Check redfish-logservices¶

Overview¶

Checks the event log entries exposed under the LogServices of a Redfish-compatible server (the System Event Log, SEL) via the Redfish API. Alerts based on the severity of the log entries.

Important Notes:

Tested on DELL iDRAC and DMTF Simulator
A check usually completes within a few seconds, but a slow or retried request can take longer. The bundled Director basket allows a 60 second runtime timeout.
This check runs with both HTTP and HTTPS. It uses GET requests only.
No additional Python Redfish modules need to be installed.

Data Collection:

Reads the service root to detect the vendor, then queries the Managers collection (or Systems on Supermicro) to locate the log service
Reads the SEL log entries and evaluates each entry's severity
Reads each collection in a single request via the Redfish $expand query where the controller supports it, otherwise falls back to one request per member
Uses HTTP Basic authentication if --username and --password are provided

Fact Sheet¶

Fact	Value
Check Plugin Download	https://github.com/Linuxfabrik/monitoring-plugins/tree/main/check-plugins/redfish-logservices
Nagios/Icinga Check Name	`check_redfish_logservices`
Check Interval Recommendation	Every 5 minutes
Can be called without parameters	No (`--url` is required)
Runs on	Cross-platform
Compiled for Windows	No (runs with Python interpreter)
Uses State File	`$TEMP/linuxfabrik-monitoring-plugins-redfish.db`

Help¶

usage: redfish-logservices [-h] [-V] [--always-ok]
                           [--cache-expire CACHE_EXPIRE] [--ignore IGNORE]
                           [--insecure] [--log-type {sel,mel,both}]
                           [--match MATCH] [--max-age MAX_AGE] [--no-insecure]
                           [--no-perfdata] [--no-proxy] [--password PASSWORD]
                           [--proxy PROXY] [--retries RETRIES]
                           [--timeout TIMEOUT] --url URL [--username USERNAME]
                           [--verbose]

Checks the event log entries exposed under the LogServices of a
Redfish-compatible server via the Redfish API and alerts based on the severity
of the log entries. By default it reads the System Event Log (SEL);
`--log-type` selects the management controller log (MEL) or both. Entries can
be filtered by regular expression (--match, --ignore), and entries older than
--max-age days can be aged out so a long-since resolved event does not keep
the check in a non-OK state forever.

options:
  -h, --help            show this help message and exit
  -V, --version         show program's version number and exit
  --always-ok           Always returns OK.
  --cache-expire CACHE_EXPIRE
                        The amount of time after which the credential/data
                        cache expires, in minutes. Default: 5
  --ignore IGNORE       Ignore SEL entries whose message matches this Python
                        regular expression. Case-sensitive by default; use
                        `(?i)` for case-insensitive matching. Can be specified
                        multiple times. Example: `--ignore="Log area
                        reset/cleared"`.
  --insecure            This option explicitly allows insecure SSL
                        connections.
  --log-type {sel,mel,both}
                        Which log to read: `sel` (System Event Log, default),
                        `mel` (management controller event log) or `both`.
                        Default: sel
  --match MATCH         Only consider SEL entries whose message matches this
                        Python regular expression. Case-sensitive by default;
                        use `(?i)` for case-insensitive matching. Can be
                        specified multiple times. If both `--match` and
                        `--ignore` are given, an item must match `--match` AND
                        not match `--ignore` to be reported (include first,
                        exclude second). Example: `--match="(?i)temperature"`.
  --max-age MAX_AGE     Age out SEL entries older than this many days: they
                        are no longer alerted on, only counted in the summary.
                        A controller keeps an entry until the log is cleared,
                        so a long-since resolved event would otherwise keep
                        the check in a non-OK state forever. Default: 0 (0
                        disables aging).
  --no-insecure         Verify the TLS certificate against the system trust
                        store, overriding the insecure default of this check.
                        Use it once the endpoint presents a publicly trusted
                        certificate, or once its CA has been added to the
                        system trust store.
  --no-perfdata         Suppress the performance data section from the output.
                        The status message and the exit code are unaffected,
                        so alerting keeps working while trending data is
                        dropped.
  --no-proxy            Do not use a proxy, not even one the environment
                        names. Overrides `--proxy`.
  --password PASSWORD   Redfish API password.
  --proxy PROXY         Proxy to reach the target through. The scheme defaults
                        to `http` when omitted. Overrides the proxy the
                        environment names (`http_proxy`, `https_proxy`,
                        `all_proxy`) together with the exceptions it lists in
                        `no_proxy`, and is itself overridden by `--no-proxy`.
                        Without either parameter the environment applies.
                        Credentials belong into the environment variable
                        rather than here, because a command-line argument is
                        visible to every user on the host. Example:
                        `--proxy=http://proxy.example.com:3128`.
  --retries RETRIES     Number of extra attempts if a request to the Redfish
                        API fails, before the check gives up. Helps against an
                        occasionally slow or flaky management controller.
                        Default: 3
  --timeout TIMEOUT     Network timeout in seconds. Default: 8 (seconds)
  --url URL             Redfish API URL.
  --username USERNAME   Redfish API username.
  --verbose             Makes this plugin verbose during the operation. Useful
                        for debugging and seeing what is going on under the
                        hood. For this check that also appends every Redfish
                        response it evaluated to its output, ready to be
                        attached to a bug report, and writes a trace of every
                        Redfish request, with timings, to linuxfabrik-
                        monitoring-plugins-redfish-trace.log below the
                        temporary directory. Unlike this check's output, the
                        trace survives a check that the monitoring server
                        terminates for exceeding its timeout, which is what
                        makes it useful against a slow management controller.
                        Passwords and session tokens are kept out of both. The
                        output grows with the responses, so keep this switched
                        on in a service definition only while chasing a
                        problem.

Documentation:
https://linuxfabrik.github.io/monitoring-plugins/check-plugins/redfish-logservices/

Usage Examples¶

./redfish-logservices --url=https://bmc --username=redfish-monitoring --password='linuxfabrik'

Output:

Checked SEL on 1 member. There are critical errors.

/redfish/v1/Managers/BMC
* 2012-03-07T14:44:00Z: System May be Melting [CRITICAL]

States¶

OK if no log entry has a severity above OK.
WARN if a log entry has severity "Warning".
CRIT if a log entry has severity "Critical".
--always-ok suppresses all alerts and always returns OK.

Perfdata / Metrics¶

There is no perfdata.

For Maintainers¶

You don't need a physical server with a real BMC (the management controller that serves the Redfish API, e.g. HPE iLO or Dell iDRAC) to develop or test this plugin. The official DMTF Redfish mockup server serves a static, read-only Redfish tree (including the manager log service) over plain HTTP, which is exactly what this GET-only plugin needs.

Run the mockup server and point the plugin at it, from the repository root:

podman run \
    --detach --rm \
    --name lfmp-redfish-mock \
    --publish 5000:8000 \
    docker.io/dmtf/redfish-mockup-server:latest
sleep 3
check-plugins/redfish-logservices/redfish-logservices --url=http://127.0.0.1:5000 --no-proxy
podman stop lfmp-redfish-mock

Use http://127.0.0.1:5000 rather than http://localhost:5000, because localhost may resolve to IPv6 (::1) while the published container port is bound to IPv4.

The fixtures under unit-test/stdout/ are the output of --verbose runs, one file per scenario, with a ### GET <path> block for every Redfish response the plugin evaluated. The test suite replays them instead of calling a controller, so the output a user attaches to a bug report becomes a new scenario as it is, whatever the number of members. To simulate an alert, copy a healthy scenario and add an entry with a Severity of Critical or Warning to the log entries. The offline test suite is run with ./run from the unit-test directory.

Credits, License¶

Authors: Linuxfabrik GmbH, Zurich
License: The Unlicense, see LICENSE file.