Dell Remote Access : Server : Chassis Intrusion is in critical state

Dell.iDRAC7.SNMPTrap.2385 (Rule)

Knowledge Base article:

Summary

Chassis Intrusion critical state alert

Causes

Chassis Intrusion has generated critical alert. Probable causes and corresponding resolutions for this condition are:

Cause	Resolutions
The chassis is open.	Close the chassis. Check system logs.
The chassis is open while the power is on.	Close the chassis. Check system logs.
The chassis is open while the power is off.	Close the chassis and verify hardware inventory. Check system logs.
A critical stop occurred during OS load.	Check video and operating system logs for additional information
BIOS detected an error configuring the Intel Trusted Execution Technology (TXT).	Check system hardware inventory and software configuration.
Processor detected an error while performing an Intel Trusted Execution Technology (TXT) operation.	Check system hardware inventory and software configuration.
BIOS Authenticated Code Module detected an Intel Trusted Execution Technology (TXT) error during POST.	Check system hardware inventory and software configuration.
SINIT Authenticated Code Module detected an Intel Trusted Execution Technology (TXT) error at boot.	Check system hardware inventory and software configuration.

Resolutions

Additional information on this issue may be available. Launch the DRAC or OMSA Console to debug further.

Element properties:

Target

Dell.RemoteAccess.iDRAC7

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Remotable

True

Alert Message

Dell Remote Access : Server : Chassis Intrusion is in critical state

{0}

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Dell.SNMPTrap.DSMT	Default
Alert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Dell.iDRAC7.SNMPTrap.2385" Enabled="true" Target="DAD!Dell.RemoteAccess.iDRAC7" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>AvailabilityHealth</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Dell.SNMPTrap.DSMT">

      <IP>$Target/Property[Type="DAD!Dell.RemoteAccess.RAC"]/IPAddress$</IP>

      <CommunityString>$Target/Property[Type="DAD!Dell.RemoteAccess.RAC"]/CommunityString$</CommunityString>

      <AllTraps>false</AllTraps>

      <OIDProps>

        <OIDProp>.1.3.6.1.4.1.674.10892.5.3.2.1.0.2385</OIDProp>

      </OIDProps>

      <EventOriginId>$Target/Id$</EventOriginId>

      <PublisherId>$Target/Id$</PublisherId>

      <PublisherName>iDRAC</PublisherName>

      <Channel>SnmpEvent</Channel>

      <LoggingComputer/>

      <EventNumber>2385</EventNumber>

      <EventCategory>5</EventCategory>

      <EventLevel>10</EventLevel>

      <UserName/>

      <Params/>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Dell.iDRAC7.SNMPTrap.2385.Rule"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventData/DataItem/Property[@Name="drsAlertMessage"]$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/Channel$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

        <SuppressionValue>$Data/EventCategory$</SuppressionValue>

        <SuppressionValue>$Data/EventLevel$</SuppressionValue>

        <SuppressionValue>$Data/UserName$</SuppressionValue>

        <SuppressionValue>$Data/EventNumber$</SuppressionValue>

        <SuppressionValue>$Data/EventData/DataItem/Property[@Name="drsAlertMessageID"]$</SuppressionValue>

        <SuppressionValue>$Data/EventData/DataItem/Property[@Name="drsAlertFQDD"]$</SuppressionValue>

        <SuppressionValue>$Data/EventData/DataItem/Property[@Name="drsAlertCurrentStatus"]$</SuppressionValue>

        <SuppressionValue>$Data/EventData/DataItem/Property[@Name="drsSystemServiceTag"]$</SuppressionValue>

      </Suppression>

      <Custom1>Alert Message ID = $Data/EventData/DataItem/Property[@Name="drsAlertMessageID"]$ </Custom1>

      <Custom2>Alert Message = $Data/EventData/DataItem/Property[@Name="drsAlertMessage"]$ </Custom2>

      <Custom3>Alert Status = $Data/EventData/DataItem/Property[@Name="drsAlertCurrentStatus"]$ </Custom3>

      <Custom4>Alert Service Tag = $Data/EventData/DataItem/Property[@Name="drsSystemServiceTag"]$ </Custom4>

      <Custom5>Alert FQDN = $Data/EventData/DataItem/Property[@Name="drsAlertFQDN"]$ </Custom5>

      <Custom6>Alert FQDD = $Data/EventData/DataItem/Property[@Name="drsAlertFQDD"]$ </Custom6>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>