Servers (Redfish)¶

This page gets Ferrule reading your servers through their management controller (the BMC), over Redfish: Dell iDRAC, HPE iLO, Supermicro, Lenovo XCC, and any other BMC that speaks it.

What Ferrule reads: each server's maker, model, serial number, BIOS version and BMC firmware; whether it is powered on, and the power it draws; the BMC's own health for the whole server; processors and memory; every temperature sensor with the BMC's own warning and critical lines; every fan; each power supply and whether the supplies are still redundant; and each drive behind the storage controller, with its health and, for SSDs, the life it has left. What it can't: it changes nothing. It can't power a server on or off, and it never opens a console.

Redfish is a standard every current BMC answers over HTTPS, whoever made the server, so one piece of Ferrule covers them all.

Several servers, one slot

One entry can list several BMCs that share the same account. Ferrule has eight source slots, so put every BMC with the same user and password in one.

Make a read-only account on each BMC¶

Make a local account named ferrule on each BMC, with the lowest role that can read, and give it the same password on every BMC in the group.

BMC	Where	Role
Dell iDRAC	iDRAC Settings → Users → Local Users → Add	Read Only
HPE iLO	Administration → User Administration → New	tick Login only, no other privilege
Lenovo XCC	BMC Configuration → User/LDAP → Create	ReadOnly
Supermicro	Configuration → Users → Add	Operator (see below)

Why Operator on Supermicro?

Supermicro's lowest role, User, can't read Redfish, so Operator is the least that works. Operator can also power the server on and off, so keep the password to this stack. Ferrule itself only ever reads.

Why no Redfish session?

Ferrule signs in with the user and password on each request (HTTP Basic) and never opens a Redfish session. Nothing is left open on the BMC between polls, and there is no session token to leak. Leave two-factor sign-in off for this account; the API can't answer it.

If the BMC can limit access to certain addresses, allow the Docker host that runs Ferrule on TCP port 443.

Enter it in the setup wizard¶

On the wizard's What you have page, set Servers (Redfish) to the number of groups you have (BMCs sharing one account count as one). On its page:

Name: what you call the group, such as rack-a.
Addresses: each BMC's address with https://, separated by commas: https://192.168.1.31,https://192.168.1.32.
BMC user and Password: the account you made above.
Tick Verify the certificate only if the BMCs have certificates your network trusts. Most ship one of their own making.
Click Test.

When it works you see ✓ Connected: and what it found, such as 2 servers, all healthy. Any alert a server has right now is listed under it.

Editing the stack by hand

The secret is the account's password. Write any $ as $$.

SOURCE_7=redfish https://192.168.1.31,https://192.168.1.32 name=rack-a user=ferrule
SOURCE_7_SECRET=<password>

Add tls=verify to check certificates. See Every variable.

Where it shows up¶

Each server gets a panel on the Power and servers tab, named by its BMC's address: the BMC's verdict and the vitals first, then temperatures, fans, power supplies and drives.

It alerts when:

Alert	When	Level
Server health not OK	The BMC reports the whole server as Warning or Critical	warning, critical
Server temperature high	A sensor reaches the BMC's own warning line (non-critical), or its critical line	warning, critical
Server fan failed	The BMC reports a fan Warning or Critical, or a fan at or under its own critical speed	warning, critical
Server power supply failed or redundancy lost	A supply is Warning or Critical, or the supplies are no longer redundant	warning, critical
Server drive not OK	A drive is Warning or Critical, or predicts its own failure	warning, critical
Source unreachable	The BMC stops answering	critical

Why the BMC's own lines?

Every server model runs at different temperatures, and the people who built it set the warning and critical lines for each sensor. Ferrule uses those, so a hot-running CPU that is within its rating doesn't alert. A temperature that has alerted stays alerted until it is 2 °C below the line, so a sensor sitting on the line is one alert, not one a minute.

Some readings are missing

Ferrule reads the Thermal and Power resources that every current BMC serves. A BMC that offers only the newer ThermalSubsystem and PowerSubsystem has its temperatures, fans or supplies left out, and the panel says so under Some readings are missing. Empty bays (no drive, no supply, no fan) are left out; they aren't faults.

If something's wrong¶

The Docker host must reach each BMC on TCP port 443.

What you see	What to do
Redfish refused the credentials (401)	Check the user and password, and that the account isn't locked or waiting for a password change at first sign-in.
Redfish denied the account access (403); check its role	Give the account the role in the table above.
no Redfish service at ...	Check it's the BMC's address, not the server's own, and that Redfish is turned on in the BMC's network services.
none of the N BMCs answered	No BMC in the list answered: check the account, the addresses and the firewall.
x509: certificate ...	The BMC's certificate isn't trusted: untick Verify the certificate, or take `tls=verify` off the line.

See Troubleshooting for more.