MONITORING EVENTS WITH INTEL AMT AND MICROSOFT SCOM 2012

Introduction Server management is a critical role for any type of business. Having the right tools to be able to accomplish this task is a key part for any IT organization to rely on for maintaining and operating their environment. Leveraging Intel AMT technology on Lenovo ThinkServer tower servers offers an effective out-of-band management solution with features such as remote control and configuration, monitoring and alerting, and remote interactive diagnostics. This can provide valued information to an IT organization with troubleshooting system events. Getting real-time notification of problems that can occur on a server is an important capability. In our own labs, we added monitors in Microsoft Systems Center Operations Manager 2012 (SCOM) to monitor system events on Lenovo ThinkServers with Intel AMT 9.0 systems management. In this document, we show you how we created custom filters in SCOM to monitor events generated by the Intel AMT Local Management Service and capture them in Microsoft Systems Center Operations Manager (SCOM) 2012. We assume that Microsoft SCOM 2012 is configured on a Windows Server and the Intel Management Engine driver has been installed on the ThinkServer server to monitor. Adding the ThinkServer to monitor to SCOM 1. Launch the Microsoft Operations Manager Panel 2. Navigate to Authoring and expand Management Object Packs then select 3. Monitors. Right click on Monitors. Select Create a Monitor then click Unit Monitor. 4. The wizard to create a Unit Monitor will appear. 5. Expand Windows Events then select Simple Event Detection. There are three choices presented. Click each option to read the description of each monitor. In this example, Timer Reset is selected. 2

6. Select the Default Management Pack, then click Next. 3

7. Enter a name for the monitor. This example uses LMS Events. 8. Click on Select and choose Windows Computer. For Parent Monitor select Availability. Check the Monitor is enabled option. 9. Click Next. 10. Click on the browse button to locate the computer where the monitor will be applied. 11. Enter the Windows computer name then click Check Names. Click OK to continue. 4

12. Select Application and click OK to continue, then click Next. 13. Enter the Event ID to be monitored. See Table 1 below for available Event IDs and Sources. 14. Click Insert button for each event ID to add that is equal to the Event Source. In this example, the Event ID equals 2001 and the Event Source equals LMS. 5

15. If there is more than one Event ID that is equal to the Event Source, multiple Event IDs can be added to the same monitor if desired. 16. Set the wait time before the auto reset will trigger and clear the state of the monitor. This example is set to use one minute. Click Next. 6

17. Set the health monitor conditions. This example is set to Event Raised. Click next. 18. Check Generate alerts for this monitor. 19. For the Generate an alert when selection, choose The monitor is in a warning health state. 20. Review the additional options and set as appropriate. 21. Confirm the settings then click Create. 7

Viewing alerts in the new unit monitor in SCOM After creating the monitor, it is displayed in the Active Alerts section. Figure 1 below shows that the monitor has triggered the event. Figure 1 Active alert displayed in SCOM Table of LMS Events for Intel AMT 9 The following table shows the Category Event ID and Event Description for all of the defined alerts beginning with AMT Release 9.0. Table 1 LMS Events Category Event Event ID ID User User Message Message Intel ME App 1001 Security policy invoked. Some or all network traffic (TX) was stopped. Intel ME App 1002 Security policy invoked. TX Network connectivity was reduced. Intel ME App 1003 Security policy invoked. Some or all network traffic (RX) was stopped. Intel ME App 1004 Security policy invoked. RX Network connectivity was reduced. Intel ME App 1101 WLAN Wireless Profile sync enablement state changed. Intel ME App 1201 A remote Serial Over LAN session was established. Intel ME App 1202 Remote Serial Over LAN session finished. User control was restored. Intel ME App 1203 A remote IDE-Redirection session was established. Intel ME App 1204 Remote IDE-Redirection session finished. User control was restored. LMS 1210 Local Software Monitor has detected that agent <Agent UUID> has not started. LMS 1211 Local Software Monitor has detected that agent <Agent UUID> has stopped. LMS 1212 Local Software Monitor has detected that agent <Agent UUID> has expired. LMS 2000 User Notification Service started. LMS 2001 User Notification Service stopped. LMS 2050 Failed to update Intel(R) ME firmware with new network configuration. LMS Failed to verify that the new network configuration is valid and did not update 2051 the Intel(R) ME firmware with the configuration. LMS 2100 Intel(R) ME Wireless LAN ucode updated successfully. LMS 2101 Intel(R) ME User Consent language updated successfully. LMS 2102 Intel(R) ME Wireless LAN update unsuccessful, error <error number> LMS Intel(R) ME User Consent language update unsuccessful, error <error 2103 number> LMS Intel(R) ME Wireless LAN ucode update unsuccessful, due to missing image 2104 file. LMS Intel(R) ME User Consent language update unsuccessful, due to missing 2105 image file. LMS 2106 DHCP IP address for LAN interface has been renewed. LMS 2107 DHCP IP address for WLAN interface has been renewed. LMS 2108 Local Maintenance Timer has awoken the system from {S3 S4 S5}. LMS 2109 WLAN Link Control set to Host LMS 2110 WLAN Link control to Intel ME LMS 2112 Intel ME WLAN Link Protection 8 is ON (Passive) LMS 2113 Intel ME WLAN Link Protection is OFF LMS 2114 Remote administrator shutdown request was executed.

Category Event ID User Message LMS 2109 WLAN Link Control set to Host LMS 2110 WLAN Link control to Intel ME LMS 2112 Intel ME WLAN Link Protection is ON (Passive) LMS 2113 Intel ME WLAN Link Protection is OFF LMS 2114 Remote administrator shutdown request was executed. LMS 2116 Remote administrator reboot request was executed. LMS 2118 Sleep operation was requested by remote administrator. LMS 2119 Hibernate operation was requested by remote administrator. LMS 2120 Remote administrator sleep request was failed with error 50. LMS 2121 Remote administrator hibernate request was failed with error 50. 9

LENOVO PROVIDES THIS PUBLICATION AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON- INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. This information could include technical inaccuracies or typographical errors. Changes may be made to the information herein; these changes will be incorporated in new editions of the publication. Lenovo may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. The following terms are trademarks of Lenovo in the United States, other countries, or both: Lenovo, and ThinkServer. Intel and AMT are trademarks of Intel Corporation in the U.S. and/or other countries. Microsoft, Windows Systems Operations Manager 2012, Windows Server 2012, and the Windows Logo are trademarks of Microsoft Corporation in the United States and/or other countries.