System Event Log

How the log is read

sel().execute()^[1]:

1. sends Get SEL Time UTC Offset, for a BMC that keeps its SEL time as local time (IPMI 2.0 revision 1.1; a BMC without the command keeps it in UTC), and Get SEL Info, for the number of entries and the time of the last addition and erase (an empty log is not read: Get SEL Entry fails on it);
2. sends Get SEL Entry for the first entry (record ID 0000h), then for the next record ID each reply gives, until that ID is FFFFh. Each entry is read whole, so no reservation is needed (IPMI 2.0, section 31.5); when a BMC asks for one anyway, or cancels the one it gave (C5h), the client takes a reservation with Reserve SEL and reads the entry again.

The first entry read (or the entry given to since(), when nothing follows it) is read again after the walk, and so is Get SEL Info: when the log was erased meanwhile (its erase timestamp changed, after a Clear SEL or a Delete SEL Entry, whose record IDs may be reused; or the first entry is another one, as two erases within a second leave the timestamp unchanged), or when an entry named as the next one is not there any more (CBh), the read starts over, once, whole (the entry given to since() may be another one by then) and from what the log is now; a log that changes twice during a read fails it with IpmiClientException rather than return a list that mixes two logs, and so does a log whose next record IDs loop or that answers another entry than the one asked for. While a Clear SEL is in progress (81h), the read waits for its end, up to 10 s. A BMC without Get SEL Info (C1h, D5h) is read all the same, without the counts and timestamps; any other refusal of it fails the read, as a clear could then go unnoticed.

Every record type is decoded: the system events, the OEM records with and without timestamp, and the reserved types, of which only the record ID is defined (Supported Commands^[2]). A log of 643 entries takes about 20 s on a Lenovo IMM (one round trip per entry); a Supermicro BMC answers its 18 entries in half a second.

The read needs the User privilege, like the other read operations, and is retried once^[3] on a new session when the session is lost while it runs.

The SelEntry object

Each SelEntry^[4] is immutable and holds:

The accessors of a system event (sensorType(), event(), …) are empty for the OEM and reserved entries, and manufacturerId() and oemData() for the system events: type() tells which. Two entries are equals() when they are the same record (same ID, same 16 bytes).

SelEntryList^[12], the result of execute(), is an unmodifiable List<SelEntry> that also gives what Get SEL Info says of the whole log: totalEntries(), lastAddition() and lastErase() (Optional: a BMC that never erased its log reports no erase time), and the utcOffsetMinutes() of the SEL time.

SensorList sensors = bmc.sensors().execute();
for (SelEntry entry : bmc.sel().execute()) {
	if (entry.eventType().orElse(0) == 0x01 && entry.direction().get() == EventDirection.Assertion) {
		byte[] data = entry.eventData();
		for (Sensor sensor : sensors) {
			if (entry.isFrom(sensor) && (data[0] & 0xC0) == 0x40 && sensor.record() instanceof FullSensorRecord) {
				FullSensorRecord record = (FullSensorRecord) sensor.record();
				System.out.println(entry.timestamp().orElse(null) + " " + sensor.name() + ": " + entry.description()
						+ " at " + record.calcFormula(data[1] & 0xFF) + " " + sensor.unit());
			}
		}
	}
}

Polling for new entries

Reading the whole log at every poll costs one round trip per entry. since(entry) reads only the entries added after the given one, the last entry of the previous read: that entry is read again to find the next one and left out.

SelEntry lastSeen = null;
while (true) {
	SelEntryList entries = lastSeen == null ? bmc.sel().execute() : bmc.sel().since(lastSeen).execute();
	for (SelEntry entry : entries) {
		alert(entry);
		lastSeen = entry;
	}
	Thread.sleep(60_000);
}

When the log was cleared since, the record IDs started over: the BMC holds another entry under the ID of the last one seen, or none, and the whole log is read (lastErase() is then more recent than the previous read). since(int recordId) does the same with the ID alone, for a cursor kept across restarts, but cannot tell a log cleared and filled up to that ID again from the one it read before: compare lastErase() with the previous read when using it.

The log has a fixed capacity (hundreds to a few thousand entries); when it is full, most BMCs stop logging (SelFull, SelAlmostFull events of the EventLoggingDisabled sensor type announce it) and the log must be cleared with ipmitool sel clear, the web interface of the BMC, or the Clear SEL command, which the library does not implement.

With the command-line client

$ ipmicli -h bmc.example.com -u monitor -pf pw.txt sel
ID  Time                  Type                  Sensor  Event                      Direction
1   2023-03-15T17:06:39Z  EventLoggingDisabled  114     Log area reset/cleared     assertion
2   pre-init 39s          PowerSupply           101     Power Supply AC lost       assertion
3   pre-init 44s          PowerSupply           101     Power Supply AC lost       deassertion
4   2023-04-03T09:35:31Z  OsBoot                0       Installation started       assertion
5   2024-03-28T15:20:37Z  PowerSupply           100     Power Supply AC lost       assertion
6   2024-03-28T15:20:37Z  PowerSupply           116     Redundancy Lost            assertion
7   2024-03-28T15:20:42Z  PowerSupply           100     Power Supply AC lost       deassertion

(The first entries of a Dell iDRAC.) See sel^[14] in the manual of the command-line client: --since <id> and --json.