This is an OEM record

We’ve been having an issue where our Dell servers will fill up their hardware event logs with the following, particularly during reboot:

...
Tue Jan 17 2012 09:02:00 This is an OEM record.
Tue Jan 17 2012 09:02:00 This is an OEM record.
Tue Jan 17 2012 09:02:00 This is an OEM record.
...

This is something of an issue since the event log fills up rather quickly, and you lose the ability to collect more meaningful logs (hardware failure!). But what does this mean, and why so many of the same message?

The short version is that Windows includes an IPMI driver which has the ability to also write to the machine system event log (SEL). Everywhere you see “This is an OEM record” is basically the DRAC’s way of saying “The OS wrote this, and I don’t know what it means.” The DRAC can only decode its own entries.

This handy article actually does a nice job of explaining how to use racadm to decode said logs: http://en.community.dell.com/techcenter/systems-management/w/wiki/bmc-sel-log.aspx. It also explains why Windows shutdowns tend to spam the logs with lots of entries, and how to stop it from doing so via a regedit.

Finally, here is the official Microsoft KB for disabling the IPMI logging: http://support.microsoft.com/kb/962920

Leave a Reply