Dell OM : Chassis Intrusion is in critical state

Dell.ManagedServer.Alert.2385 (Rule)

Knowledge Base article:

Summary

Chassis Intrusion critical state alert

Causes

Chassis Intrusion has generated critical alert. Probable causes and corresponding resolutions for this condition are:

Cause	Resolutions
The chassis is open.	Close the chassis. Check system logs.
The chassis is open while the power is on.	Close the chassis. Check system logs.
The chassis is open while the power is off.	Close the chassis and verify hardware inventory. Check system logs.
A critical stop occurred during OS load.	Check video and operating system logs for additional information
BIOS detected an error configuring the Intel Trusted Execution Technology (TXT).	Check system hardware inventory and software configuration.
Processor detected an error while performing an Intel Trusted Execution Technology (TXT) operation.	Check system hardware inventory and software configuration.
BIOS Authenticated Code Module detected an Intel Trusted Execution Technology (TXT) error during POST.	Check system hardware inventory and software configuration.
SINIT Authenticated Code Module detected an Intel Trusted Execution Technology (TXT) error at boot.	Check system hardware inventory and software configuration.

Resolutions

Additional information on this issue may be available. Launch the iDRAC Console to debug further.

Element properties:

Target

Dell.ManagedServer

Category

Alert

Enabled

True

Event_ID

2385

Event Source

LifeCycle Controller Log

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Remotable

True

Alert Message

Dell OM : Chassis Intrusion is in critical state

Event Description: {0}

Event Log

System

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="Dell.ManagedServer.Alert.2385" Enabled="true" Target="DellManagedServer!Dell.ManagedServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Property[Type="DellManagedServer!Dell.ManagedServer"]/HostName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">2385</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">LifeCycle Controller Log</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Dell.ManagedServer.Alert.2385.Rule"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/Channel$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

        <SuppressionValue>$Data/EventCategory$</SuppressionValue>

        <SuppressionValue>$Data/EventLevel$</SuppressionValue>

        <SuppressionValue>$Data/UserName$</SuppressionValue>

        <SuppressionValue>$Data/EventNumber$</SuppressionValue>

        <SuppressionValue>$Data/EventDescription$</SuppressionValue>

      </Suppression>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>