High CPU Temp on Proliant G7 Servers

[Stephan G]

Don't use the beta firmware. There is already Version 1.61 final out.

[Torsten.]

... but I was told the critical temp. fix is not in version 1.61 but maybe in 1.70 ... ?

[Stephan G]

I installed it on every server and don't have any problems since then.

But seems right - there is no entry in the release notes.

[Oscar A. Perez]

Mani,

That logging issue is in 1.57 as well and got fixed in 1.61. It happens everytime HP Agents update the iLO clock. Or when the server is in POST and executing the iLO Option ROM.

Edit: Enabling iLO3 to syncronize time with an NTP server will solve the logging issue.

[Oscar A. Perez]

Stephan,

iLO3 v1.61 doesn't have the fix for the false CPU overheating bug. However, there were changes added to 1.57 (same changes are in 1.61) that helped mask the issue for most case. But, you can still get the false CPU over temps with 1.61.

[Rinatishe]

Great news!

Go to ftp://ilo4me:G!v3t2me@ftp.usa.hp.com & download ilo3_165_Final.zip

BUILD DATE: 11/11/2013

FIXES:

The following issues are resolved in this firmware version:

- IPMI transactions to read the power consumption from Power Supplies P/N 499250-201 might
report an incorrect value of zero watts.
- CPU overheating messages could be incorrectly detected and logged in the IML and causing iLO
to initiate a server shutdown.
- A security vulnerability related to SSRT101326 has been addressed.
- The following message appears when the Java IRC is started: This application will be blocked
in a future Java security update because the JAR file manifest does not contain the Permissions
attribute. This message will continue to appear when you run Java 7 unless you install an SSL
certificate that is signed by a trusted Certification Authority.

[anthony11]

- The following message appears when the Java IRC is started: This application will be blocked
in a future Java security update because the JAR file manifest does not contain the Permissions
attribute. This message will continue to appear when you run Java 7 unless you install an SSL
certificate that is signed by a trusted Certification Authority.

---

For those of us who aren't versed in certificate-fu:  where would one get such a cert?  Installed on iLO, or on each desktop?  How?

[Oscar A. Perez]

The iLO3 1.65 containing the fix for the false overheating bug was released to the HP website over the weekend.

About the Java remote console warning message that users started seeing after upgrading to the latest Java7 u45. We added to the JAR file manifest the Permissions attribute but, users will still get the warning unless users import into each iLO a SSL certificate signed by a trusted Certification Authority, use the iLO DNS name instead of IP address to connect to iLO and import into the JVM keystore the root certificate of the CA.

[anthony11]

Thanks, Oscar!  Should we expect a similar cert requirement to appear eventually for iLO2 and especially iLO4?  I found 1.65 here:

http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetails/?sp4ts.oid=4154847&spf_p.tpst=swdMain&spf_p.prp_swdMain=wsrp-navigationalState%3Didx%253D3%257CswItem%253DMTX_b220852c69c24a7aae269026f7%257CswEnvOID%253D%257CitemLocale%253D%257CswLang%253D%257Cmode%253D4%257Caction%253DdriverDocument&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vigne...

(What a URL!)

but don't see much advice on how to handle the cert requirements, would be very grateful for a quick summary of how to get/install from the CLI so I can have Puppet automate the process.  I know we do some self-signed certs and some from Tucows OpenSRS, but am not versed in the specifics of cert management.

-- Anthony

[Oscar A. Perez]

Anthony,

The Java manifest fix has been added to iLO2 v2.23, iLO3 v1.65 and iLO4 v1.32.  They were all released to the HP website over the weekend.

For the SSL cert, you need each iLO to generate a Certificate Signing Request (CSR) then, you send this CSR to your own Certification Autorithy (CA) and once it is signed by your CA, you import that signed certificate back into the respective iLO.

There is no CLI command to do this but, you can use XML scripts and the iLO webUI.  I would suggest you to look in the iLO scripting and command line guide for the XML script with the CERTIFICATE_SIGNING_REQUEST tag.  Also, for iLO2, you might need to run a couple of extra XML scripts to properly configure the certificate parameters you need prior to generating the CSR.  Look for CSR_CERT_SETTINGS and CERT_SIGNATURE_ALGORITHM tags.