LOM it up!
Lights out management on the new Intel XservesNow that we have LOM what the heck do you do with it? Read on for how to setup it up and what you can do with it once it's working.
LOM, or lights out management, allows you to manipulate the server hardware outside of the OS actually running, or not running as the case may be, on the server box itself. At its basic level, LOM will allow you to power on and off the system remotely.
On the Intel Xserve, the only Apple system with support for lights out management at this time, LOM is provided by a BMC, baseboard management controller, chip that uses IPMI protocols for communication. On OS X Server there are a few applications that can use the LOM setup, or there is the ipmitool for access the LOM functions via the CLI.
IPMI runs over UDP port 623, so you'll need to make sure that port is available to any remote management systems.
IMPORTANT: On the Intel Xserve the LOM actually uses a secondary IP on each of the Ethernet interfaces. On other systems that you may have managed there is a dedicated Ethernet port for the LOM functions. Each Ethernet port can have a LOM IP assigned to it, and those IPs need not be on the same subnet. From what I can tell, you can't get the BMC to use VLAN tagging, but it does have a separate MAC address from the standard Ethernet ports on the Xserve, so you could VLAN via MAC address if you have network infrastructure that supports that.
Before going any further...
You MUST repeat MUST use the installers on the DVD that came with your Xserve, don't be silly and embarass yourself like I did and think that the Server Admin Tools installer on the Apple site will work. Use the ones from your DVDs. Without installing the updated tools on your management station you won't be able to do anything remotely.
Turning it on
If you installed your Xserve from scratch the Server Assistant application, what you see when you first boot up a newly installed server, should have given you the option to set an IP address for the LOM interfaces. If you're doing a remote install make sure that you have the latest Server Tools, see above, and then the Server Assistant will also be able to set the IP address and username/password for the LOM configuration. Note that the LOM username and password is separate from any user on the system as this is kept on the BMC chip itself. It would also be rather hard to access system users when the system is turned off.
Once your server is up and running you are able to change the IP address or user assigned to the LOM configuration by using Server Monitor and the "Configure Local Machine" option under the Server menu.
Applications
Server Monitor only uses the LOM interface on the new Xserves. Pointing it towards the normal IP of the system won't return any information. Once connected you are able to use the "Edit Accounts" item in the Server menu to setup LOM accounts. However you won't be able to change the IP address of the LOM interface without using Server Monitor on the local machine.
If you power off the system, Server Monitor will still see the server but will show a half green circle next to it instead of the full green circle. Also you won't be able to get any information on the system other than it's there at that IP. You can, and this is really what you care about when using LOM, power on the system from Server Monitor.
Apple Remote Desktop acts in a slightly different way then Server Monitor does. Once you've installed the Server Admin Tools the next time you launch ARD it will update itself with some BMC components. At which point you'll be able to select an Intel Xserve and in the Info window there will be a second username and password field for a LOM user. Then you can control-click on the column titles in the computer list and you'll have the option to add a "LOM Status" column. Once configured with a LOM user ARD will allow you to power off and power on your servers.
ipmitool
ipmitool is a CLI tool for configuration of the BMC chip. It can be used on the local system or across the network. The tool is from an open source project and is available for a number of systems. So it should be possible to compile ipmitool on another system and manage your Xserves from there, although I haven't actually tried that.
Before diving into ipmitool you should probably read over the manpage for it as it doesn't seem that the Server Admin Tools install one for you. The syntax for the tool is pretty simple, just keep in mind that if you have the username or password wrong you won't get an error. That put me off for a while when I was using a bad password and thought the tool was busted. It's also important to keep in mind that there are a number of features that are available to you through ipmitool that the BMC on the Xserves does not currently support.
So here's some examples of using this tool remotely:
ipmitool -H IP address -U user -P password command
ipmitool -H 10.0.1.20 -U admin -P secretpassword chassis status
ipmitool -H 10.0.1.20 -U admin -P secretpassword chassis power off
ipmitool -H 10.0.1.20 -U admin -P secretpassword lan print 1
ipmitool -H 10.0.1.20 -U admin -P secretpassword chassis identify 120
ipmitool -H 10.0.1.20 -U admin -P secretpassword sdr list compact
ipmitool -H 10.0.1.20 -U admin -P secretpassword sensor get "CPU Fan 2 Inlet"
Other Notes
At times when first setting up the LOM configuration you may need to reset the controller. I noticed that the first time I changed the username and password it didn't seem to take. To reset the controller you need to remove the system from any power for 30 seconds. So pull the plug out of the back and kick back on a natural for a bit. When everything gets powered on you should be good.
Also, while the password is passed as an MD5 hash, the communication itself is not encrypted. Probably not a big deal, but it would behoove you to keep your LOM traffic on a separate LAN. It looks like with ipmitool you can also only allow specific hosts to be able to access the LOM settings, but I haven't had a chance to look at that too closely.