Identifying Received Events

Intel AMT Features > WS-Eventing > Detailed Description > Identifying Received Events

Identifying Received Events

To identify the meaning of the WS-Eventing events that are sent from the Intel AMT firmware, you must perform the following:

1. Get the CIM_ALertIndication from the serialized message (see WS-Eventing Event Example).

2. Check the CIM_ALertIndication.MessageID (see WS-Eventing Event Example) according to the WSEventAndPetTableReplacment.xls.

For example, if the MessageID equals “iAMT0001”, this indicates that a System Defense Policy was triggered.

Note:

• Instead of checking the value of the MessageID in the xls file, you can use the sample script described in Translating Event IDs (Sample Script).

• Intel AMT Release 6.0 supports a new type of event, sent by the ME, which has a different format (see ME Presence Event Example).

WS-Eventing Event Example

The following example demonstrates a WS-Eventing event in the XML format as sent from the Intel AMT firmware:

<?xml version="1.0" encoding="UTF-8"?>

<a:Envelope

xmlns:a="http://www.w3.org/2003/05/soap-envelope"

xmlns:b="http://schemas.xmlsoap.org/ws/2004/08/addressing"

xmlns:c="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd"

xmlns:d="http://schemas.xmlsoap.org/ws/2005/02/trust"

xmlns:e="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-

wssecurity-secext-1.0.xsd"

xmlns:f="http://schemas.dmtf.org/wbem/wsman/1/cimbinding.xsd"

xmlns:g="http://schemas.dmtf.org/wbem/wscim/1/cim-

schema/2/CIM_AlertIndication"

xmlns:h="http://schemas.dmtf.org/wbem/wscim/1/common">

<a:Header>

<b:To>

http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous

</b:To>

<b:ReplyTo>

<b:Address>

http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous

</b:Address>

</b:ReplyTo>

<c:AckRequested>

</c:AckRequested>

<b:Action a:mustUnderstand="true">

http://schemas.dmtf.org/wbem/wsman/1/wsman/Event

</b:Action>

<b:MessageID>

uuid:00000000-8086-8086-8086-000000000013
</b:MessageID>

<c:ResourceURI>

http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_AlertIndication

</c:ResourceURI>

<m:Hello xmlns:m="http://mynamespace.com">

Here

</m:Hello>

<m:Goodbye xmlns:m="http://mynamespace.com">

There

</m:Goodbye>

</a:Header>

<a:Body>

<g:CIM_AlertIndication>

<g:AlertType>8</g:AlertType>

<g:AlertingElementFormat>2</g:AlertingElementFormat>

<g:AlertingManagedElement>

http://my-amt.amt-domainname.com:623/

wsman:CIM_ComputerSystem.CreationClassName=

"CIM_ComputerSystem",Name="Intel(r) AMT"

</g:AlertingManagedElement>

<g:IndicationFilterName>

Intel(r) AMT:AllEvents

</g:IndicationFilterName>

<g:IndicationIdentifier></g:IndicationIdentifier>

<g:IndicationTime>

<h:Datetime>2008-12-23T14:42:35.000</h:Datetime>

</g:IndicationTime>

<g:Message></g:Message>

<g:MessageArguments>1</g:MessageArguments>

<g:MessageArguments>

Interop:CIM_ComputerSystem.CreationClassName=CIM_ComputerSystem,

Name=Intel(r) AMT

</g:MessageArguments>

<g:MessageID>PLAT0032</g:MessageID>

<g:OtherAlertingElementFormat></g:OtherAlertingElementFormat>

<g:OtherSeverity></g:OtherSeverity>

<g:OwningEntity>DMTF</g:OwningEntity>

<g:PerceivedSeverity>6</g:PerceivedSeverity>

<g:ProbableCause>0</g:ProbableCause>

<g:SystemName>Intel(r) AMT</g:SystemName>

</g:CIM_AlertIndication>

</a:Body>

</a:Envelope>

ME Presence Event Example

The ME presence Event is a specific WS-Eventing event (specified below) that is sent by the ME firmware to a software entity registered to receive this event (subscription to “Intel(r) AMT:ME Presence”).

ME will send this event upon any change in network settings or a defined periodic setting (configurable). Network events that will cause this WS-Event to be sent:

• Change of host or ME FQDN

• Change or renew of IP address

• Periodic update if set (off by default – minimum of 15 minutes). See Configure ME Presence Event Period.

The following example demonstrates the event in the XML format as sent from the Intel ME firmware:

<g:CIM_AlertIndication>

<g:AlertType> 2 (CommunicationAlert) </g:AlertType>

<g:AlertingElementFormat>2 (CIM)</g:AlertingElementFormat>

<g:AlertingManagedElement></g:AlertingManagedElement>

<g:IndicationFilterName>

Intel(r) AMT:ME Presence Events

</g:IndicationFilterName>

<g:IndicationIdentifier></g:IndicationIdentifier>

<g:IndicationTime>

<h:Datetime>2009-10-19T15:25:22.000Z</h:Datetime>

</g:IndicationTime>

<g:Message>Intel(r)ME Presence Notification</g:Message>

<g:MessageArguments>

System UUID

88888888-8887-8888-8888-878888888888

</g:MessageArguments>

<g:MessageArguments>

ME FQDN

at61-user.intel.com

</g:MessageArguments>

<g:MessageArguments>

HOST FQDN

AT6-User-Host.vprodemo.com

</g:MessageArguments>

<g:MessageArguments>

System State (“S0”, “Sx”)

</g:MessageArguments>

<g:MessageArguments>

Connection Type (1=Local)

</g:MessageArguments>

<g:MessageArguments>

“{[list of IPv4 addresses on interface];[list of IPv6

addresses on interface]}, { [list of IPv4 addresses on

interface];[list of IPv6 addresses on interface]}”

{[10.0.140.5];[1111::8431:EF04:4302:DC8;FE80::FA01:5BAC:9A3E:22EC]

},{[0.0.0.0];[]}

</g:MessageArguments>

<g:MessageID>iAMT0037</g:MessageID>

<g:OtherAlertingElementFormat></g:OtherAlertingElementFormat>

<g:OtherSeverity></g:OtherSeverity>

<g:OwningEntity>Intel(r) AMT</g:OwningEntity>

<g:PerceivedSeverity>2 (information)</g:PerceivedSeverity>

<g:ProbableCause>0 (unknown)</g:ProbableCause>

<g:SystemName>Intel(r) AMT</g:SystemName>

</g:CIM_AlertIndication>