IPMI-SEL(8)

📦
version 1.6.20 · 15 versions
, in arch rolling, centos-stream 10, centos-stream 9

💖 IPMI-SEL(8) 💖

okay so bestie, welcome to ipmi-sel — it's in the System Commands manual, lowercase-and-casual, and it's literally about peeking at your System Event Log. buckle up 🫶

✨ NAME ✨

ipmi-sel — display SEL entries

🌸 SYNOPSIS 🌸

ipmi-sel [OPTION...]

🦋 DESCRIPTION 🦋

Okay so ipmi-sel is the tool for viewing and managing System Event Log (SEL) entries. What are those? They're SEL records, and they store all your system event info — genuinely useful when you're out here debugging problems at 2am. 🕵️‍♀️

Here's the tea though: ipmi-sel does not tell you whether an event is good or bad. It just tells you the event happened. That's it. No editorializing, no vibes check on your hardware. If you actually want the analyzed state, bestie, you gotta use the --output-event-state option. 👑

Down below you'll find the general IPMI options, the tool-specific options, troubleshooting info, workaround info, examples, and known issues. For a general intro to FreeIPMI, go look at freeipmi(7). And if you wanna do some advanced SEL management, that's a whole other girlie — see bmc-device(8). 💅

🎀 GENERAL OPTIONS 🎀

These are the general options for configuring IPMI communication and running the general tool commands. slay.

  • -D IPMIDRIVER, --driver-type=IPMIDRIVER — tell it which driver type to use instead of letting it auto-select. the currently available outofband drivers are LAN and LAN_2_0, which do IPMI 1.5 and IPMI 2.0 respectively. the currently available inband drivers are KCS, SSIF, OPENIPMI, SUNBMC, and INTELDCMI. pick your fighter ✨
  • --disable-auto-probe — do not probe in-band IPMI devices for default settings. like, don't even look. 🚫
  • --driver-address=DRIVER-ADDRESS — specify the in-band driver address to use instead of the probed value. DRIVER-ADDRESS should be prefixed with "0x" for a hex value and '0' for an octal value.
  • --driver-device=DEVICE — specify the in-band driver device path to use instead of the probed path.
  • --register-spacing=REGISTER-SPACING — specify the in-band driver register spacing instead of the probed value. the argument is in bytes (i.e. 32bit register spacing = 4). math girlie behavior 🧮
  • --target-channel-number=CHANNEL-NUMBER — specify the in-band driver target channel number to send IPMI requests to.
  • --target-slave-address=SLAVE-ADDRESS — specify the in-band driver target slave number to send IPMI requests to.
  • -h IPMIHOST1,IPMIHOST2,...,, --hostname=IPMIHOST1[:PORT],IPMIHOST2[:PORT],... — specify the remote host(s) to communicate with. multiple hostnames can be separated by comma, or you can specify them in a range format (see HOSTRANGED SUPPORT below). an optional port can be specified with each host, which is handy for port forwarding or similar situations. if you're specifying an IPv6 address and port, use the format [ADDRESS]:PORT. 💖
  • -u USERNAME, --username=USERNAME — specify the username to use when authenticating with the remote host. if not specified, a null (i.e. anonymous) username is assumed. the user must have atleast USER privileges for this tool to operate fully. (yes, hold that thought, privileges matter 👀)
  • -p PASSWORD, --password=PASSWORD — specify the password to use when authenticationg with the remote host. if not specified, a null password is assumed. maximum password length is 16 for IPMI 1.5 and 20 for IPMI 2.0. 🔐
  • -P, --password-prompt — prompt for the password so it doesn't end up listed in process lists. privacy icon 💅
  • -k K_G, --k-g=K_G — specify the K_g BMC key to use when authenticating with the remote host for IPMI 2.0. if not specified, a null key is assumed. to input the key in hexadecimal form, prefix the string with '0x'. e.g., the key 'abc' can be entered with either the string 'abc' or the string '0x616263'. both valid, pick your aesthetic 🌈
  • -K, --k-g-prompt — prompt for k-g so it doesn't end up listed in process lists. same energy, different secret 🤫
  • --session-timeout=MILLISECONDS — specify the session timeout in milliseconds. defaults to 20000 milliseconds (20 seconds) if not specified. ⏰
  • --retransmission-timeout=MILLISECONDS — specify the packet retransmission timeout in milliseconds. defaults to 1000 milliseconds (1 second) if not specified. and heads up: the retransmission timeout cannot be larger than the session timeout. ⚠️
  • -a AUTHENTICATION-TYPE, --authentication-type=AUTHENTICATION-TYPE — specify the IPMI 1.5 authentication type to use. the currently available authentication types are NONE, STRAIGHT_PASSWORD_KEY, MD2, and MD5. defaults to MD5 if not specified. 🔥
  • -I CIPHER-SUITE-ID, --cipher-suite-id=CIPHER-SUITE-ID — specify the IPMI 2.0 cipher suite ID to use. the Cipher Suite ID identifies a set of authentication, integrity, and confidentiality algorithms to use for IPMI 2.0 communication. let me break that down, bestie: the authentication algorithm is the one used for session setup, the integrity algorithm is the one used for session packet signatures, and the confidentiality algorithm is the one used for payload encryption. defaults to cipher suite ID 3 if not specified. the following cipher suite ids are currently supported:
    • 0 - Authentication Algorithm = None; Integrity Algorithm = None; Confidentiality Algorithm = None
    • 1 - Authentication Algorithm = HMAC-SHA1; Integrity Algorithm = None; Confidentiality Algorithm = None
    • 2 - Authentication Algorithm = HMAC-SHA1; Integrity Algorithm = HMAC-SHA1-96; Confidentiality Algorithm = None
    • 3 - Authentication Algorithm = HMAC-SHA1; Integrity Algorithm = HMAC-SHA1-96; Confidentiality Algorithm = AES-CBC-128
    • 6 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = None; Confidentiality Algorithm = None
    • 7 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = HMAC-MD5-128; Confidentiality Algorithm = None
    • 8 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = HMAC-MD5-128; Confidentiality Algorithm = AES-CBC-128
    • 11 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = MD5-128; Confidentiality Algorithm = None
    • 12 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = MD5-128; Confidentiality Algorithm = AES-CBC-128
    • 15 - Authentication Algorithm = HMAC-SHA256; Integrity Algorithm = None; Confidentiality Algorithm = None
    • 16 - Authentication Algorithm = HMAC-SHA256; Integrity Algorithm = HMAC_SHA256_128; Confidentiality Algorithm = None
    • 17 - Authentication Algorithm = HMAC-SHA256; Integrity Algorithm = HMAC_SHA256_128; Confidentiality Algorithm = AES-CBC-128

(note that 16 and 17 say HMAC_SHA256_128 with underscores, not dashes — that's not a typo, that's canon 💀)

  • -l PRIVILEGE-LEVEL, --privilege-level=PRIVILEGE-LEVEL — specify the privilege level to be used. the currently available privilege levels are USER, OPERATOR, and ADMIN. defaults to OPERATOR if not specified. 👑
  • --config-file=FILE — specify an alternate configuration file.
  • -W WORKAROUNDS, --workaround-flags=WORKAROUNDS — specify workarounds for vendor compliance issues. multiple workarounds can be specified separated by commas. the special command line flag "none" indicates no workarounds at all (which may be useful for overriding configured defaults). see WORKAROUNDS below for a list of the available workarounds. 🛠️
  • --debug — turn on debugging.
  • -?, --help — output a help list and exit. 🫶
  • --usage — output a usage message and exit.
  • -V, --version — output the program version and exit.

more parts coming, don't you dare close the tab bestie 💖

💅 IPMI-SEL OPTIONS 💅

okay bestie, these are the ones that are literally just for ipmi-sel — the main character options, if you will ✨

  • -v — verbose mode, babes. This one outputs event direction. And why do we care? Because event direction can help you tell the severity apart between some events 🫶 Like, some motherboards will fire off an event when a temperature goes over a threshold AND another one when it drops back under it — so direction is your girl for telling those two apart.
  • -vv — very verbose, aka -v but extra 💅 This one gives you additional info beyond verbose. Most notably it spits out extra hex codes for the ambiguous SEL entries — think OEM codes and stuff like that. For example: Generator ID hex codes for sensors that don't have names, event type codes for OEM events, and record types for OEM records. This is genuinely useful if you're writing a parser outside of ipmi-sel to interpret OEM information. iykyk 🔥
  • -i, --info — show general information about the SEL. Just the vibes, the overview, the big picture 🌸
  • --display=RECORD-IDS-LIST — display SEL records by record id. Takes space or comma separated lists, so go off with your formatting 💖
  • --exclude-display=RECORD-IDS-LIST — the opposite energy: exclude display of SEL records by record id. Also accepts space or comma separated lists 🦋
  • --display-range=START-END — display SEL records from record id START to END. Range queen 👑
  • --exclude-display-range=START-END — exclude display of SEL records from record id START to END. Not invited to the party 🙈
  • --date-range=DATE-DATE — display SEL records with events occurring in the specified date range. Dates can be in MM/DD/YYYY, MM-DD-YYYY, or the ISO 8601 YYYY-MM-DDTHH:MM:SS format. For the non ISO 8601 formats, the month can be a numeral or its abbreviated string name. And the current local system time? Just say "now" ✨ Heads up though: non-timestamped records will not be displayed automatically, because they literally don't have a timestamp to check. No timestamp, no entry, periodt 💀
  • --exclude-date-range=DATE-DATE — exclude display of SEL records with events occurring in the specified date range. Same date formats, bestie: MM/DD/YYYY, MM-DD-YYYY, or ISO 8601 YYYY-MM-DDTHH:MM:SS. For the non ISO 8601 formats, month can be a numeral or its abbreviated string name. "now" works for the current local system time too. And note the flip side here: non-timestamped records will be displayed automatically, since they don't possess a timestamp 🌈
  • -t SENSOR-TYPE-LIST, --sensor-types=SENSOR-TYPE-LIST — specify which sensor types to show SEL events for. Multiple types? Separate them with commas or spaces, easy. There's a special command line type of "all" which means all types get shown (handy for overriding configured defaults). You can specify sensor types by string (peep --list-sensor-types below) or by number (decimal or hex) 🎀
  • -T SENSOR-TYPE-LIST, --exclude-sensor-types=SENSOR-TYPE-LIST — specify which sensor types to not show SEL events for. Multiple types separated by commas or spaces. Special command line type here is "none", which means no types should be excluded (again, useful for overriding configured defaults). String or number (decimal or hex), your call 💜
  • -L, --list-sensor-types — list sensor types. That's it, that's the whole thing 🌸
  • --tail=count — display approximately the last count SEL records. Key word: approximately 😭 The display count gets calculated by approximating the record ids of the last SEL records, so how correct it is depends highly on the SEL implementation by the vendor. Fr fr, don't @ me if it's off.
  • --clear — clear the SEL. Yeet it 💀
  • --post-clear — identical to --clear, except the SEL clearing happens after the SEL event records are displayed. This one's a lifesaver for scripting — if you wanna log SEL events to another log and then immediately clear the SEL, this is your girl. Unlike calling --clear in a separate execution of ipmi-sel, this option uses SEL reservations to notify you if a SEL change occurred while displaying and clearing. That protects you from a race where a new SEL event gets generated before you clear, and nobody knows about it 😱 Just know that SEL reservations are optionally implemented by vendors and may not be available on all machines. No cap.
  • --delete=RECORD-IDS-LIST — delete records by record id in the SEL. Space or comma separated lists, same as always ✨
  • --delete-range=START-END — delete record ids from START to END in the SEL. Bye bye 👋
  • --system-event-only — output only system event records, i.e. don't output OEM records. Filtered, slay 💅
  • --oem-event-only — output only OEM event records, i.e. don't output system event records. The other side of the coin 🦋
  • --output-manufacturer-id — for OEM SEL record types, output the manufacturer ID along with the event data when it's available. Iconic detail work 👑
  • --output-event-state — output event state in the output. This adds an additional output reporting whether an event should be viewed as NOMINAL, WARNING, or CRITICAL. The event state is an interpreted value based on the configuration file /etc/freeipmi//freeipmi_interpret_sel.conf and the event direction. See freeipmi_interpret_sel.conf(5) for more info 🫶
  • --event-state-config-file=FILE — specify an alternate event state configuration file. This option is ignored if --output-event-state isn't specified. Sorry babe, it needs its partner 💀
  • --hex-dump — hex-dump SEL entries. Raw bytes, main character energy 🔥
  • --interpret-oem-data — attempt to interpret OEM data — that's event data, sensor readings, general extra info, etc. If there's no OEM interpretation available, you just get the default output. And real talk: correctness of OEM interpretations cannot be guaranteed, because OEM vendors may change things up in products, firmware, etc. Peep OEM INTERPRETATION below for the confirmed supported motherboard interpretations 💖
  • --output-oem-event-strings — some motherboards support an IPMI OEM extension that returns the string output for a system event, and that string can be super helpful for figuring out what an OEM specific event actually means. This option uses the OEM event string to describe all system events in the ipmi-sel output. It differs from --interpret-oem-data in that all system events get the vendor supplied event string — not just the OEM specific ones. And heads up: that event string may be very different from the normal FreeIPMI event string output. If an OEM event string isn't available, you get the default output. Confirmed to work for Fujitsu iRMC S1 and iRMC S2 systems ✨
  • --entity-sensor-names — output sensor names prefixed with their entity id and instance number when appropriate. This can genuinely be necessary on some motherboards to help identify what sensors are referencing. Like, a motherboard might have multiple sensors all named 'TEMP' — the entity id and instance number help you clock which one refers to "Processor 1" vs. "Processor 2" 🧚
  • --no-sensor-type-output — don't show sensor type output for each entry. On a lot of systems the sensor type is redundant to the sensor's name, and that's especially true if you specified --entity-sensor-names. If the sensor name is sufficient, or if the sensor type just isn't interesting to you, use this to condense the output 💅
  • --comma-separated-output — output fields in comma separated format. CSV girlies rise 🍓
  • --no-header-output — don't output column headers. Very useful in scripting 🫶
  • --non-abbreviated-units — output non-abbreviated units (like 'Amps' instead of 'A'). Helps disambiguate units — think 'C' for Celsius vs. Coulombs 😭
  • --legacy-output — output in legacy format. Newer options may not be applicable to legacy output, so don't come for me 🙈

🎀 SDR CACHE OPTIONS 🎀

so like, this tool needs access to the sensor data repository (SDR) cache for general operation, bestie. By default, SDR data gets downloaded and cached on the local machine. These options are all about that cache ✨

  • --flush-cache — flush a cached version of the sensor data repository (SDR) cache. The SDR is typically cached for faster subsequent access, but it may need to be flushed and re-generated if the SDR has been updated on a system. Out with the old 💀
  • --quiet-cache — don't output information about cache creation/deletion. Useful in scripting, ngl 🤫
  • --sdr-cache-recreate — if the SDR cache is out of date or invalid, automatically recreate the sensor data repository (SDR) cache. This one's handy for scripting purposes 🎀
  • --sdr-cache-file=FILE — specify a specific sensor data repository (SDR) cache file to be stored or read from. If you use this when multiple hosts are specified, the same SDR cache file will be used for all of them 🦋
  • --sdr-cache-directory=DIRECTORY — specify an alternate directory for sensor data repository (SDR) caches to be stored or read from. Defaults to the home directory if not specified 💖
  • --ignore-sdr-cache — ignore SDR cache related processing. This may lead to incomplete or less useful information being output, but it will allow functionality for systems without SDRs, or when the correct SDR can't be loaded 🫶

🌸 TIME OPTIONS 🌸

okay so by IPMI definition, all IPMI times and timestamps are stored in localtime. But plot twist: in many situations they're not actually stored in localtime 😭 Whether a system truly stored timestamps in localtime varies on a bunch of factors — the vendor, BIOS, the operating system, the whole vibe. These options let you adjust how the stored timestamps get interpreted and how they should be output ✨

  • --utc-to-localtime — assume all times are reported in UTC time, and convert the time to localtime before outputting it 🦋
  • --localtime-to-utc — convert all localtime timestamps to UTC before outputting them 🎀
  • --utc-offset=SECONDS — specify a specific UTC offset in seconds to be added to timestamps. The value can range from -86400 to 86400 seconds, and it defaults to 0 ⭐

🦋 HOSTRANGED OPTIONS 🦋

okay so these next ones are all about how the hostranged output behaves — if you're like "wait, what's a hostrange", scroll down to HOSTRANGED SUPPORT, i gotchu 💖

  • -B, --buffer-output — buffers the hostranged output, bestie. For every node, standard output gets held back until that node has completely finished its IPMI operation. Heads up tho: with this on, data may look like it's coming out slower, because the entire IPMI operation has to finish before anything can be printed. See HOSTRANGED SUPPORT below for the deets ✨
  • -C, --consolidate-output — consolidates the hostranged output. The complete standard output from every node you specified gets smooshed together so that nodes with identical output don't get printed twice. A header will list which nodes are in the consolidated output. With this on, you see literally nothing until the IPMI operations to all the nodes have completed. And if you break out of the program early? All the currently consolidated output gets dumped. See HOSTRANGED SUPPORT below 💅
  • -F NUM, --fanout=NUM — sets the multiple host fanout. There's a "sliding window" (aka fanout) algorithm doing the parallel IPMI communication, so slower nodes or timed-out nodes don't block the parallel stuff. The max number of threads running at the same time is capped by the fanout. Default is 64. 🧚
  • -E, --eliminate — eliminates hosts that ipmidetect determined are undetected. This tries to fix that super common issue where hostranged execution times out because, like, several nodes got pulled out of service in a big cluster. The ipmidetectd daemon has to be running on the node executing the command. 🔥
  • --always-prefix — always prefixes the output, even if there's only one host specified or you're communicating in-band. This one is mainly useful for scripting. It gets ignored if you specify it with the -C option, no cap.

🌈 HOSTRANGED SUPPORT 🌈

Multiple hosts can be given to you either as an explicit comma separated list of hosts, or as a range of hostnames in the general form: prefix[n-m,l-k,...], where n < m and l < k, etc. ⭐ And pls don't confuse that range form with regular expression character classes (which also use []) — they are NOT the same thing. For example, foo[19] does not mean foo1 or foo9, it literally represents a degenerate range: foo19. 🙈

This range syntax is only meant as a convenience on clusters that use a prefixNN naming convention — specifying ranges is not, like, necessary at all. The list foo1,foo9 could just be written as itself, or as the range foo[1,9]. either works bestie 💜

Some examples of range usage:

foo[01-05] instead of foo01,foo02,foo03,foo04,foo05
foo[7,9-10] instead of foo7,foo9,foo10
foo[0-3] instead of foo0,foo1,foo2,foo3

And a friendly reminder to the reader: some shells will interpret brackets ([ and ]) for pattern matching. Depending on your shell, you may need to enclose ranged lists in quotes. 🐚

When multiple hosts are specified, a thread runs for each host in parallel, up to the configured fanout (which you can adjust with the -F option). This lets you talk to a huge number of nodes way faster than doing it one at a time, fr fr. ⚡

By default, the standard output from each node gets output with the hostname prepended to each line. That's readable in lots of situations, but sometimes it's a struggle — like, output from multiple nodes can get mixed together 😭. The -B and -C options exist to change this default. 🎀

In-band IPMI Communication gets used when the host "localhost" is specified. That's how you sneak the localhost into your hostranged output. 👑

💜 GENERAL TROUBLESHOOTING 💜

Most of the time, IPMI problems are just configuration problems. it's giving "it was the config all along" 💀

IPMI over LAN problems involve a misconfiguration of the remote machine's BMC. Double check that all of these are configured properly in the remote machine's BMC: IP address, MAC address, subnet mask, username, user enablement, user privilege, password, LAN privilege, LAN enablement, and allowed authentication type(s). For IPMI 2.0 connections, double check that the cipher suite privilege(s) and K_g key are configured properly. The ipmi-config(8) tool can be used to check and/or change these configuration settings. ✅

Inband IPMI problems are typically caused by improperly configured drivers or non-standard BMCs.

In addition to the troubleshooting tips below, please see WORKAROUNDS below — also check if there are any vendor specific bugs that have been discovered and worked around. 🔍

Listed below are many of the common issues behind error messages. For additional support, please e-mail the freeipmi-users@gnu.org mailing list. 🫶

  • "username invalid" — the username entered (or a NULL username if none was entered) is not available on the remote machine. It may also be possible that the remote BMC's username configuration is incorrect.
  • "password invalid" — the password entered (or a NULL password if none was entered) is not correct. It may also be possible that the password for the user is not correctly configured on the remote BMC.
  • "password verification timeout" — password verification has timed out. A "password invalid" error (described above) or a generic "session timeout" (described below) occurred. At this point in the protocol you simply cannot tell which one happened. 😭
  • "k_g invalid" — the K_g key entered (or a NULL K_g key if none was entered) is not correct. It may also be possible that the K_g key is not correctly configured on the remote BMC.
  • "privilege level insufficient" — an IPMI command requires a higher user privilege than the one you authenticated with. Please try authenticating with a higher privilege. This may require authenticating to a different user which has a higher maximum privilege.
  • "privilege level cannot be obtained for this user" — the privilege level you're trying to authenticate with is higher than the maximum allowed for this user. Please try again with a lower privilege. It may also be possible that the maximum privilege level allowed for a user is not configured properly on the remote BMC.
  • "authentication type unavailable for attempted privilege level" — the authentication type you want to authenticate with is not available for this privilege level. Please try again with an alternate authentication type or an alternate privilege level. It may also be possible that the available authentication types you can authenticate with are not correctly configured on the remote BMC.
  • "cipher suite id unavailable" — the cipher suite id you want to authenticate with is not available on the remote BMC. Please try again with an alternate cipher suite id. It may also be possible that the available cipher suite ids are not correctly configured on the remote BMC.
  • "ipmi 2.0 unavailable" — IPMI 2.0 was not discovered on the remote machine. Please try to use IPMI 1.5 instead.
  • "connection timeout" — initial IPMI communication failed. A bunch of potential errors are possible here, including an invalid hostname specified, an IPMI IP address that can't be resolved, IPMI not being enabled on the remote server, a bad network connection, etc. Please verify configuration and connectivity. 🌐
  • "session timeout" — the IPMI session has timed out. Please reconnect. If this error happens a lot, you may want to increase the retransmission timeout — some remote BMCs are considerably slower than others. 🐌
  • "device not found" — the specified device could not be found. Please check configuration or inputs and try again.
  • "driver timeout" — communication with the driver or device has timed out. Please try again.
  • "message timeout" — communication with the driver or device has timed out. Please try again.
  • "BMC busy" — the BMC is currently busy. It may be processing information or have too many simultaneous sessions to manage. Please wait and try again. 😴
  • "could not find inband device" — an inband device could not be found. Please check configuration or specify a specific device or driver on the command line.
  • "driver timeout" — the inband driver has timed out communicating to the local BMC or service processor. The BMC or service processor may be busy or (worst case) possibly non-functioning. 💀
  • "internal IPMI error" — an IPMI error has occurred that FreeIPMI does not know how to handle. Please e-mail freeipmi-users@gnu.org to report the issue. 🙏

🍓 IPMI-SEL TROUBLESHOOTING 🍓

Some timestamps in the SEL may report a date of 1-Jan-1970, the epoch for SEL timestamps. And ngl, that timestamp is not necessarily incorrect. It usually means a hardware event happened before a timestamp in firmware was initialized — like, certain hardware components get their internal clocks reset during a power cycle. 🔄

However, if the internal clock of the SEL appears to be regularly incorrect, you may need to set the SEL time. This can be done using bmc-device(8). ⏰

The following are the common SEL related messages:

  • "sel config file parse error" — a parse error was found in the sel event interpretation configuration file. Please see freeipmi_interpret_sel.conf(5). 📝

🛠 WORKAROUNDS 🛠

Okay so bestie, here's the tea: every vendor out there is out here implementing their own IPMI solution, and like… some of them fumbled the protocol badly. 💀 So FreeIPMI ships a little stack of workarounds to deal with compliance drama that's already been discovered. When it's possible, these workarounds are baked in so they're totally transparent to you — you don't even notice. But some of them? You gotta opt in yourself via the -W option. Periodt.

The hardware listed under each one might only be the hardware where the problem was first spotted. Newer versions of the same boards may have fixed it. Similar machines from the same vendor may or may not have the same issue. And because different vendors sometimes license firmware from the same IPMI firmware developer, it's genuinely worth trying the workarounds below even if your motherboard isn't on the list. iykyk ✨

If you're convinced your hardware has an extra compliance issue that needs its own workaround, please hit up the FreeIPMI maintainers at <freeipmi-users@gnu.org> or <freeipmi-devel@gnu.org>. 🫶

  • assumeio — tells everything to assume inband interfaces talk to system I/O instead of being memory-mapped. This gets around systems that report invalid base addresses. If you're hitting this you might see "device not supported" or "could not find inband device" errors. Issue observed on HP ProLiant DL145 G1. 🙈
  • spinpoll — tells some inband drivers (most notably the KCS driver) to spin while polling instead of putting the process to sleep. Ngl this can significantly improve the wall clock running time of tools, because an OS scheduler's granularity may be way bigger than the time it takes to do a single IPMI message transaction. The tradeoff? By spinning, your system may be doing less useful work because it's not contexting out the tool for something more useful. balance, bestie ⚖️
  • authcap — skips the early checks for username capabilities, authentication capabilities, and K_g support, and just lets IPMI authentication succeed. It works around a whole pile of issues where the remote system doesn't properly report username capabilities, authentication capabilities, or K_g status. Symptoms include "username invalid", "authentication type unavailable for attempted privilege level", or "k_g invalid" errors. Issue observed on Asus P5M2/P5MT-R/RS162-E4/RX4, Intel SR1520ML/X38ML, and Sun Fire 2200/4150/4450 with ELOM. 🔥
  • nochecksumcheck — tells FreeIPMI to not check the checksums coming back in IPMI command responses. Works around systems returning invalid checksums because of implementation errors even though the packet is otherwise valid. ⚠️ Users are cautioned on this one, because it removes validation of packet integrity in a number of circumstances. That said, it's unlikely to be an issue in most situations. Symptoms: "connection timeout", "session timeout", or "password verification timeout" errors. On IPMI 1.5 connections, you might also need the "noauthcodecheck" workaround too. Issue observed on Supermicro X9SCM-iiF, Supermicro X9DRi-F, and Supermicro X9DRFR. 😭
  • idzero — lets the client accept empty session IDs. Works around IPMI sessions that report empty session IDs to the client. Symptoms: "session timeout" errors. Issue observed on Tyan S2882 with M3289 BMC. 🦋
  • unexpectedauth — allows unexpected non-null authcodes to be checked as though they were expected. Works around the issue where packets contain non-null authentication data when they should be null due to disabled per-message authentication. Symptoms: "session timeout" errors. Issue observed on Dell PowerEdge 2850,SC1425. Confirmed fixed on newer firmware. ✨
  • forcepermsg — forces per-message authentication to be used no matter what the remote system advertises. Works around the case where per-message authentication is advertised as disabled on the remote system but is actually required for the protocol. Symptoms: "session timeout" errors. Issue observed on IBM eServer 325. 💅
  • endianseq — flips the endian of the session sequence numbers so the session can keep going properly. Works around IPMI 1.5 session sequence numbers that are the wrong endian. Symptoms: "session timeout" errors. Issue observed on some Sun ILOM 1.0/2.0 (depends on service processor endian). 🌸
  • noauthcodecheck — tells FreeIPMI to not check the authentication codes returned from IPMI 1.5 command responses. Works around systems returning invalid authentication codes due to hashing or implementation errors. ⚠️ Users are cautioned here too, because it removes an authentication check that verifies the validity of a packet — but in most organizations, that's unlikely to be a security issue. Symptoms: "connection timeout", "session timeout", or "password verification timeout" errors. Issue observed on Xyratex FB-H8-SRAY, Intel Windmill, Quanta Winterfell, and Wiwynn Windmill. 👑
  • intel20 — covers several Intel IPMI 2.0 authentication issues, including padding of usernames and password truncation when the authentication algorithm is HMAC-MD5-128. Symptoms: "username invalid", "password invalid", or "k_g invalid" errors. Issue observed on Intel SE7520AF2 with Intel Server Management Module (Professional Edition). 🔥
  • supermicro20 — covers several Supermicro IPMI 2.0 authentication issues on motherboards w/ Peppercon IPMI firmware, including handling invalid length authentication codes. Symptoms: "password invalid" errors. Issue observed on Supermicro H8QME with SIMSO daughter card. Confirmed fixed on newerver firmware. 🧚
  • sun20 — works around several Sun IPMI 2.0 authentication issues, including invalid lengthed hash keys, improperly hashed keys, and invalid cipher suite records. Symptoms: "password invalid" or "bmc error" errors. Issue observed on Sun Fire 4100/4200/4500 with ILOM. This workaround automatically includes the "opensesspriv" workaround. 🌈
  • opensesspriv — slightly alters FreeIPMI's IPMI 2.0 connection protocol to work around an invalid hashing algorithm used by the remote system: the privilege level sent during the Open Session stage of an IPMI 2.0 connection is used for hashing keys instead of the privilege level sent during the RAKP1 connection stage. Symptoms: "password invalid", "k_g invalid", "bad rmcpplus status code", or "privilege level cannot be obtained for this user" errors. Issue observed on Sun Fire 4100/4200/4500 with ILOM, Inventec 5441/Dell Xanadu II, Supermicro X8DTH, Supermicro X8DTG, Intel S5500WBV/Penguin Relion 700, Intel S2600JF/Appro 512X, Quanta QSSC-S4R/Appro GB812X-CN, Dell C5220, and the OpenIPMI software BMC. This workaround is automatically triggered with the "sun20" workaround. 💜
  • integritycheckvalue — works around an invalid integrity check value during IPMI 2.0 session establishment when using Cipher Suite ID 0. The integrity check value should be 0 length, but the remote motherboard responds with a non-empty field. Symptoms: "k_g invalid" errors. Issue observed on Supermicro X8DTG, Supermicro X8DTU, and Intel S5500WBV/Penguin Relion 700, and Intel S2600JF/Appro 512X. 🎀
  • assumemaxsdrrecordcount — informs SDR reading to stop reading after a known maximum number of SDR records have been read. Works around systems with miss-implemented SDR reading functions. Symptoms: "SDR record count invalid" errors. Issue observed on unspecified Inspur motherboard. 🙈
  • assumesystemevent — assumes invalid SEL record types are actually system event records. The records may be formatted correctly but report invalid record types. Symptoms: "Unknown SEL Record Type" errors. Output may be unknown, pray for the best. 😭 This option is confirmed to work around compliances issues on HP DL 380 G5 motherboards.

No IPMI 1.5 Support — some motherboards that support IPMI 2.0 have been found to not support IPMI 1.5. Symptoms: "ipmi 2.0 unavailable" or "connection timeout" errors. You can work around this by using IPMI 2.0 instead of IPMI 1.5 — just specify --driver-type=LAN_2_0. Issue observed on a number of HP and Supermicro motherboards. ✨

🏭 OEM INTERPRETATION 🏭

These motherboards are confirmed to have at least some support from the --interpret-oem-data option, bestie. 👑 While it's highly probable the OEM data interpretations would work across other motherboards from the same manufacturer, there are no guarantees — so don't come for me if it doesn't. 🙈 Some of the boards below may be rebranded by vendors/distributors.

  • Dell Poweredge 2900
  • Dell Poweredge 2950
  • Dell Poweredge R610
  • Dell Poweredge R710
  • Fujitsu iRMC S1 and iRMC S2 systems
  • Gigabyte MD90-FS0-ZB
  • Gigabyte MG20-OP0-ZB/Penguin Computing Relgion X1904GT
  • Intel S5500WB/Penguin Computing Relion 700
  • Intel S2600JF/Appro 512X
  • Intel S2600GZ
  • Intel S2600WP
  • Intel S5000PAL
  • Intel Windmill
  • Intel S2600KP
  • Intel S2600KPR
  • Intel S2600WT2
  • Intel S2600WTT
  • Inventec 5441/Dell Xanadu II
  • Inventec 5442/Dell Xanadu III
  • Quanta S99Q/Dell FS12-TY
  • Quanta QSSC-S4R/Appro GB812X-CN
  • Quanta Winterfell
  • Sun X4140
  • Supermicro X7DBR-3
  • Supermicro X7DB8
  • Supermicro X8DTN
  • Supermicro X7SBI-LN4
  • Supermicro X8DTH
  • Supermicro X8DTG
  • Supermicro X8DTU
  • Supermicro X8DT3-LN4F
  • Supermicro X8DTU-6+
  • Supermicro X8DTL
  • Supermicro X8DTL-3F
  • Supermicro X8SIL-F
  • Supermicro X9SCL
  • Supermicro X9SCM
  • Supermicro X8DTN+-F
  • Supermicro X8SIE
  • Supermicro X9SCA-F-O
  • Supermicro H8DGU-F
  • Supermicro X9DRi-F
  • Supermicro X9DRI-LN4F+
  • Supermicro X9SPU-F-O
  • Supermicro X9SCM-iiF
  • Supermicro X10SLM-F
  • Wiwynn Windmill
  • Wistron/Dell Poweredge C6220

🎀 EXAMPLES 🎀

Okay, demo time — these are the moments where it all clicks, bestie. 🌟

# ipmi-sel

Shows all SEL records on the local machine. the classic, the icon 💅

# ipmi-sel -h ahost -u myusername -p mypassword

Shows all SEL records of a remote machine using IPMI over LAN. 🌐

# ipmi-sel -h mycluster[0-127] -u myusername -p mypassword

Shows all SEL records across a cluster using IPMI over LAN. hostranged slay ✨

# ipmi-sel --delete=44,82

Deletes SEL records 44 and 82 on the local machine. 🗑️

# ipmi-sel --clear

Deletes all SEL entries on the local machine. ⚠️ like, all of them, no takebacks — this is giving main character energy but also please be sure.

# ipmi-sel --delete-range=12-42

Deletes SEL entries in the range 12 to 42 on the local machine. 🦋

💖 DIAGNOSTICS 💖

Okay so the receipts on how it went — it's literally just two numbers bestie:

  • 0 — slayed. It worked, no notes.
  • 1 — nope, something broke along the way.

And if you're out here talking to multiple hosts at once? The rule is stricter, bestie. The exit status is 0 if and only if every single target executed successfully. Every. Single. One. If even one of them fumbled, you get 1 and that's the vibe check failed for the whole group chat. 😭

⚠️ KNOWN ISSUES ⚠️ (the fine print, but make it fashion)

So on older operating systems, if you're typing your username, your password, and other potentially security relevant information right there on the command line — that's a yikes — other users might literally find it by using tools like the ps(1) command or by peeking around in the /proc file system. Not iconic. Not the move. 🫣

It's generally more secure to hand over your password info with options like the -P or -K options. And honestly? Configuring security relevant information inside the FreeIPMI configuration file is also a totally appropriate way to keep that info hidden. Lock it up, bestie. 🔒

Also, PSA: to prevent brute force attacks, some BMCs will temporarily "lock up" after a number of remote authentication errors. So if you're sitting there like "why won't it let me in 😭" — you may need to wait awhile for this temporary "lock up" to pass before you may authenticate again. It's not ghosting you, it's just on cooldown. 💀

🐛 REPORTING BUGS 🐛

Found a bug? Don't suffer in silence, tell the group chat:

  • <freeipmi-users@gnu.org>
  • <freeipmi-devel@gnu.org>

We want the tea. 🍓

Copyright © 2003-2015 FreeIPMI Core Team.

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.

(Yes bestie, it's GPL — the "or any later version" clause is right there, acting generous. 👑)

🦋 SEE ALSO 🦋

Go read these next, they're the friend group:

And the official hangout spot:

http://www.gnu.org/software/freeipmi/

🎀 and that's the whole thing 🎀

That was ipmi-sel, version 1.6.20, dated 2026-10-05 — you read the entire IPMI-SEL(8) page and honestly? Iconic behavior. Go touch some grass, then go check your SEL. 💅✨🌸

📦 where this page comes from