Censusby Steward IT

Documentation › Using Steward IT Census

Server hardware health

Servers have a management controller of their own: a small computer on the motherboard that watches the hardware and keeps working when the server is off or its operating system hangs. Census reads it over Redfish, the industry standard interface these controllers offer, so you see failing fans, overheating, a power supply that lost redundancy or a drive that predicts its own failure, together with the rest of the server's inventory.

Supported: HPE iLO 4, 5 and 6, Dell iDRAC 8 and 9, Lenovo XClarity Controller, Supermicro, Cisco CIMC and any other controller that speaks Redfish.

Setting it up#

  1. On each controller, create a read-only account for Census:
    • HPE iLO: a user with only the Login privilege.
    • Dell iDRAC: a user with the Read Only role.
    • Lenovo XClarity Controller: a user with the Read-only role.
    • Supermicro, Cisco CIMC and others: the lowest role that can sign in to the web interface.
  2. Under Scanning › Credentials, add a credential of the type Server management controllers (Redfish) with that account. Fill in the HTTPS port only when the controller doesn't answer on 443.
  3. Make sure a scan target covers the controllers' addresses (their management network). The next scan reads them.

Census only reads (HTTP GET); it never changes a setting, powers a server on or off, or clears a log.

Security#

  • The password is only sent over HTTPS, and only to a device that first answers as a Redfish service without a login. Ordinary web servers never receive it.
  • Controllers come with self-signed certificates, so Census remembers the certificate a controller shows the first time and refuses to send the password if it changes later. The controller's page then says so under The last scan couldn't log in. After a firmware update or a new certificate on the controller (both change it), an administrator clicks Trust the new certificate (or Trust a new controller certificate on the Hardware health tab) and the next scan accepts it.
  • As with every credential, a mapped credential (used only for the controllers' addresses or range) is safer than a global one: see Global credentials and rogue devices.
  • Remote scanners read controllers at their sites too, when you allow the credential on that scanner and the scanner runs this Census version or later.

What you see#

The hardware belongs to the server, not to the controller's network address. Census therefore files it on the server's own asset, found by its serial number (the same one the Census agent or a WinRM/SSH inventory reports; on Dell servers the service tag). The server's existing inventory stays as it is: the controller only fills in a manufacturer, model or serial number that is still empty. When the server isn't in the inventory yet, Census adds it as type Server (one asset, using a license like any other) and the agent or a login inventory later completes it.

The controller itself appears as a network device of type BMC, with its own address, model and firmware, linked to its server.

The server's Hardware health tab shows:

  • the overall health (OK, Warning or Critical) and every component that isn't OK;
  • power state and current power draw, model, serial number, BIOS, processors and memory;
  • the controller: model, firmware version, address (a link to its web page), name and MAC address;
  • fans and temperatures with their readings and thresholds;
  • power supplies with model, serial number, firmware, capacity and status;
  • storage: controllers and drives with model, serial number, size, type, status and the life left of SSDs (drives that predict a failure are shown as Warning);
  • the firmware inventory of the server's components;
  • the newest hardware log entries (system event log, Integrated Management Log…).

Health changes are written to the server's History: a component that turns Warning or Critical (or gets worse), a new critical log entry, and the return to OK. A new controller firmware version is recorded as a change too.

Reports#

Under Reports › Hardware health:

Report
Servers with hardware warnings or faults Every component that isn't OK, per server
Management controller firmware Each server's controller with its firmware and BIOS version, to find controllers that need an update
Server power supplies Power supplies with status, model, serial number and firmware
Server drive health Drives behind the servers' storage controllers, the ones that aren't OK first
Servers by power consumption The power each server drew at the last scan, highest first

Alert#

The alert Server hardware fault (Configuration › Alerts & scheduled reports) emails each server whose controller reports a new fault: a component that turned Warning or Critical, or got worse, since the last scan, and new critical entries in its hardware log. Each fault is emailed once. Choose Critical faults only to leave out warnings, or leave out log entries.

Good to know#

  • The controller is read at each scan of its address. How fresh the data is depends on the scan target's schedule; daily is a good start.
  • Older controllers (iLO 4, iDRAC 8) offer less over Redfish: drive details may be missing there. The tab lists what couldn't be read under Not everything could be read.
  • Only the first page of each hardware log is read, so very long logs may show fewer than the 50 newest entries.
  • A controller that manages several servers (blade enclosures) is read for its first server only.