ipmitool(1)

📦
version 1.8.19.13.gbe11d94 · 8 versions
, in alpine 3.24, arch rolling, opensuse-leap 16.0

✨ ipmitool(1) ✨

okay so this is the manual page for ipmitool(1) — ipmitool — the utility for controlling IPMI-enabled devices. bestie, it's a long one, so buckle up, hydrate, and let's go 💖

🌸 SYNOPSIS 🌸

ipmitool [ <options> ] <command> [ <sub-commands and sub-options> ]

<options>           := [ <general-options> | <conditional-opts> ]

Any recognized option is accepted. Conditional options may be ignored or
it's usage postponed until shell or exec processes relevant command.

<general-options>   := [ -h | -V | -v | -I <interface> | -H <address> |
                         -d <N> | -p <port> | -c | -U <username> |
                         -L <privlvl> | -l <lun> | -m <local_address> |
                         -N <sec> | -R <count> | <password-option> |
                         <oem-option> | <bridge-options> ]

<conditional-opts>  := [ <lan-options> | <lanplus-options> |
                         <command-options> ]
Bridging:
<bridge-options>    := -t <target_address> [ -b <channel> |
                       [ -T <address> | -B <channel> ] ]

Options used with -I lan:
<lan-options>       := [ -A <authtype> ]

Options used with -I lanplus:
<lanplus-options>   := [ -C <ciphersuite> | <key-option> ]

Option groups setting same value:
<key-option>        := [ -k <key> | -K | -y <hex_key> | -Y ]
<password-option>   := [ -f <password_file> | -a | -P <password> | -E ]
<oem-option>        := [ -o <oemtype> | -g | -s ]

Options used with specific command <command-options>:
<options-sdr>       := [ -S <sdr_cache_file> ]
<options-sel>       := [ -O <sel_oem> ]
<options-sol>       := [ -e <sol_escape_char> ]

so basically: <options> is either some general ones or some conditional ones, and any recognized option gets accepted — the conditional ones might just get ignored, or their usage gets postponed until a shell or exec process hits the relevant command. iykyk 🫶

🦋 DESCRIPTION 🦋

This program lets you manage Intelligent Platform Management Interface (IPMI) functions — either of the local system, via a kernel device driver, or of a remote system, using IPMI v1.5 and IPMI v2.0. And what does "manage" mean here? Obsessed you asked: printing FRU information, LAN configuration, sensor readings, and remote chassis power control. the range, honestly 👑

IPMI management of a local system interface requires a compatible IPMI kernel driver to be installed and configured. On Linux this driver is called OpenIPMI and it is included in standard distributions. On Solaris this driver is called BMC and it is included in Solaris 10. Management of a remote station requires the IPMI-over-LAN interface to be enabled and configured. Depending on the particular requirements of each system it may be possible to enable the LAN interface using ipmitool over the system interface. no cap, that's the whole vibe ✨

💅 OPTIONS 💅

  • -a — Prompt for the remote server password. cute, interactive, it'll ask.
  • -A <authtype> — Specify an authentication type to use during IPMIv1.5 lan session activation. Supported types are NONE, PASSWORD, MD2, MD5, or OEM.
  • -b <channel> — Set destination channel for bridged request.
  • -B <channel> — Set transit channel for bridged request (dual bridge).
  • -b <channel> — Set destination channel for bridged request. (yes it's in here twice, the page really do be like that 🙈)
  • -B <channel> — Set transit channel for bridged request. (dual bridge)
  • -c — Present output in CSV (comma separated variable) format. This is not available with all commands.
  • -C <ciphersuite> — The remote server authentication, integrity, and encryption algorithms to use for IPMIv2.0 lanplus connections. See table 22-20 in the IPMI v2.0 specification. The default is 17, which specifies RAKP-HMAC-SHA256 authentication, HMAC-SHA256-128 integrity, and AES-CBC-128 encryption algorithms.
NOTE: In ipmitool 1.8.18 and earlier the default was 3, which was insecure and was not supported by some more recent BMC implementations. so if you're on an old one, that's why, and also, respectfully, upgrade 😭
  • -d N — Use device number N to specify the /dev/ipmiN (or /dev/ipmi/N or /dev/ipmidev/N) device to use for in-band BMC communication. Used to target a specific BMC on a multi-node, multi-BMC system through the ipmi device driver interface. Default is 0.
  • -e <sol_escape_char> — Use supplied character for SOL session escape character. The default is to use ~ but this can conflict with ssh sessions. (the classic ~ jumpscare 💀)
  • -E — The remote server password is specified by the environment variable IPMI_PASSWORD or IPMITOOL_PASSWORD. The IPMITOOL_PASSWORD takes precedence.
  • -f <password_file> — Specifies a file containing the remote server password. If this option is absent, or if password_file is empty, the password will default to NULL.
  • -g — Deprecated. Use: -o intelplus
  • -h — Get basic usage help from the command line.
  • -H <address> — Remote server address, can be IP address or hostname. This option is required for lan and lanplus interfaces. non-negotiable, you need it 🫡
  • -I <interface> — Selects IPMI interface to use. Supported interfaces that are compiled in are visible in the usage help output.
  • -k <key> — Use supplied Kg key for IPMIv2.0 authentication. The default is not to use any Kg key.
  • -K — Read Kg key from IPMI_KGKEY environment variable.
  • -l <lun> — Set destination lun for raw commands.
  • -L <privlvl> — Force session privilege level. Can be CALLBACK, USER, OPERATOR, ADMINISTRATOR. Default is ADMINISTRATOR. This value is ignored and always set to ADMINISTRATOR when combined with -t target address. (the -t option said "hold my crown" 👑)
  • -m <local_address> — Set the local IPMB address. The local address defaults to 0x20 or is auto discovered on PICMG platforms when -m is not specified. There should be no need to change the local address for normal operation. like fr, leave it alone 💜
  • -N <sec> — Specify nr. of seconds between retransmissions of lan/lanplus messages. Defaults are 2 seconds for lan and 1 second for lanplus interfaces. Command raw uses fixed value of 15 seconds. Command sol uses fixed value of 1 second.
  • -o <oemtype> — Select OEM type to support. This usually involves minor hacks in place in the code to work around quirks in various BMCs from various manufacturers. Use -o list to see a list of current supported OEM types.
  • -O <sel oem> — Open selected file and read OEM SEL event descriptions to be used during SEL listings. See examples in contrib dir for file format.
  • -p <port> — Remote server UDP port to connect to. Default is 623.
  • -P <password> — Remote server password is specified on the command line. If supported it will be obscured in the process list. Note! Specifying the password as a command line option is not recommended.
  • -R <count> — Set the number of retries for lan/lanplus interface (default=4). Command raw uses fixed value of one try (no retries). Command hpm uses fixed value of 10 retries.
  • -s — Deprecated. Use: -o supermicro
  • -S <sdr_cache_file> — Use local file for remote SDR cache. Using a local SDR cache can drastically increase performance for commands that require knowledge of the entire SDR to perform their function. Local SDR cache from a remote system can be created with the sdr dump command. it's giving ✨speed✨
  • -t <target_address> — Bridge IPMI requests to the remote target address. Default is 32. The -L privlvl option is always ignored and value set to ADMINISTRATOR.
  • -T <address> — Set transit address for bridge request (dual bridge).
  • -T <transmit_address> — Set transit address for bridge request. (dual bridge) (again, listed twice in the source, we do not gatekeep 🎀)
  • -U <username> — Remote server username, default is NULL user.
  • -v — Increase verbose output level. This option may be specified multiple times to increase the level of debug output. If given three times you will get hexdumps of all incoming and outgoing packets. Using it five times provides details on request and expected reply processing. The hpm commands targetcap compprop abort upgstatus rollback rollbackstatus selftestresult increases the verbosity level.
  • -V — Display version information.
  • -y <hex key> — Use supplied Kg key for IPMIv2.0 authentication. The key is expected in hexadecimal format and can be used to specify keys with non-printable characters. E.g. '-k PASSWORD' and '-y 50415353574F5244' are equivalent. The default is not to use any Kg key.
  • -Y — Prompt for the Kg key for IPMIv2.0 authentication.
  • -z <size> — Change Size of Communication Channel. (OEM)

If no password method is specified then ipmitool will prompt the user for a password. If no password is entered at the prompt, the remote server password will default to NULL. so, like, don't just mash enter and act surprised 🙈

🔥 SECURITY 🔥

okay bestie, this section is the "please take this seriously" section, no cap.

There are several security issues be be considered before enabling the IPMI LAN interface. A remote station has the ability to control a system's power state as well as being able to gather certain platform information. To reduce vulnerability it is strongly advised that the IPMI LAN interface only be enabled in 'trusted' environments where system security is not an issue or where there is a dedicated secure 'management network'. literally the whole power state. respect the LAN interface 🫶

Further it is strongly advised that you should not enable IPMI for remote access without setting a password, and that that password should not be the same as any other password on that system. (yes, reusing passwords is still a crime, we've been over this 💀)

When an IPMI password is changed on a remote machine with the IPMIv1.5 lan interface the new password is sent across the network as clear text. This could be observed and then used to attack the remote system. It is thus recommended that IPMI password management only be done over IPMIv2.0 lanplus interface or the system interface on the local station. clear text!! in the group chat!! no 💀

For IPMI v1.5, the maximum password length is 16 characters; longer passwords might be truncated or rejected by the server, or rejected by ipmitool.

For IPMI v2.0, the maximum password length is 20 characters; longer passwords will be rejected by ipmitool.

🌈 COMMANDS 🌈

  • help — This can be used to get command-line help on ipmitool commands. It may also be placed at the end of commands to get option usage help. the icon that it is 🎀

and that's just the very first command on the list — there's a whole buffet of them waiting, so stay tuned bestie 💖

K so real talk: ipmitool help is your little map of everything the tool can do, and it lowkey prints this exact list. Copy-paste safe, character for character:

> ipmitool help
Commands:
        bmc          Deprecated. Use mc
        channel      Configure Management Controller channels
        chassis      Get chassis status and set power state
        dcmi         Data Center Management Interface
        delloem      Manage Dell OEM Extensions.
        echo         Used to echo lines to stdout in scripts
        ekanalyzer   run FRU-Ekeying analyzer using FRU files
        event        Send events to MC
        exec         Run list of commands from file
        firewall     Configure Firmware Firewall
        fru          Print built-in FRU and scan for FRU locators
        fwum         Update IPMC using Kontron OEM Firmware
Update Manager
        gendev       Read/Write Device associated with Generic
Device locators sdr
        hpm          Update HPM components using PICMG HPM.1 file
        i2c          Send an I2C Master Write-Read command and
print response
        ime          Upgrade/Query Intel ME firmware
        isol         Configure and connect Intel IPMIv1.5
Serial-over-LAN
        kontronoem   Manage Kontron OEM Extensions
        lan          Configure LAN Channels
        mc           Management Controller status and global
enables
        nm           Node Manager
        pef          Configure Platform Event Filtering (PEF)
        picmg        Run a PICMG/ATA extended command
        power        Shortcut to chassis power commands
        raw          Send a RAW IPMI request and print response
        sdr          Print Sensor Data Repository entries and
readings
        sel          Print System Event Log (SEL)
        sensor       Print detailed sensor information
        session      Print session information
        set          Set runtime variable for shell and exec
        shell        Launch interactive IPMI shell
        sol          Configure and connect IPMIv2.0
Serial-over-LAN
        spd          Print SPD info from remote I2C device
        sunoem       Manage Sun OEM Extensions
        tsol         Configure and connect Tyan IPMIv1.5
Serial-over-LAN
        user         Configure Management Controller users

Now the vibe check on each one, bestie, so you know what you're picking up:

  • bmc — ✨ deprecated ✨. It literally says Deprecated. Use mc. So use mc, ok? Not me still seeing people type bmc in 2024 😭.
  • channel — configure management controller channels. Your whole comms setup lives here.
  • chassis — get chassis status and set power state. The classic "is it on, can I turn it off" zone.
  • dcmi — Data Center Management Interface. Very data-center, very serious.
  • delloem — manage Dell OEM extensions. Dell-specific club 💅
  • echo — used to echo lines to stdout in scripts. Baby's first script tool, iconic.
  • ekanalyzer — run FRU-Ekeying analyzer using FRU files. Niche, but she's valid.
  • event — send events to MC.
  • exec — run a list of commands from a file. Batch mode nation 🫶
  • firewall — configure Firmware Firewall. Security girlie.
  • fru — print built-in FRU and scan for FRU locators.
  • fwum — update IPMC using Kontron OEM Firmware Update Manager.
  • gendev — read/write device associated with generic device locators sdr.
  • hpm — update HPM components using a PICMG HPM.1 file.
  • i2c — send an I2C master write-read command and print the response.
  • ime — upgrade/query Intel ME firmware.
  • isol — configure and connect Intel IPMIv1.5 Serial-over-LAN.
  • kontronoem — manage Kontron OEM extensions.
  • lan — configure LAN channels.
  • mc — management controller status and global enables. (This is the one. The main character.)
  • nm — Node Manager.
  • pef — configure Platform Event Filtering (PEF).
  • picmg — run a PICMG/ATA extended command.
  • power — shortcut to the chassis power commands, no cap.
  • raw — send a RAW IPMI request and print the response. Powerful, slightly feral 🔥
  • sdr — print Sensor Data Repository entries and readings.
  • sel — print the System Event Log (SEL).
  • sensor — print detailed sensor information.
  • session — print session information.
  • set — set a runtime variable for shell and exec.
  • shell — launch the interactive IPMI shell.
  • sol — configure and connect IPMIv2.0 Serial-over-LAN.
  • spd — print SPD info from a remote I2C device.
  • sunoem — manage Sun OEM extensions.
  • tsol — configure and connect Tyan IPMIv1.5 Serial-over-LAN.
  • user — configure management controller users.

🌸 channel 🌸

authcap <channel number> <max priv>

Shows you the authentication capabilities of the channel you picked, at the privilege level you picked. Simple, honest, slays.

The possible privilege levels are, and yes you need to memorise these:

1   Callback level
2   User level
3   Operator level
4   Administrator level
5   OEM Proprietary level
15   No access
Ngl the jump from 5 to 15 is such a choice, but that's the spec, not me 🙈.

info [channel number]

Tells you everything about the chosen channel. Don't pass a channel number? It just shows you info about whatever channel is currently in use. Lowkey convenient.

> ipmitool channel info
Channel 0xf info:
  Channel Medium Type   : System Interface
  Channel Protocol Type : KCS
  Session Support       : session-less
  Active Session Count  : 0
  Protocol Vendor ID    : 7154

Look at her go. 0xf, KCS, session-less, zero active sessions — a whole mood 💅.

getaccess <channel number> [<userid>]

Sets the given userid as the default on that channel number. Then whenever that channel gets used later, the user is identified implicitly by that userid. So it's like... pre-booking the identity. Cute.

Configures the access info for that userid on that channel. Everything in brackets is optional, so take what you need:

  • callin=on|off
  • ipmi=on|off
  • link=on|off
  • privilege=level

getciphers <ipmi|sol> [<channel>]

Spits out the list of cipher suites supported for the app you name — ipmi or sol — on the channel you name. Cipher shopping, but make it secure 🔐.

🎀 chassis 🎀

status

Status info related to power, buttons, cooling, drives and faults. The whole vibe check of the physical box.

power

The power moves, and here's the full menu:

  • status
  • on
  • off
  • cycle
  • reset
  • diag
  • soft

That's it. That's the list. Pick your fighter 💀.

identify [<seconds>|force]

The identify interval — you know, the "which server am I even looking at" light.

  • Default is 15 seconds.
  • 0 — off.
  • force — turn it on indefinitely.

policy

What should happen when power gets restored? Big philosophical question, honestly.

  • list — show the available options.
  • always-on
  • previous
  • always-off

restart_cause

Shows the last restart cause. Receipts for why it rebooted 🔍.

poh

Get power on hours. How long has she been awake. 😭

bootdev

Where should this thing boot from? The options:

  • none — do not change boot device order.
  • pxe — force PXE boot.
  • disk — force boot from default hard-drive.
  • safe — force boot from default hard-drive, request Safe Mode.
  • diag — force boot from Diagnostic Partition.
  • cdrom — force boot from CD/DVD.
  • bios — force boot into BIOS Setup.
  • floppy — force boot from Floppy/primary removable media.

bootmbox get [text] [block <block#>]

Reads the Boot Initiator Mailbox, either as a hex dump or in text mode (that's what the text bit is for).

By default the whole mailbox gets read. But if you give a block number, only that particular block gets read. And heads up: for block 0, or when you're reading the whole mailbox, it also prints the Boot Initiator IANA Enterprise Number plus the matching enterprise name. Extra info, no extra charge ✨.

bootmbox set text [block <block#>] <IANA_PEN> "<data_string>"

Writes either the specified <block> or the entire Boot Initiator Mailbox, in text mode.

You must give a decimal IANA Enterprise Number that the boot initiator on the target system actually recognises — check with your target system manufacturer for the details, bestie, I can't guess that for you. Everything after that is a text string.

Real talk warning 🚨: when you request a single block write, the total length of <data> may not exceed 13 bytes for block 0, or 16 bytes otherwise. Overshoot and it's not gonna be cute.

bootmbox set [block <block#>] <IANA_PEN> <data_byte> [<data_byte> ...]

Same thing as above, except the arguments after the IANA PEN are separate data byte values, each separated by spaces.

bootparam get <opt_id> [<opt_param>]

Gets the value of system boot option number <opt_id>. Some boot options (option 7, for example) can also take an optional numeric parameter, which is what <opt_param> is for.

bootparam set bootflag <device> [options=...]

Sets a boot flag. The valid devices:

  • force_pxe — force PXE boot.
  • force_disk — force boot from default hard-drive.
  • force_safe — force boot from default hard-drive, request Safe Mode.
  • force_diag — force boot from Diagnostic Partition.
  • force_cdrom — force boot from CD/DVD.
  • force_bios — force boot into BIOS Setup.

And the valid options:

  • PEF — clear the valid bit on reset/power cycle caused by PEF.
  • timeout — automatically clear the boot flag valid bit on timeout.
  • watchdog — clear the valid bit on reset/power cycle caused by watchdog.
  • reset — clear the valid bit on push button reset/soft reset.
  • power — clear the valid bit on power up via power push button or wake event.

selftest

Gets the chassis self-test results. Is she okay? Let's find out 🫶.

💜 dcmi 💜

discover

Used to discover the capabilities supported in DCMI. It's the "what can you even do" command.

power <command>

The platform power limit commands are:

  • reading — get power related readings from the system.
  • get_limit — get the configured power limits.
  • set_limit <parameter> <value> — set a power limit option.
  • activate — activate the set power limit.
  • deactivate — deactivate the set power limit.

And the possible parameters/values for set_limit, since this is the messy part:

  • action <No Action | Hard Power Off & Log Event to SEL | Log Event to SEL> — the exception action taken is either "No Action", "Hard Power Off system and log events to SEL", or "Log event to SEL only".
  • limit <number in Watts> — the power limit requested, in Watts.
  • correction <number in milliseconds> — the correction time limit, in milliseconds.
  • sample <number in seconds> — the statistics sampling period, in seconds.

sensors

Prints the available DCMI sensors.

asset_tag

Prints the platform's asset tag. Name tag energy 🏷️.

set_asset_tag <string>

Sets the platform's asset tag.

get_mc_id_string

Gets the management controller identifier string.

set_mc_id_string <string>

Sets the management controller identifier string. The maximum length is 64 bytes, and that includes a null terminator — so don't go spending all 64 on your cute nickname 🙈.

thermalpolicy [<get | set>]

Thermal Limit policy get/set. The commands are:

  • Get <entityID> <instanceID> — get Thermal Limit values.

entityID is the physical entity that a sensor or device is associated with — like, which thing are we even talking about. instanceID is a particular instance of an entity. Entity Instance can live in one of two ranges: system-relative or device-relative. For example, a system with four processors could use an Entity Instance value of "0" to identify the first processor. 🫶

  • Set <entityID> <instanceID> — Set Thermal Limit values. 🔥

Ngl, the next bit is literally the same paragraph again, but your girl doesn't skip lore: entityID is the physical entity that a sensor or device is associated with, and instanceID is a particular instance of an entity. Entity Instance can be in one of two ranges, system-relative or device-relative. For example, a system with four processors could use an Entity Instance value of "0" to identify the first processor. (yes bestie, "0" = first processor, iconic numbering) 💅

  • get_temp_reading — Get Temperature Sensor Readings. 🌡️
  • get_conf_param — Get DCMI Configuration Parameters. ⚙️
  • set_conf_param <parameters> — Set DCMI Configuration Parameters.

The Configuration Parameters are:

  • activate_dhcp — Activate/restart DHCP. 🚀
  • dhcp_config — Discover DHCP Configuration.
  • init — Set DHCP Initial timeout interval, in seconds. The recommended default is four seconds.
  • timeout — Set DHCP Server contact timeout interval, in seconds. The recommended default timeout is two minutes.
  • retry — Set DHCP Server contact retry interval, in seconds. The recommended default timeout is sixty-four seconds.
  • oob_discover — Ping/Pong Message for DCMI Discovery. 🏓

🦋 delloem 🌈

The delloem commands provide information on Dell-specific features. It's giving "Dell said lemme add my own commands" energy, and honestly? Respect. 👑

💖 setled {b:d.f} {state..}

Sets the drive backplane LEDs for a device.

  • {b:d.f} = PCI Address of device (eg. 06:00.0)
  • {state} = one or more of the following: online | present | hotspare | identify | rebuilding | fault | predict | critical | failed

🎀 lcd

set {mode}|{lcdqualifier}|{errordisplay} — Allows you to set the LCD mode and user-defined string.

Then the individual LCD moves, in all their glory:

lcd set mode {none}|{modelname}|{ipv4address}|{macaddress}|{systemname}|{servicetag}|{ipv6address}|{ambienttemp}|{systemwatt}|{assettag}|{userdefined}<text>

Allows you to set the LCD display mode to any of the preceding parameters.

lcd set lcdqualifier {watt}|{btuphr}|{celsius}|{fahrenheit}

Allows you to set the unit for the system ambient temperature mode.

lcd set errordisplay {sel}|{simple}

Allows you to set the error display.

lcd info — Displays the LCD screen information. 📺

lcd set vkvm {active}|{inactive}

Allows you to set the vKVM status to active or inactive. When it is active and session is in progress, a message appears on LCD.

lcd status — Displays the LCD status for vKVM display active or inactive and Front Panel access mode (viewandmodify, view-only or disabled). No cap, that's a whole vibe check of your front panel right there.

🌸 mac

Displays the information about the system NICs.

mac list — Displays the NIC MAC address and status of all NICs. It also displays the DRAC/iDRAC MAC address. 🧚

mac get <NIC number> — Displays the selected NICs MAC address and status.

⭐ lan

Displays the information of Lan.

lan set <Mode> — Sets the NIC selection mode (dedicated, shared with lom1, shared with lom2, shared with lom3, shared with lom4, shared with failover lom1, shared with failover lom2, shared with failover lom3, shared with failover lom4, shared with Failover all loms, shared with Failover None).

lan get — Returns the current NIC selection mode (dedicated, shared with lom1, shared with lom2, shared with lom3, shared with lom4, shared with failover lom1, shared with failover lom2, shared with failover lom3, shared with failover lom4, shared with Failover all loms, shared with Failover None).

lan get active — Returns the current active NIC (dedicated, LOM1, LOM2, LOM3 or LOM4).

🔥 powermonitor

Displays power tracking statistics.

powermonitor clear cumulativepower — Reset cumulative power reading.

powermonitor clear peakpower — Reset peak power reading.

powermonitor powerconsumption <watt>|<btuphr> — Displays the power consumption in watt or btuphr.

powermonitor powerconsumptionhistory <watt>|<btuphr> — Displays the power consumption history in watt or btuphr.

powermonitor getpowerbudget <watt>|<btuphr> — Displays the power cap in watt or btuphr.

powermonitor setpowerbudget <val><watt|btuphr|percent> — Allows you to set the power cap in watt, BTU/hr or percentage.

powermonitor enablepowercap — Enables set power cap. ⚡

powermonitor disablepowercap — Disables set power cap.

💜 vFlash info Card

Shows Extended SD Card information. 🍓

✨ echo 💖

For echoing lines to stdout in scripts. Tiny command, big main character energy — your scripts said "I need a little guy to just print things" and echo delivered.

🧚 ekanalyzer 💫

ekanalyzer <command> <xx=filename1> <xx=filename2> [<rc=filename3>] ...
NOTE: This command can support a maximum of 8 files per command line. Eight. Not nine. Bestie, don't push it. 🙈

Here's who's who in that command line:

  • filename1 — binary file that stores FRU data of a Carrier or an AMC module
  • filename2 — binary file that stores FRU data of an AMC module. These binary files can be generated from command: ipmitool fru read <id> <filename>
  • filename3 — configuration file used for configuring On-Carrier Device ID or OEM GUID. This file is optional.

And xx? It indicates the type of the file. It can take the following value:

  • oc — On-Carrier device
  • a1 — AMC slot A1
  • a2 — AMC slot A2
  • a3 — AMC slot A3
  • a4 — AMC slot A4
  • b1 — AMC slot B1
  • b2 — AMC slot B2
  • b3 — AMC slot B3
  • b4 — AMC slot B4
  • sm — Shelf Manager

The available commands for ekanalyzer are:

carrier (default) <oc=filename1> <oc=filename2> ... — Display point to point physical connectivity between carriers and AMC modules.

Example, served fresh:

> ipmitool ekanalyzer print carrier oc=fru oc=carrierfru
   From Carrier file: fru
      Number of AMC bays supported by Carrier: 2
      AMC slot B1 topology:
         Port 0 =====> On Carrier Device ID 0, Port 16
         Port 1 =====> On Carrier Device ID 0, Port 12
         Port 2 =====> AMC slot B2, Port 2
      AMC slot B2 topology:
         Port 0 =====> On Carrier Device ID 0, Port 3
         Port 2 =====> AMC slot B1, Port 2
   *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
   From Carrier file: carrierfru
      On Carrier Device ID 0 topology:
         Port 0 =====> AMC slot B1, Port 4
         Port 1 =====> AMC slot B1, Port 5
         Port 2 =====> AMC slot B2, Port 6
         Port 3 =====> AMC slot B2, Port 7
      AMC slot B1 topology:
         Port 0 =====> AMC slot B2, Port 0
      AMC slot B1 topology:
         Port 1 =====> AMC slot B2, Port 1
      Number of AMC bays supported by Carrier: 2

Look at all those arrows. The topology ate and left no crumbs. 🫶

power <xx=filename1> <xx=filename2> ... — Display power supply information between carrier and AMC modules.

all <xx=filename> <xx=filename> ... — Display both physical connectivity and power supply of each carrier and AMC modules. The "why not both" option, honestly iconic. 💅

🎀 frushow <xx=filename>

Convert a binary FRU file into human readable text format. Use -v option to get more display information. 👀

⭐ summary [<match | unmatch | all>]

  • match (this one's the default, so if you don't say anything else it's what you get 💅) <xx=filename> <xx=filename> ... — shows you only the matched results of the Ekeying match, whether it's between an On-Carrier device and an AMC module, or between 2 AMC modules. Like, the "y'all actually line up" report ✨

Example, because a picture is worth a thousand words:

 > ipmitool ekanalyzer summary match oc=fru b1=amcB1 a2=amcA2
  On-Carrier Device vs AMC slot B1
   AMC slot B1 port 0 ==> On-Carrier Device 0 port 16
    Matching Result
    - From On-Carrier Device ID 0
     -Channel ID 11 || Lane 0: enable
     -Link Type: AMC.2 Ethernet
     -Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link
     -Link Group ID: 0 || Link Asym. Match: exact match
    - To AMC slot B1
     -Channel ID 0 || Lane 0: enable
     -Link Type: AMC.2 Ethernet
     -Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link
     -Link Group ID: 0 || Link Asym. Match: exact match
    *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
   AMC slot B1 port 1 ==> On-Carrier Device 0 port 12
    Matching Result
    - From On-Carrier Device ID 0
     -Channel ID 6 || Lane 0: enable
     -Link Type: AMC.2 Ethernet
     -Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link
     -Link Group ID: 0 || Link Asym. Match: exact match
    - To AMC slot B1
     -Channel ID 1 || Lane 0: enable
     -Link Type: AMC.2 Ethernet
     -Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link
     -Link Group ID: 0 || Link Asym. Match: exact match
    *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
  On-Carrier Device vs AMC slot A2
   AMC slot A2 port 0 ==> On-Carrier Device 0 port 3
    Matching Result
    - From On-Carrier Device ID 0
     -Channel ID 9 || Lane 0: enable
     -Link Type: AMC.2 Ethernet
     -Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link
     -Link Group ID: 0 || Link Asym. Match: exact match
    - To AMC slot A2
     -Channel ID 0 || Lane 0: enable
     -Link Type: AMC.2 Ethernet
     -Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link
     -Link Group ID: 0 || Link Asym. Match: exact match
    *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
  AMC slot B1 vs AMC slot A2
   AMC slot A2 port 2 ==> AMC slot B1 port 2
    Matching Result
    - From AMC slot B1
     -Channel ID 2 || Lane 0: enable
     -Link Type: AMC.3 Storage
     -Link Type extension: Serial Attached SCSI (SAS/SATA)
     -Link Group ID: 0 || Link Asym. Match: FC or SAS interface {exact match}
    - To AMC slot A2
     -Channel ID 2 || Lane 0: enable
     -Link Type: AMC.3 Storage
     -Link Type extension: Serial Attached SCSI (SAS/SATA)
     -Link Group ID: 0 || Link Asym. Match: FC or SAS interface {exact match}
  *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
  • unmatch <xx=filename> <xx=filename> ... — the opposite vibe 🫶 shows you the unmatched results of the Ekeying match, again between an On-Carrier device and an AMC module, or between 2 AMC modules. It's giving "these two are not seeing each other".
  • all <xx=filename> <xx=filename> ... — the whole story, bestie: displays both the matched results and the unmatched results of the Ekeying match between two cards or two modules 🔥

🎀 event 🎀

<predefined event number N> 🌸

Sends a pre-defined test event into the System Event Log. The events below are there as a way to test that the System Event Log component of the BMC is actually, like, functioning (an entry gets added every single time the event N command runs 👑).

Currently supported values for N are:

  • 1 — Temperature: Upper Critical: Going High
  • 2 — Voltage Threshold: Lower Critical: Going Low
  • 3 — Memory: Correctable ECC
NOTE: these pre-defined events will likely not produce "accurate" SEL records for a particular system, because they aren't correctly tied to a valid sensor number — but they're still plenty to verify correct operation of the SEL. So don't come for them 😭

file <filename> 🦋

Event log records specified in <filename> will be added to the System Event Log.

The format of each line in the file is as follows:

<{EvM Revision} {Sensor Type} {Sensor Num} {Event Dir/Type} {Event Data 0} {Event Data 1} {Event Data 2}>[# COMMENT]

e.g.:

0x4 0x2 0x60 0x1 0x52 0x0 0x0 # Voltage threshold: Lower Critical: Going Low

Field-by-field, because ikyk y'all want the deets:

  • EvM Revision — the "Event Message Revision" is 0x04 for messages that comply with the IPMI 2.0 Specification and 0x03 for messages that comply with the IPMI 1.0 Specification.
  • Sensor Type — tells you the Event Type or Class.
  • Sensor Num — represents the 'sensor' within the management controller that generated the Event Message.
  • Event Dir/Type — this field is encoded with the event direction as the high bit (bit 7) and the event type as the low 7 bits. Event direction is 0 for an assertion event and 1 for a deassertion event.

See the IPMI 2.0 specification for further details on the definitions for each field 📚

<sensorid> <list> ✨

Gets you a list of all the possible Sensor States and the pre-defined Sensor State Shortcuts available for a particular sensor. sensorid is the character string representation of the sensor, and it must be enclosed in double quotes if it includes white space. Several different commands, including ipmitool sensor list, can be used to obtain a list that includes the sensorid strings representing the sensors on a given system 🫶

> ipmitool -I open event "PS 2T Fan Fault" list
Finding sensor PS 2T Fan Fault... ok
Sensor States:
  State Deasserted
  State Asserted
Sensor State Shortcuts:
  present    absent
  assert     deassert
  limit      nolimit
  fail       nofail
  yes        no
  on         off
  up         down

<sensorid> <sensor state> [<direction>] 💜

Generates a custom event based on existing sensor info. That optional event direction can be either assert (the default, if you don't say anything) or deassert.

> ipmitool event "PS 2T Fan Fault" "State Asserted"
Finding sensor PS 2T Fan Fault... ok
   0 | Pre-Init Time-stamp   | Fan PS 2T Fan Fault | State Asserted
> ipmitool event "PS 2T Fan Fault" "State Deasserted"
Finding sensor PS 2T Fan Fault... ok
   0 | Pre-Init Time-stamp   | Fan PS 2T Fan Fault | State Desserted

(yes, Desserted is literally what it prints — no cap, that's the output, we don't fix it 🍓)

🌈 exec 🌈

exec <filename> — runs ipmitool commands straight out of filename. Each line is a complete command, and the syntax of those commands is defined by the COMMANDS section in this manpage. Every line may have an optional comment at the end of the line, delimited with a # symbol 💅

e.g., a command file with two lines:

sdr list # get a list of sdr records
sel list # get a list of sel records

🔥 firewall 🔥

This command supports the Firmware Firewall capability. Use it to add or remove security-based restrictions on certain commands/command sub-functions, or to list the current firmware firewall restrictions set on any commands. For each firmware firewall command listed below, parameters may be included to make the command execute with increasing granularity — on a specific LUN, for a specific NetFn, for a specific IPMI Command, and finally for a specific command's sub-function (peep Appendix H in the IPMI 2.0 Specification for a listing of any sub-function numbers that may be associated with a particular command 👑).

Parameter syntax and dependencies are as follows:

[<channel H>] [<lun L> [ <netfn N> [<command C [<subfn S>]]]]
Heads up bestie: if netfn <N> is specified, then lun <L> must also be specified; if command <C> is specified, then netfn <N> (and therefore lun <L>) must also be specified, and so forth. The nesting is real 😭

channel <H> is an optional and standalone parameter. If you don't specify it, the requested operation happens on the current channel. Note that command support may vary from channel to channel — it's giving "every channel's got its own personality" 🙈

Firmware firewall commands:

info [<Parms as described above>] ⭐

Lists firmware firewall information for the specified LUN, NetFn, and Command (if supplied) on the current or specified channel. The listed information includes the support, configurable, and enabled bits for the specified command or commands 💖

Some usage examples:

  • info [<channel H>] [<lun L>] — this one lists firmware firewall info for all NetFns for the specified LUN on either the current channel or the channel you specify. 💅
  • info [<channel H>] [<lun L> [ <netfn N> ] — this prints out all command information for a single LUN/NetFn pair.
  • info [<channel H>] [<lun L> [ <netfn N> [<command C] ]] — this prints detailed, human-readable info showing the support, configurable, and enabled bits for the specified command on the specified LUN/NetFn pair. Info gets printed about each of the command subfunctions. ✨
  • info [<channel H>] [<lun L> [ <netfn N> [<command C [<subfn S>]]]] — print out information for a specific sub-function.
  • enable [<Parms as described above>] — enables commands for a given NetFn/LUN combination on the specified channel.
  • disable [<Parms as described above>] [force] — disables commands for a given NetFn/LUN combination on the specified channel. Great care should be taken if using the force option so as not to disable the Set Command Enables command. 😭
  • reset [<Parms as described above>] — resets the firmware firewall back to a state where all commands and command sub-functions are enabled. 🫶

🍓 fru — Field Replaceable Unit era

  • print — read all Field Replaceable Unit (FRU) inventory data and extract stuff like serial number, part number, asset tags, and short strings describing the chassis, board, or product.
  • read <fru id> <fru file> — fru id is the digit ID of the FRU (see output of fru print). fru file is the absolute pathname of a file to dump the binary FRU data pertaining to the specified FRU entity into.
  • write <fru id> <fru file> — fru id is the digit ID of the FRU (see output of fru print). fru file is the absolute pathname of a file to pull the binary FRU data from before uploading it to the specified FRU.
  • upgEkey <fru id> <fru file> — update a multirecord FRU location. fru id is the digit ID of the FRU (see output of fru print). fru file is the absolute pathname of a file to pull the binary FRU data from to upload into the specified multirecord FRU entity.
  • edit <fru id> — provides interactive editing of some supported records, namely PICMG Carrier Activation Record. fru id is the digit ID of the FRU (see output of fru print); default is 0.
  • edit <fru id> field <section> <index> <string> — sets a field string to a new value. It replaces the FRU data found at index in the specified section with the supplied string.

fru id is the digit ID of the FRU (see output of fru print).

<section> is a string which refers to FRU Inventory Information Storage Areas and may refer to:

  • c — FRU Inventory Chassis Info Area
  • b — FRU Inventory Board Info Area
  • p — FRU Inventory Product Info Area

<index> specifies the field number. Field numbering starts on the first 'english text' field type. For instance in the <board> info area field 0 is <Board Manufacturer> and field 2 is <Board Serial Number>; see IPMI Platform Management FRU Information Storage Definition v1.0 R1.1 for field locations.

<string> must be the same length as the string being replaced and must be 8-bit ASCII (0xCx).

  • edit <fru id> oem iana <record> <format> [<args>] — edits the data found in the multirecord area. Support for OEM specific records is limited.

🧚 fwum — Kontron OEM firmware update manager

Update IPMC using Kontron OEM Firmware Update Manager. 💜

  • info — show information about current firmware.
  • status — show status of each firmware bank present in the hardware.
  • download <filename> — download specified firmware.
  • upgrade [filename] — install firmware upgrade. If the filename is specified, the file is downloaded first, otherwise the last firmware downloaded is used.
  • rollback — ask IPMC to rollback to previous version.
  • tracelog — show firmware upgrade log.

🦋 gendev — generic device locators

  • list — list all Generic Device Locators.
  • read <sdr name> <file> — read to a file the eeprom specified by Generic Device Locators.
  • write <sdr name> <file> — write from a file to the eeprom specified by Generic Device Locators.

👑 hpm — PICMG HPM.1 Upgrade Agent

  • check — check the target information.
  • check <filename> — display both the existing target version and image version on the screen.
  • download <filename> — download specified firmware.
  • upgrade <filename> [all] [component <x>] [activate] — upgrade the firmware using a valid HPM.1 image file. If no option is specified, the firmware versions are checked first and the firmware is upgraded only if they are different.
    • all — upgrade all components even if the firmware versions are the same (use this only after using check command).
    • component <x> — upgrade only the given component from the given file.
      • component 0 — BOOT
      • component 1 — RTK
    • activate — activate new firmware right away.
  • activate — activate the newly uploaded firmware.
  • targetcap — get the target upgrade capabilities.
  • compprop <id> <select> — get the specified component properties. Valid component id: 0-7. select can be one of the following:
    • 0 — General properties
    • 1 — Current firmware version
    • 2 — Description string
    • 3 — Rollback firmware version
    • 4 — Deferred firmware version
  • abort — abort the on-going firmware upgrade.
  • upgstatus — show status of the last long duration command.
  • rollback — perform manual rollback on the IPM Controller firmware.
  • rollbackstatus — show the rollback status.
  • selftestresult — query the self test results.

🌈 i2c <i2caddr> <read bytes> [<write data>]

This command may be used to execute raw I2C commands with the Master Write-Read IPMI command. ⚡

🎀 ime — Manageability Engine

  • help — print usage information.
  • info — displays information about the Manageability Engine (ME).
  • update <file> — upgrade the ME firmware with the specified image file. WARNING: You MUST use a supported image provided by your board vendor. 💀
  • rollback — perform manual rollback of the ME firmware.

🌸 isol — Intel IPMI v1.5 Serial-over-LAN

  • info — retrieve information about the Intel IPMI v1.5 Serial-Over-LAN configuration.
  • set <parameter> <value> — configure parameters for Intel IPMI v1.5 Serial-over-LAN. Valid parameters and values are:
    • enabled — true, false.
    • privilege-level — user, operator, admin, oem.
    • bit-rate — 9.6, 19.2, 38.4, 57.6, 115.2.
  • activate — causes ipmitool to enter Intel IPMI v1.5 Serial Over LAN mode. An RMCP+ connection is made to the BMC, the terminal is set to raw mode, and user input is sent to the serial console on the remote server. On exit, the SOL payload mode is deactivated and the terminal is reset to its original settings.

Special escape sequences are provided to control the SOL session:

  • ~. — terminate connection
  • ~^Z — suspend ipmitool
  • ~^X — suspend ipmitool, but don't restore tty on restart
  • ~B — send break
  • ~~ — send the escape character by typing it twice
  • ~? — print the supported escape sequences
Note that escapes are only recognized immediately after newline. 🫶

⭐ kontronoem — OEM commands specific to Kontron devices

  • setsn — set FRU serial number.
  • setmfgdate — set FRU manufacturing date.
  • nextboot <boot device> — select the next boot order on the Kontron CP6012.

💖 lan — LAN channel configuration

These commands will allow you to configure IPMI LAN channels with network information so they can be used with the lan and lanplus interfaces.

NOTE: To determine on which channel the LAN interface is located, issue the channel info number command until you come across a valid 802.3 LAN channel. For example:
> ipmitool -I open channel info 1
Channel 0x1 info:
  Channel Medium Type   : 802.3 LAN
  Channel Protocol Type : IPMB-1.0
  Session Support       : session-based
  Active Session Count  : 8
  Protocol Vendor ID    : 7154
  • print [<channel>]

Print the current config for the channel you point at — and if you just don't specify one, it'll slide into the first LAN channel it finds and print that. Comfy default, tbh.

🛠️ set <channel number> <command> <parameter>

Okay so this one sets the command and parameter on the channel you name. Valid command/parameter combos, bestie, are these:

  • ipaddr <x.x.x.x> — sets the IP address for this channel. literally the main character of network config.
  • netmask <x.x.x.x> — sets the netmask for this channel.
  • macaddr <xx:xx:xx:xx:xx:xx> — sets the MAC address for this channel.
  • defgw ipaddr <x.x.x.x> — sets the default gateway IP address.
  • defgw macaddr <xx:xx:xx:xx:xx:xx> — sets the default gateway MAC address.
  • bakgw ipaddr <x.x.x.x> — sets the backup gateway IP address. the understudy gateway 🎭
  • bakgw macaddr <xx:xx:xx:xx:xx:xx> — sets the backup gateway MAC address.
  • password <pass> — sets the null user password.
  • snmp <community string> — sets the SNMP community string.
  • user — enables user access mode for userid 1 (go issue the user command to display info about userids for a given channel, iykyk).
  • access <on|off> — sets the LAN channel access mode.
  • alert <on|off> — enables or disables PEF alerting for this channel.
  • ipsrc <source> — sets the IP address source. the options are:
    • none — unspecified
    • static — manually configured static IP address
    • dhcp — address obtained by BMC running DHCP
    • bios — address loaded by BIOS or system software
  • arp respond <on|off> — sets BMC generated ARP responses.
  • arp generate <on|off> — sets BMC generated gratuitous ARPs.
  • arp interval <seconds> — sets the BMC generated gratuitous ARP interval.
  • vlan id <off|id> — disables VLAN operation, or enables VLAN and sets the ID. the ID is the value of the virtual lan identifier between 1 and 4094 inclusive. 🦋
  • vlan priority <priority> — sets the priority associated with VLAN frames. ID: priority of the virtual lan frames between 0 and 7 inclusive.
  • auth <level,...> <type,...> — sets the valid authtypes for a given auth level.
    • Levels: callback, user, operator, admin
    • Types: none, md2, md5, password, oem
  • cipher_privs <privlist> — correlates cipher suite numbers with the maximum privilege level allowed to use it. so basically you can restrict cipher suites to users with a given privilege level — meaning, for example, admins are required to use a stronger cipher suite than normal users. gatekeeping, but make it security 💅

The format of privlist is as follows: each character represents a privilege level, and the character position identifies the cipher suite number. So like, the first character represents cipher suite 0, the second represents cipher suite 1, and so on. privlist must be 15 characters long. no more, no less.

Characters used in privlist and their associated privilege levels:

  • X — Cipher Suite Unused
  • c — CALLBACK
  • u — USER
  • o — OPERATOR
  • a — ADMIN
  • O — OEM

So, to set the maximum privilege for cipher suite 0 to USER and suite 1 to ADMIN, you'd issue this:

> ipmitool -I interface lan set channel cipher_privs uaXXXXXXXXXXXXX
  • bad_pass_thresh <thresh_num> <1|0> <reset_interval> <lockout_interval> — sets the Bad Password Threshold. the deets:
    • <thresh_num> — if non-zero, this value determines the number of sequential bad passwords that will be allowed to be entered for the identified user before the user is automatically disabled from access on the channel.
    • <1|0> — 1 = generate a Session Audit sensor "Invalid password disable" event message. 0 = do not generate an event message when the user is disabled.
    • <reset_interval> — Attempt Count Reset Interval. the interval, in tens of seconds, for which the accumulated count of bad password attempts is retained before being automatically reset to zero.
    • <lockout_interval> — User Lockout Interval. the interval, in tens of seconds, that the user will remain disabled after being disabled because the Bad Password Threshold number was reached. 💀

🚨 alert print [<channel>] [<alert destination>]

Prints alert info for the specified channel and destination. default behavior prints all alerts for all alert destinations on the first found LAN channel. the full scroll, bestie.

🚨 alert set <channel number> <alert destination> <command> <parameter>

Sets an alert on the given LAN channel and destination. you can see your Alert Destinations via the lan alert print command. valid command/parameter options:

  • ipaddr <x.x.x.x> — sets alert IP address.
  • macaddr <xx:xx:xx:xx:xx:xx> — sets alert MAC address.
  • gateway <default | backup> — sets the channel gateway to use for alerts.
  • ack <on | off> — turns Alert Acknowledge on or off.
  • type <pet | oem1 | oem2> — sets the destination type as PET or OEM.
  • time <seconds> — sets ack timeout or unack retry interval.
  • retry <number> — sets the number of alert retries.

📊 stats get [<channel number>]

Pulls info about the IP connections on the specified channel. default grabs statistics on the first found LAN channel. numbers go brrr 📈

🧹 stats clear [<channel number>]

Clears all IP/UDP/RMCP Statistics to 0 on the specified channel. default clears statistics on the first found LAN channel. fresh start energy ✨

💻 mc | bmc

🔄 reset <warm|cold>

Instructs the BMC to perform a warm or cold reset. pick your temperature, bestie 🌡️

🆔 guid [smbios|rfc4122|ipmi|dump]

Displays the Management Controller Globally Unique IDentifier. the whole encoding situation is a saga, so buckle up:

  • auto — this is the default behavior for ipmitool(1).

It tries to automatically detect the encoding based on the value of the version field and (for version 1) the timestamp. The version is considered valid if it is 1 through 5, and the timestamp is valid if the year is past or equal to UNIX Epoch (1970) and is before or equal to the current year.

If multiple encodings happen to have valid version fields, then precedence takes the one with version 1 and a valid timestamp. If neither one has that, then the precedence order is as follows: smbios, ipmi, rfc4122.

If neither encoding yields a valid version field, then ipmitool(1) defaults to dump mode.

If this option is in use, then ipmitool(1) will also print out the detected encoding and warn regarding IPMI specification violation if the encoding isn't ipmi. consider it a little heads up 🫶

  • smbios — decodes the GUID as if it was sent by the BMC as prescribed by the SMBIOS specification.
NOTE: this is a violation of the IPMI specification, but many BMC implementations do it this way. If your BMC's GUID is shown correctly using this option, you may want to inform your BMC manufacturer that they have a bug. drag them, respectfully 🙈
  • ipmi — decodes the GUID according to the IPMI specification. It MUST show the correct GUID. If it doesn't, try other options and inform your BMC manufacturer of the bug.
  • rfc4122 or rfc — decodes the GUID as if it was sent by the BMC as prescribed by the RFC4122 specification.
NOTE: this is a violation of the IPMI specification. If your BMC's GUID is shown correctly using this option, you may want to inform your BMC manufacturer that they have a bug.
  • dump — dumps as hex the data received from BMC in response to the Get Device GUID command. No decoding or interpretation is performed. First received byte is dumped first. raw and unfiltered, no cap 🔥

ℹ️ info

Displays info about the BMC hardware — including device revision, firmware revision, IPMI version supported, manufacturer ID, and info on additional device support. the whole résumé 👑

⏱️ watchdog

These commands let a user view and change the current state of the watchdog timer.

  • get
  • the display one — shows the current Watchdog Timer settings and the countdown state. both bestie, at once 🫶
  • reset — resets the Watchdog Timer to its most recent state and restarts that countdown timer. fresh start energy 🔄
  • off — turns off a Watchdog countdown timer that's currently running. bye 👋
  • selftest — checks on the basic health of the BMC by executing the Get Self Test results command and reports the results back to you. it's giving "vibe check, but for hardware" 🩺✨
  • getenables — displays a list of the options that are currently enabled on the BMC. 📋
  • setenables <option>=[on|off] — enables or disables the given option.
okay important 💅 per the IPMI specification, this command is only supported over the system interface. that's the spec talking, not me.

Currently supported values for option include:

  • recv_msg_intr — Receive Message Queue Interrupt
  • event_msg_intr — Event Message Buffer Full Interrupt
  • event_msg — Event Message Buffer
  • system_event_log — System Event Logging
  • oem0 — OEM-Defined option #0
  • oem1 — OEM-Defined option #1
  • oem2 — OEM-Defined option #2
  • getsysinfo <argument> — retrieves system info from the bmc for the given argument. for what the arguments actually are, go look at setsysinfo — the definitions live there, iykyk 🫡
  • setsysinfo <argument> <string> — stores a system info string to the bmc for the given argument. 🗄️

Possible arguments are:

  • primary_os_name — Primary Operating System Name
  • os_name — Operating System Name
  • system_name — System Name of Server
  • delloem_os_version — Running version of operating system
  • delloem_URL — URL of BMC Webserver

✨ chassis ✨

whole-chassis energy, the main character of the box 👑

  • status — displays information regarding the high-level status of the system chassis and the main power subsystem. 🎛️
  • poh — this command returns the Power-On Hours counter. like, how long has this thing been awake 😴⏰
  • identify <interval> — controls the front panel identify light. 💡 default interval is 15 seconds, use 0 to turn it off, and use "force" to turn it on indefinitely.
  • restart_cause — queries the chassis for the cause of the last system restart. detective mode 🕵️‍♀️
  • selftest — checks on the basic health of the BMC by executing the Get Self Test results command and reports the results. same vibe check, chassis edition 🩺
  • policy — sets the chassis power policy for the event of a power failure. ⚡
    • list — return supported policies.
    • always-on — turn on when power is restored.
    • previous — returned to previous state when power is restored.
    • always-off — stay off after power is restored.
  • power — performs a chassis control command to view and change the power state. 🔌
    • status — show current chassis power status.
    • on — power up chassis.
    • off — power down chassis into soft off (S4/S5 state).
⚠️ WARNING: this command does not initiate a clean shutdown of the operating system prior to powering down the system. fr fr, know what you're doing 😭
  • cycle — provides a power off interval of at least 1 second. no action should occur if chassis power is in S4/S5 state, but it is recommended to check the power state first and only issue a power cycle command if the system power is on, or in a lower sleep state than S4/S5.
  • reset — this command performs a hard reset. 🔨
  • diag — pulses a diagnostic interrupt (NMI) directly to the processor(s). unhinged but iconic 💀
  • soft — initiates a soft-shutdown of the OS via ACPI. this can be done in a number of ways, commonly by simulating an overtemperture or by simulating a power button press. it's necessary for there to be Operating System support for ACPI and some sort of daemon watching for events for this soft power to work. teamwork makes the dream work 🫶
  • bootdev <device> [<clear-cmos=yes|no>] [<options=help,...>] — requests the system to boot from an alternate boot device on the next reboot. the clear-cmos option, if supplied, instructs the BIOS to clear its CMOS on the next reboot. various options may be used to modify the boot device settings — run bootdev none options=help for a list of available boot device modifiers/options. 🥾

Currently supported values for <device> are:

  • none — do not change boot device
  • pxe — force PXE boot
  • disk — force boot from BIOS default boot device
  • safe — force boot from BIOS default boot device, request Safe Mode
  • diag — force boot from diagnostic partition
  • cdrom — force boot from CD/DVD
  • bios — force boot into BIOS setup
  • floppy — force boot from Floppy/primary removable media
  • bootparam — get or set various system boot option parameters. ⚙️
    • get <param #> — get boot parameter. currently supported values for <param #> are:
      • 0 — Set In Progress
      • 1 — Service Partition Selector
      • 2 — Service Partition Scan
      • 3 — BMC Boot Flag Valid Bit Clearing
      • 4 — Boot Info Acknowledge
      • 5 — Boot Flags
      • 6 — Boot Initiator Info
      • 7 — Boot Initiator Mailbox
    • set <device> [<options=help,...>] — set the boot device parameter used for the next boot. various options may be used to change when the next boot device is cleared. run options=help for a list of available bootparam set device options.

Currently supported bootparam device settings are:

  • force_pxe — force PXE boot
  • force_disk — force boot from default hard-drive
  • force_safe — force boot from default hard-drive, request Safe Mode
  • force_diag — force boot from diagnostic partition
  • force_cdrom — force boot from CD/DVD
  • force_bios — force boot into BIOS setup

Currently supported bootparam options settings are associated with BMC Boot Valid Bit Clearing, and they are as follows — and any option can be prefixed with "no-" to invert the sense of the operation. sneaky but valid 💅

  • PEF — clear valid bit on reset/power cycle caused by PEF
  • timeout — automatically clear boot flag valid bit if Chassis Control command is not received within 60 seconds
  • watchdog — clear valid bit on reset/power cycle caused by watchdog timeout
  • reset — clear valid bit on push button reset / soft-reset
  • power — clear valid bit on power up via power push button or wake event

🌈 nm 🌈

  • alert — the Node Manager alert vibes 🚨
    • clear dest <dest> — clear the Node Manager Alert lan destination.
    • get — get the Node Manager Alert settings.
    • set chan <chan> dest <dest> string <string> — set the Node Manager alert channel, lan destination, and alert string number.
  • capability — obtains the Node Manager power control capabilities and ranges. 📊
  • control — the on/off switch era 🎚️
    • enable|disable — pick your fighter
      • global — enable/disable all policies for all domains. go big or go home 👑

okay so we're still deep in Node Manager territory, and the enable|disable side of the group chat has exactly two moves. no cap, here they are:

  • per_domain <platform|CPU|Memory> — turns all the policies on or off for whichever domain you name. platform, CPU, or Memory, pick your fighter 💅
  • per_policy <0-7> — turns the policy on or off for one specific domain/policy combo. the number is 0-7, bestie, don't freestyle it.

🦋 discover

This one discovers Node Manager presence and spills the Node Manager version, revision, and patch number. presence check plus version tea ✨

💖 policy

  • add — okay so this has two flavors, and both can add a new policy or overwrite an existing one:
    • power <watts> policy_id <0-7> [correction auto|soft|hard] trig_lim <seconds> stats <seconds> [domain <platform|CPU|Memory>] enable|disable — adds a power policy. correction controls how aggressive the frequency limiting is, and the default is auto. trig_lim is the correction time limit and has to be at least 6000 and not greater than 65535. stats is the averaging period in seconds, ranges from 1-65535. no domain? it defaults to platform. power policy slay 🔥
    • inlet <temp> policy_id <0-7> [correction auto|soft|hard] trig_lim <seconds> stats <seconds> [domain <platform|CPU|Memory>] enable|disable — adds an inlet temp policy. same correction default auto, same trig_lim range 6000 to 65535, same stats range 1-65535, same domain default platform. temperature policy, but make it cute 🌡️
  • get policy_id <0-7> — grabs a policy that's already stored. retrieval era
  • limiting — reports the policy number if any policy is currently limiting power. snitch on the limiting policy 👀
  • remove policy_id <0-7> [domain <platform|CPU|Memory>] — deletes a policy. no domain? defaults to platform.

⚡ power

  • power min <minimum> max <maximum> [domain <platform|CPU|Memory>] — configures Node Manager power minimum and maximum power draw limits. min and max must be in the range 0-65535. no domain? defaults to platform. set the floor and the ceiling 🏗️

🌈 reset

  • comm policy_id <0-7> [domain <platform|CPU|Memory>] — resets Node Manager communication statistics. no domain? defaults to platform.
  • global — resets Node Manager global statistics. big reset energy
  • memory policy_id <0-7> [domain <platform|CPU|Memory>] — resets Node Manager memory throttling statistics. no domain? defaults to platform.
  • per_policy policy_id <0-7> [domain <platform|CPU|Memory>] — resets Node Manager per policy statistics. no domain? defaults to platform.
  • requests policy_id <0-7> [domain <platform|CPU|Memory>] — resets Node Manager unhandled requests statistics. no domain? defaults to platform.
  • response policy_id <0-7> [domain <platform|CPU|Memory>] — resets Node Manager response time statistics. no domain? defaults to platform.
  • throttling policy_id <0-7> [domain <platform|CPU|Memory>] — resets Node Manager throttling statistics. no domain? defaults to platform.

🍓 statistics

  • comm_fail — reports Node Manager communication failure statistics. the "oops" report 😭
  • cpu_throttling — reports Node Manager cpu throttling statistics.
  • mem_throttling — reports Node Manager memory throttling statistics.
  • policy_power policy_id <0-7> [domain <platform|CPU|Memory>] — reports Node Manager per policy power statistics (policy must be a power limit type policy). no domain? defaults to platform.
  • policy_temps policy_id <0-7> [domain <platform|CPU|Memory>] — reports Node Manager per policy temp statistics (policy must be an inlet temp limit policy). no domain? defaults to platform.
  • policy_throt policy_id <0-7> [domain <platform|CPU|Memory>] — reports Node Manager per policy throttling statistics. no domain? defaults to platform.
  • requests — reports Node Manager unhandled requests statistics.
  • response — reports Node Manager response time statistics.

🧚 suspend

  • get policy_id <0-7> [domain <platform|CPU|Memory>] — gets Node Manager policy suspend periods. no domain? defaults to platform.
  • set policy_id <0-7> [domain <platform|CPU|Memory>] <start> <stop> <repeat> — sets Node Manager policy suspend periods. no domain? defaults to platform. <start> and <stop> have to be in the range 0-239, which is the number of minutes past midnight divided by 6. <repeat> is the daily recurrence pattern: bit 0 is repeat every Monday, bit 1 is repeat every Tuesday, on through bit 6 for Sunday. calendar girl math 🗓️

👑 threshold

  • get policy_id <0-7> [domain <platform|CPU|Memory>] — gets Node Manager policy Alert Threshold settings. no domain? defaults to platform.
  • set policy_id <0-7> [domain <platform|CPU|Memory>] thresh_array — sets Node Manager policy Alert Threshold values. no domain? defaults to platform. the thresh_array is 1, 2, or 3 integers that set three alert threshold settings. the setting type is a power or temperature value, and it must match the type of policy. matching energy only 💅

🌸 pef

  • info — queries the BMC and prints information about the PEF supported features.
  • status — prints the current PEF status (the last SEL entry processed by the BMC, etc). status check
  • policy — lists the PEF policy table entries. each policy entry describes an alert destination. a policy set is a collection of table entries. PEF alert actions reference policy sets.
  • list — lists the PEF table entries. each PEF entry relates a sensor event to an action. when PEF is active, each platform event causes the BMC to scan this table for entries matching the event, and possible actions to be taken. actions are performed in priority order (higher criticality first). priority order, periodt 🔥

🔧 picmg <properties>

runs a PICMG/ATA extended command. Get PICMG properties may be used to obtain and print Extension major version information, PICMG identifier, FRU Device ID and Max FRU Device ID. PICMG lore unlocked 🧚

  • addrinfo — gets address information. this command may return information on the Hardware address, IPMB-0 Address, FRU ID, Site/Entity ID, and Site/Entity Type. address reveal
  • frucontrol <fru id> <options> — sets various control options:
    • 0x00 — Cold Reset
    • 0x01 — Warm Reset
    • 0x02 — Graceful Reboot
    • 0x03 — Issue Diagnostic Interrupt
    • 0x04 — Quiesce [AMC only]
    • 0x05-0xFF — Cold Reset
  • activate <fru id> — activates the specified FRU. wake it up ✨
  • deactivate <fru id> — deactivates the specified FRU.
  • policy get <fru id> — gets FRU activation policy.
  • policy set <fru id> <lockmask> <lock> — sets FRU activation policy. lockmask is 1 or 0 to indicate action on the deactivation or activation locked bit respectively. lock is 1 or 0 to set/clear locked bit.
  • portstate set|getall|getgranted|getdenied <parameters> — gets or sets various port states. see usage for parameter details. parameter details live in usage, bestie

⚡ power <chassis power command>

shortcut to the chassis power commands. see the chassis power commands for usage information. shortcut szn

🪄 raw <netfn> <cmd> [<data>]

this lets you execute raw IPMI commands. for example, to query the POH counter with a raw command:

> ipmitool -v raw 0x0 0xf
RAW REQ (netfn=0x0 cmd=0xf data_len=0)
RAW RSP (5 bytes)
3c 72 0c 00 00
note: the OpenIPMI driver provided by the Linux kernel will reject the Get Message, Send Message and Read Event Message Buffer commands because it handles the message sequencing internally. do not fight the driver, bestie 💀

🌈 sdr

  • get <id> ... [<id>] — prints information for sensor data records specified by sensor id. sensor tea, served fresh 🍓

info

Okay so this command will query the BMC for Sensor Data Record (SDR) Repository information. slay, now we know what the SDR repo is up to.

  • type [<sensor type>] — This command will display all records from the SDR Repository of a specific type. Run with type list (or simply with no type) to see the list of available types. For example to query for all Temperature sensors:
> ipmitool sdr type Temperature
Baseboard Temp   | 30h | ok  |  7.1 | 28 degrees C
FntPnl Amb Temp  | 32h | ok  | 12.1 | 24 degrees C
Processor1 Temp  | 98h | ok  |  3.1 | 57 degrees C
Processor2 Temp  | 99h | ok  |  3.2 | 53 degrees C
  • list | elist [<all|full|compact|event|mcloc|fru|generic>] — This command will read the Sensor Data Records (SDR) and extract sensor information of a given type, then query each sensor and print its name, reading, and status. If invoked as elist then it will also print sensor number, entity id and instance, and asserted discrete states.

The default output will only display full and compact sensor types, to see all sensors use the all type with this command.

Valid types are:

  • all — All SDR records (Sensor and Locator)
  • full — Full Sensor Record
  • compact — Compact Sensor Record
  • event — Event-Only Sensor Record
  • mcloc — Management Controller Locator Record
  • fru — FRU Locator Record
  • generic — Generic SDR records
  • entity <id>[.<instance>] — Displays all sensors associated with an entity. Get a list of valid entity ids on the target system by issuing the sdr elist command. A list of all entity ids can be found in the IPMI specifications. iykyk ✨
  • dump <file> — Dumps raw SDR data to a file. This data file can then be used as a local SDR cache of the remote managed system with the -S <file> option on the ipmitool command line. This can greatly improve performance over system interface or remote LAN. obsessed with a good cache glow-up 💅
  • fill sensors — Create the SDR Repository for the current configuration. Will perform a 'Clear SDR Repository' command so be careful.
⚠️ Bestie, for real: fill sensors will perform a 'Clear SDR Repository' command, so be careful.
  • fill file <filename> — Fill the SDR Repository using records stored in a binary data file. Will perform a 'Clear SDR Repository' command so be careful.
⚠️ Same warning energy: fill file <filename> will perform a 'Clear SDR Repository' command, so be careful.

sel 🧾

⚠️ NOTE: System Event Log (SEL) entry-times are displayed as Pre-Init Time-stamp if the SEL clock needs to be set. Ensure that the SEL clock is accurate by invoking the sel time get and sel time set <time string> commands.
  • info — This command will query the BMC for information about the System Event Log (SEL) and its contents.
  • clear — This command will clear the contents of the SEL. It cannot be undone so be careful. no cap, this is the point of no return 😭
  • list | elist — When this command is invoked without arguments, the entire contents of the System Event Log are displayed. If invoked as elist (extended list) it will also use the Sensor Data Record entries to display the sensor ID for the sensor that caused each event. Note this can take a long time over the system interface.
    • <count> | first <count> — Displays the first count (least-recent) entries in the SEL. If count is zero, all entries are displayed.
    • last <count> — Displays the last count (most-recent) entries in the SEL. If count is zero, all entries are displayed.
  • delete <SEL Record ID> ... <SEL Record ID> — Delete one or more SEL event records. bye bye, little records 🦋
  • add <filename ID> — Read event entries from a file and add them to the SEL. New SEL entries are added onto the SEL after the last record in the SEL. Record added is of type 2 and is automatically timestamped.
  • get <SEL Record ID> — Print information on the specified SEL Record entry.
  • save <file> — Save SEL records to a text file that can be fed back into the event file ipmitool command. This can be useful for testing Event generation by building an appropriate Platform Event Message file based on existing events. Please see the available help for the 'event file ...' command for a description of the format of this file.
  • writeraw <file> — Save SEL records to a file in raw, binary format. This file can be fed back to the sel readraw ipmitool command for viewing.
  • readraw <file> — Read and display SEL records from a binary file. Such a file can be created using the sel writeraw ipmitool command.
  • time — SEL clock time stuff, because timestamps need to be cute and accurate ⏰
    • get — Displays the SEL clock's current time.
    • set <time string> — Sets the SEL clock. Future SEL entries will use the time set by this command. <time string> is of the form "MM/DD/YYYY HH:MM:SS". Note that hours are in 24-hour form. It is recommended that the SEL be cleared before setting the time.

sensor 🌡️

  • list — Lists sensors and thresholds in a wide table format.
  • get <id> ... [<id>] — Prints information for sensors specified by name.
  • thresh <id> <threshold> <setting> — This allows you to set a particular sensor threshold value. The sensor is specified by name.

Valid thresholds are:

  • unr — Upper Non-Recoverable
  • ucr — Upper Critical
  • unc — Upper Non-Critical
  • lnc — Lower Non-Critical
  • lcr — Lower Critical
  • lnr — Lower Non-Recoverable
  • thresh <id> lower <lnr> <lcr> <lnc> — This allows you to set all lower thresholds for a sensor at the same time. The sensor is specified by name and the thresholds are listed in order of Lower Non-Recoverable, Lower Critical, and Lower Non-Critical.
  • thresh <id> upper <unc> <ucr> <unr> — This allows you to set all upper thresholds for a sensor at the same time. The sensor is specified by name and the thresholds are listed in order of Upper Non-Critical, Upper Critical, and Upper Non-Recoverable.

session 👥

  • info <active|all|id 0xnnnnnnnn|handle 0xnn> — Get information about the specified session(s). You may identify sessions by their id, by their handle number, by their active status, or by using the keyword all to specify all sessions.

set ⚙️

  • hostname <host> — Session hostname.
  • username <user> — Session username.
  • password <pass> — Session password.
  • privlvl <level> — Session privilege level force.
  • authtype <type> — Authentication type force.
  • localaddr <addr> — Local IPMB address.
  • targetaddr <addr> — Remote target IPMB address.
  • port <port> — Remote RMCP port.
  • csv [level] — Enable output in comma separated format. Affects following commands: user, channel, isol, sunoem, sol, sensor, sdr, sel, session. spreadsheet era 📊
  • verbose [verbose] — Verbosity level.

shell 🐚

This command will launch an interactive shell which you can use to send multiple ipmitool commands to a BMC and see the responses. This can be useful instead of running the full ipmitool command each time. Some commands will make use of a Sensor Data Record cache and you will see marked improvement in speed if these commands are able to reuse the same cache in a shell session. LAN sessions will send a periodic keepalive command to keep the IPMI session from timing out. main character shell energy ✨

sol 🌐

  • info [<channel number>] — Retrieve information about the Serial-Over-LAN configuration on the specified channel. If no channel is given, it will display SOL configuration data for the currently used channel.
  • payload <enable | disable | status> <channel number> <userid> — Enable, disable or show status of SOL payload for the user on the specified channel.
  • set <parameter> <value> [<channel>] — Configure parameters for Serial Over Lan. If no channel is given, it will display SOL configuration data for the currently used channel. Configuration parameter updates are automatically guarded with the updates to the set-in-progress parameter.

Valid parameters and values are:

  • set-in-progress — set-complete set-in-progress commit-write
  • enabled — true false
  • force-encryption — true false
  • force-authentication — true false
  • privilege-level — user operator admin oem
  • character-accumulate-level — Decimal number given in 5 milliseconds increments
  • character-send-threshold — Decimal number
  • retry-count — Decimal number. 0 indicates no retries after packet is transmitted.
  • retry-interval — a decimal number, counted in 10 millisecond increments. Set it to 0 and the retries get fired back to back with zero breathing room. 💨
  • non-volatile-bit-rate — your options are serial, 19.2, 38.4, 57.6, 115.2. If you set it to serial, that means the BMC should use the setting used by the IPMI over serial channel. iykyk ✨
  • volatile-bit-rate — same menu, bestie: serial, 19.2, 38.4, 57.6, 115.2. Set it to serial and the BMC should use the setting used by the IPMI over serial channel. 🎀

activate [usesolkeepalive | nokeepalive] [instance=<number>]

This is the moment ipmitool slides into Serial Over LAN mode, and it's only available when you're using the lanplus interface — no substitutions, okay? 💅 An RMCP+ connection gets made to the BMC, your terminal gets flipped into raw mode, and everything you type gets yeeted straight to the serial console on the remote server. On exit, the SOL payload mode is deactivated and the terminal is reset to its original settings. Iconic behavior, honestly.

If you hand it an instance, it activates using that instance number. Default is 1.

Special escape sequences exist to control the SOL session, and they are:

  • ~. — terminate the connection
  • ~^Z — suspend ipmitool
  • ~^X — suspend ipmitool, but don't restore the tty on restart
  • ~B — send break
  • ~~ — send the escape character by typing it twice
  • ~? — print the supported escape sequences
Heads up bestie: escapes are only recognized immediately after a newline. So don't be out here mashing tildes mid-line and wondering why nothing happens 😭

deactivate [instance=<number>]

Deactivates Serial Over LAN mode on the BMC. Normally, exiting Serial Over LAN mode should automatically cause this command to be sent to the BMC — but if you had an unintentional exit from SOL mode, this command may be necessary to reset the state of the BMC. Basically it's the cleanup crew for when things got messy. 🧹

If you give it an instance, it deactivates that instance number. Default is 1.

🦋 spd

spd <i2cbus> <i2caddr> [<channel>] [<axread>]

This command may be used to read SPD (Serial Presence Detect) data using the I2C Master Write-Read IPMI command. Very demure, very mindful, very low-level. ✨

🌈 sunoem

Okay so sunoem has a whole little friend group of subcommands, let's meet them 👑

cli [<command string> ...]

Execute the service processor command line interface commands. With no command string at all, you get dropped into an interactive session inside the service processor command line environment — main character energy, you're literally inside the SP now. If you do specify a command string, that command string is executed on the service processor and the connection is closed. In and out. 🚪

led

These commands provide a way to get and set the status of LEDs on a Sun Microsystems server. Use sdr list generic to get a list of devices that are controllable LEDs. The ledtype parameter is optional and not necessary to provide on the command line unless it is required by hardware.

  • get <sensorid> [<ledtype>] — Get status of a particular LED described by a Generic Device Locator record in the SDR. A sensorid of all will get the status of all available LEDS. 👀
  • set <sensorid> <ledmode> [<ledtype>] — Set status of a particular LED described by a Generic Device Locator record in the SDR. A sensorid of all will set the status of all available LEDS to the specified ledmode and ledtype. 🎀

LED Mode is required for set operations:

  • OFF — Off
  • ON — Steady On
  • STANDBY — 100ms on 2900ms off blink rate
  • SLOW — 1HZ blink rate
  • FAST — 4HZ blink rate

LED Type is optional:

  • OK2RM — Ok to Remove
  • SERVICE — Service Required
  • ACT — Activity
  • LOCATE — Locate

nacname <ipmi name>

Return the full NAC name of a target identified by ipmi name. Short and sweet. 🍓

ping <count> [<q>]

Send and receive count packets. Each packet is 64 bytes.

q — Quiet. Displays output only at the start and end of the process. So you don't get spammed with packets, slay. 🔇

getval <property name>

Returns value of specified ILOM property. That's it, that's the whole thing. 💜

setval <property name> <property value> [<timeout>]

Sets value of ILOM property. If timeout is not specified, the default value is 5 seconds.

⚠️ NOTE: setval must be executed locally on host! Not remotely, not over the network, locally. Don't come crying to me when it doesn't work from your jump box 😭

sshkey

  • set <userid> <keyfile> — This command will allow you to specify an SSH key to use for a particular user on the Service Processor. This key will be used for CLI logins to the SP and not for IPMI sessions. View available users and their userids with the user list command. 🔑
  • del <userid> — This command will delete the SSH key for a specified userid. Bye bye key 💀

version

Display the version of ILOM firmware. Quick vibe check on the firmware. ⭐

getfile <file identifier> <destination file name>

This command will return various files from service processor and store them in specified destination file. Note that some files may not be present or be supported by your SP. 🙈

File identifiers:

SSH_PUBKEYS
DIAG_PASSED
DIAG_FAILED
DIAG_END_TIME
DIAG_INVENTORY
DIAG_TEST_LOG
DIAG_START_TIME
DIAG_UEFI_LOG
DIAG_TEST_LOG
DIAG_LAST_LOG
DIAG_LAST_CMD

(Yes, DIAG_TEST_LOG is listed twice in the source — not a typo on my end, bestie, don't @ me 💅)

getbehavior <feature identifier>

This command will test if various ILOM features are enabled.

Feature identifiers:

SUPPORTS_SIGNED_PACKAGES
REQUIRES_SIGNED_PACKAGES

🌸 tsol

This command allows Serial-over-LAN sessions to be established with Tyan IPMIv1.5 SMDC such as the M3289 or M3290. The default command run with no arguments will establish a default SOL session back to the local IP address. Optional arguments may be supplied in any order — chaotic but valid, we respect it 🫶

  • <ipaddr> — Send receiver IP address to SMDC, which it will use to send serial traffic to. By default this detects the local IP address and establishes a two-way session. Format of ipaddr is XX.XX.XX.XX.
  • port=NUM — Configure UDP port to receive serial traffic on. By default this is 6230.
  • ro|rw — Confiure SOL session as read-only or read-write. Sessions are read-write by default.

👑 user

The whole user-management situation, let's get into it 💖

summary

Displays a summary of userid information, including the maximum number of userids, the number of enabled users, and the number of fixed names defined. A little dashboard of who's who. ✨

list

Displays a list of user information for all defined userids. Everyone's invited to the list. 🎀

set

  • name <userid> <username> — Sets the username associated with the given userid. Name them, bestie 🏷️
  • password <userid> [<password> [<16|20>]] — Sets the password for the given userid. If no password is given, the password is cleared (set to the NULL password).
🚨 Be careful when removing passwords from administrator-level accounts. Like, genuinely be careful. That's a locked-door situation you're opening. 😭

If specified, 16 or 20 determines the maximum password length.

disable <userid>

Disables access to the BMC by the given userid. Revoked. 🚫

enable <userid>

Enables access to the BMC by the given userid. Access granted, welcome back 💅

priv <userid> <privilege level> [<channel number>]

Set user privilege level on the specified channel. If the channel is not specified, the current channel will be used. Give them exactly the power they need, no more, no less. 🔥

test <userid> <16|20> [<password>]

Determine whether a password has been stored as 16 or 20 bytes. Detective work, but make it credential-forensics 🕵️‍♀️

🌈 INTERFACES 🌈

💖 OPEN INTERFACE 💖

Okay so the open interface is the one that rides on the OpenIPMI kernel device driver. That driver ships in all modern 2.4 and all 2.6 kernels, and it should already be in recent Linux distro kernels too. There are also IPMI driver kernel patches for various kernel versions hanging out on the OpenIPMI homepage, iykyk.

The modules you need are different for 2.4 vs 2.6 kernels — do not mix and match, bestie. On a 2.4-based kernel, these modules must be loaded for ipmitool to work:

  • ipmi_msghandler — the incoming and outgoing message handler for IPMI interfaces.
  • ipmi_kcs_drv — an IPMI Keyboard Controller Style (KCS) interface driver for the message handler.
  • ipmi_devintf — the Linux character device interface for the message handler.

On a 2.6-based kernel, load these instead:

  • ipmi_msghandler — incoming and outgoing message handler for IPMI interfaces.
  • ipmi_si — an IPMI system interface driver for the message handler. This one supports a bunch of IPMI system interfaces like KCS, BT, SMIC, and even SMBus in 2.6 kernels. iconic tbh.
  • ipmi_devintf — the Linux character device interface for the message handler.

Once the required modules are loaded, there's a dynamic character device entry that must exist at /dev/ipmi0. On systems using devfs or udev, it'll show up at /dev/ipmi/0 instead. ✨

To create the device node, first figure out what dynamic major number the kernel assigned — peek in /proc/devices and look for the ipmidev entry. Usually, if this is the first dynamic device, the major number is 254, and the minor number for the first system interface is 0, so you'd create the device entry with:

mknod /dev/ipmi0 c 254 0

ipmitool also ships some sample initialization scripts that can do this task for you automatically at start-up, so you don't have to rawdog it manually 🫶

And to make ipmitool actually use the OpenIPMI device interface, just say so on the command line:

> ipmitool -I open <command>

🌸 BMC INTERFACE 🌸

The bmc interface uses the bmc device driver as provided by Solaris 10 and higher. To force ipmitool to use this interface, specify it on the command line:

> ipmitool -I bmc <command>

These files are associated with the bmc driver — know them, love them:

  • /platform/i86pc/kernel/drv/bmc — 32-bit ELF kernel module for the bmc driver.
  • /platform/i86pc/kernel/drv/amd64/bmc — 64-bit ELF kernel module for the bmc driver.
  • /dev/bmc — character device node used to communicate with the bmc driver.

🦋 LIPMI INTERFACE 🦋

The lipmi interface uses the Solaris 9 IPMI kernel device driver. Heads up though: it has been superceeded by the bmc interface on Solaris 10. (Yeah, "superceeded" — that's how the page spells it, and I refuse to gaslight the manpage.) You can tell ipmitool to use this interface by specifying it on the command line:

> ipmitool -I lipmi <expression>

🎀 LAN INTERFACE 🎀

The lan interface talks to the BMC over an Ethernet LAN connection using UDP under IPv4. The UDP datagrams are formatted to contain IPMI request/response messages with IPMI session headers and RMCP headers. Very layered, very demure.

IPMI-over-LAN uses version 1 of the Remote Management Control Protocol (RMCP) to support pre-OS and OS-absent management. RMCP is a request-response protocol delivered using UDP datagrams to port 623.

The LAN interface is an authentication multi-session connection — messages delivered to the BMC can (and should) be authenticated with a challenge/response protocol using either straight password/key or the MD5 message-digest algorithm. ipmitool will attempt to connect with administrator privilege level, because that's required to perform chassis power functions. main character privilege level fr fr 👑

You can tell ipmitool to use the lan interface with the -I lan option:

> ipmitool -I lan -H <hostname> [-U <username>] [-P <password>] <command>

A hostname must be given on the command line to use the lan interface with ipmitool. The password field is optional; if you don't provide a password on the command line, ipmitool will attempt to connect without authentication. If you do specify a password, it'll use MD5 authentication if the BMC supports it, and straight password/key otherwise — unless you override that with a command line option.

🧚 LANPLUS INTERFACE 🧚

Like the lan interface, the lanplus interface communicates with the BMC over an Ethernet LAN connection using UDP under IPv4. The difference is that lanplus uses the RMCP+ protocol as described in the IPMI v2.0 specification. RMCP+ allows for improved authentication and data integrity checks, plus encryption and the ability to carry multiple types of payloads. Generic Serial Over LAN support requires RMCP+, so the ipmitool sol activate command requires the use of the lanplus interface. No shortcuts, bestie 💅

RMCP+ session establishment uses a symmetric challenge-response protocol called RAKP (Remote Authenticated Key-Exchange Protocol), which allows the negotiation of many options. ipmitool does not yet allow the user to specify the value of every option, defaulting to the most obvious settings marked as required in the v2.0 specification. Authentication and integrity HMACS are produced with SHA1, and encryption is performed with AES-CBC-128. Role-level logins are not yet supported.

⚠️ ipmitool must be linked with the OpenSSL library in order to perform the encryption functions and support the lanplus interface. If the required packages aren't found, it will not be compiled in and supported. So if lanplus is ghosting you, that's why 😭

You can tell ipmitool to use the lanplus interface with the -I lanplus option:

> ipmitool -I lanplus -H <hostname> [-U <username>] [-P <password>] <command>

A hostname must be given on the command line in order to use the lan interface with ipmitool. With the exception of the -A and -C options, the rest of the command line options are identical to those available for the lan interface.

The -C option lets you specify the authentication, integrity, and encryption algorithms to use for a lanplus session, based on the cipher suite ID found in the IPMIv2.0 specification in table 22-20. The default cipher suite is 17, which specifies RAKP-HMAC-SHA256 authentication, HMAC-SHA256-128 integrity, and AES-CBC-128 encryption algorightms. (Again — "algorightms" is the original's spelling, we're keeping it, don't come for me 🙈)

⭐ FREE INTERFACE ⭐

The free interface utilizes the FreeIPMI libfreeipmi drivers. You can tell ipmitool to use the FreeIPMI interface with the -I option:

> ipmitool -I free <command>

💜 IMB INTERFACE 💜

The imb interface supports the Intel IMB (Intel Inter-module Bus) Interface through the /dev/imb device. You can tell ipmitool to use the IMB interface with the -I option:

> ipmitool -I imb <command>

✨ EXAMPLES ✨

Example 1: Listing remote sensors

> ipmitool -I lan -H 1.2.3.4 -f passfile sdr list
Baseboard 1.25V  | 1.24 Volts        | ok
Baseboard 2.5V   | 2.49 Volts        | ok
Baseboard 3.3V   | 3.32 Volts        | ok

Example 2: Displaying status of a remote sensor

> ipmitool -I lan -H 1.2.3.4 -f passfile sensor get "Baseboard 1.25V"
Locating sensor record...
Sensor ID              : Baseboard 1.25V (0x10)
Sensor Type (Analog)   : Voltage
Sensor Reading         : 1.245 (+/- 0.039) Volts
Status                 : ok
Lower Non-Recoverable  : na
Lower Critical         : 1.078
Lower Non-Critical     : 1.107
Upper Non-Critical     : 1.382
Upper Critical         : 1.431
Upper Non-Recoverable  : na

Example 3: Displaying the power status of a remote chassis

> ipmitool -I lan -H 1.2.3.4 -f passfile chassis power status
Chassis Power is on

Example 4: Controlling the power on a remote chassis

> ipmitool -I lan -H 1.2.3.4 -f passfile chassis power on
Chassis Power Control: Up/On

🍓 FILES 🍓

  • /usr/share/misc/enterprise-numbers — system IANA PEN registry taken from http://www.iana.org/assignments/enterprise-numbers
  • ~/.local/usr/share/misc/enterprise-numbers — user's override for the system IANA PEN registry; this file, if it exists, is loaded instead of the system registry (see above). Sneaky little override, love that for you 💅

👑 AUTHORS 👑

Originally written by Duncan Laurie <duncan@iceblink.org>.

Numerous contributors over time. (So many. A whole crowd. Respect 🫶)

💀 BUGS 💀

Any bugs found in ipmitool please report via the GitHub issue system at https://github.com/ipmitool/ipmitool/issues. Don't suffer in silence, bestie — file the issue.

🦋 SEE ALSO 🦋

That's the whole page, bestie, you made it to the end 🎉 Huge shoutout to Duncan Laurie, who wrote the original, and to the untold contributors over time — this is ipmitool(1), and it ate. Now go power-cycle a chassis responsibly. 💖✨🎀

📦 where this page comes from