banshee/hardware-collection/hardware/redfish/https/event-log

Event logs of a server, by Redfish

Returns, for each event log a server's management card serves under its systems by Redfish (the System Event Log, HPE's Integrated Management Log, Lenovo's platform log), the number of its entries of critical and of warning severity, and of all its entries. Three watches are offered, none checked by default: the logs keep old entries, and their content differs from one brand to the next, so each one is turned on knowingly.

Versions

Generic: written for the LogService and LogEntry schemas of DMTF Redfish, whose fields read here have kept their form since the first versions (2016). Any management card that serves them. Hence the common level.

How it works

The collector reads, the account in Basic, GET https://<host:address>/redfish/v1/Systems, each system it lists, its LogServices collection, each log service in it, then every page of its Entries: the card gives the next page's path under Members@odata.nextLink when it cuts the list.

{"Members": [{"Id": "1", "Severity": "Critical", "Message": "The power input for power supply 1 is lost.", "Created": "2026-10-27T08:12:44+00:00"}],
 "Members@odata.nextLink": "/redfish/v1/Systems/1/LogServices/IML/Entries?$skip=50"}

A log is named by its Name (System Event Log, Integrated Management Log), or its Id without one, or its path without either (a JSON null reads as '', "not given"). An entry whose Severity is null is counted in entries only.
critical and warning count the entries of each Severity; entries counts them all.
A new entry raises through the rise of its count, over a day: an entry kept in the log for years does not raise. A log cleared lowers the counts, and the watches start again from there.
A code 401 or 403 stops the collector misconfigured; any other code but 200 stops it unreachable, with the path it was reading. A card that serves no log under its systems stops it misconfigured.

The password comes from protocol:http:password, a secret variable: it only goes in the Basic header. Redfish only reads with GET: nothing is cleared nor acknowledged.

Prerequisites

The management card's address as the host's address, reachable from the poller in HTTPS (443); its certificate trusted by the TLS profile of the probe (protocol:http:fingerprint, or its authority under protocol:tls:authorities).
A read-only account on the card (the ReadOnly role of Redfish), in protocol:http:user and protocol:http:password.

Outputs

Name	Label	Unit	Per instance
`critical`	Critical entries	—	yes, per log
`warning`	Warning entries	—	yes, per log
`entries`	Entries	—	yes, per log

Watches

Name	Title	Kind	Defaults	Checked by default
`new-critical`	New critical entries	increase, on `critical`	critical beyond 0 in 1 d	no
`new-warning`	New warning entries	increase, on `warning`	warning beyond 0 in 1 d	no
`missing`	Log missing	expected instances, on `entries`	no log named: it raises nothing until names are set on the probe	no

Limits

The address is written into the URL as is: an IPv6 address must be given as a name.
Only the logs under the systems are read, not those under the managers (the card's own logs, such as Dell's Lifecycle Log, thousands of entries long). Which logs a card serves under its systems differs by brand and firmware, and is not checked: a card that serves none there stops the collector misconfigured.
The message of an entry is not returned: the collector counts, and the card's own page tells what happened.
A full log that drops its oldest entry as it writes a new one keeps the same count: a new entry then does not raise. A count that goes down (a log cleared) starts the watch's window again.
One request per page of entries: a long log takes as many round trips.
Not checked against a card: the paths and fields are those of the DMTF Redfish schemas (ComputerSystem, LogService, LogEntry), read on redfish.dmtf.org.