem is not powered on, and does not keep a record of the differences in hardware - you would have to add that capability to your application as you noted in your last response.

AMT does not know if/when the memory was physically removed, or if the chassis was tampered with - it simply reports the current hardware inventory.

Follow me on Twitter: @GH_IntelBlogs Facebook: https://www.facebook.com/gh.intelblogs
Superior
Imagen de valantinaa
valantinaa
Mié, 29/12/2010 - 02:25

Thanks Gael for the detailed explanation and confirming that " AMT simplyreports the current hardwrae inventory"

actually, iwas confused after reading belowlinks.

1. http://software.intel.com/en-us/articles/intel-active-management-technol...

some content fromthis link :

Event log and alerts. Management software can read a log of recent hardware events that occurred including failures, reboots, case intrusion, and more. Management software can also subscribe to be notified as soon as an event occurs.

2. ftp://download.intel.com/intelpress/articles/Solving_End_User_Problems_w...

some content from this pdf:

Intel AMT also supports the case intrusion switch and can send an alert to the administrator each time a computer case is open. Even if the computer is not connected at the time of the theft, the next time power and network is connected back, the computer will send the case intrusion alert to the administrator console.

Thanks Again !!!

Superior
Imagen de valantinaa
valantinaa
Mié, 29/12/2010 - 02:32

One suggestion !!!

Intel AMT SDKcan edit 'WSEventAndPetTableReplacement.xls' spreadsheet to contain only the list of events genarated by AMT ( as speciifed under 'Event Manger->AMT generated Events' section)and remove all other events.

Superior
Imagen de Gael Hofemeier (Intel)
Gael Hofemeier (Intel)
Mié, 29/12/2010 - 16:02

Hi - there is some sensor events (in ASF format) that are received by Intel AMT. Temperature, Fan, Voltage, and Case Intrusion.

Follow me on Twitter: @GH_IntelBlogs Facebook: https://www.facebook.com/gh.intelblogs
Superior

Inicie sesión para dejar un comentario.