When a PowerEdge server reports a problem, the first evidence is in iDRAC9's two logs. The System Event Log (SEL) records hardware events on the managed system. The Lifecycle Log (LC log) is broader: system health, storage, firmware and driver updates, configuration changes, licensing, logins and your own work notes. Dell states that every SEL entry also appears in the Lifecycle Log. This guide shows how to read, filter, decode and export both, and how to clear the SEL without losing evidence.
Before you start
- Log in to iDRAC9 with an account that can view logs. Clearing the SEL needs the Clear Logs privilege; adding work notes needs the iDRAC logs privilege.
- Check the iDRAC date and time. Dell notes that SEL and LC timestamps may not match while iDRAC is rebooting.
- If you will send logs to Dell support, a SupportAssist collection may be better: see SupportAssist collection from iDRAC9.
Step 1 — Read the System Event Log
- In the iDRAC web interface, go to Maintenance > System Event Log.
- Each entry shows a health indicator, a time stamp and a description. Start from the newest critical and warning entries.
- Click Save As to keep a copy before you change anything.
From RACADM, racadm getsel shows the whole log and racadm getsel -i shows the number of entries. More health and log commands are in racadm health and log commands.
Step 2 — Read and filter the Lifecycle Log
- Go to Maintenance > Lifecycle Log.
- Under Log Filter, choose the Log Type and Severity, enter a keyword (for example a slot number or a message ID) and set a date range.
- Click Apply. Matching entries appear in Log Results.
- Click the + icon on an entry to see its message ID details and to add a comment.
| Category | What it holds |
|---|---|
| System Health | Hardware alerts inside the chassis: temperature, voltage, device errors |
| Storage | Controller, drive and virtual disk alerts |
| Updates | Firmware and driver upgrades and downgrades |
| Audit | Logins, logouts, failed logins, sessions, power states |
| Configuration | Hardware, firmware and software configuration changes, including RAID changes |
| Work Notes | Notes added by administrators |
Configuration jobs started from RACADM or the web interface are logged with the user, interface and source IP address, which helps when you need to know who changed what. RACADM can filter too, for example storage and system entries at warning or critical severity:
racadm lclog view -c storage,system -s warning,criticalStep 3 — Decode a message ID
Every entry carries a message ID such as PDR1001. Look it up in Dell's iDRAC Error and Event Messages Reference Guide, which covers 12G to 17G PowerEdge servers. The prefix names the category (Dell's examples: PSU = power supply, STOR = storage, VLT = voltage; PDR = physical disk). Each entry lists the message, a detailed description, the recommended response action, category and severity, and in many cases the text shown on the server's LCD.
| ID | Message | Recommended action (Dell) |
|---|---|---|
| PDR1001 | Fault detected on drive arg1 in disk drive bay arg2. | Analyze the TTY logs for events, sense codes or SMART attributes; update drive and PERC firmware; remove and reseat the disk |
| SEL0008 | System event log (SEL) is full. | Back up and clear the log |
| SEL0004 | Log cleared. | None (informational) |
| LOG007 | The previous log entry was repeated arg1 times. | None; it summarises duplicate events |
About LOG007: Dell explains that repeated events are logged once by default, followed by LOG007 with the count. To log every duplicate, the guide gives racadm set idrac.logging.LCDuplicateEventEnable enabled.
Step 4 — Export the logs
When the Lifecycle Log reaches 800 KB, iDRAC compresses and archives older entries. You can only view and filter the active part in the web page; exporting is the only way to get the archived entries.
- On the Lifecycle Log page click Export.
- Choose Local (your workstation) or Network (a share). Dell recommends avoiding special characters in share user names and passwords, or percent-encoding them.
- Click Export. The result is one zipped XML file (
.xml.gz) with active and archived entries, ordered by sequence number.
RACADM syntax for a network share, from the RACADM CLI Guide:
racadm lclog export -f <filename> -u <username> -p <password> -l <CIFS or NFS or TFTP or FTP share>To keep a copy off the server permanently, enable remote system logging so entries are written to a syslog server at the same time: see iDRAC9 alerts, email, SNMP and syslog.
Step 5 — Clear the SEL only after saving it
Warning: Clearing the SEL deletes the hardware event history that Dell support and your own troubleshooting rely on. Export the SEL (Save As) and the Lifecycle Log first, and do not clear while a fault is still being investigated.
- Web: on Maintenance > System Event Log click Clear Log. The button appears only if you have the Clear Logs permission.
- RACADM:
racadm clrsel. - iDRAC Settings utility (F2 at boot): open System Event Log, which shows the total number of records, and choose to clear them.
After a clear, iDRAC writes an entry to the Lifecycle Log with the user name and IP address that cleared the SEL, so the action stays traceable. A common reason to clear is SEL0008 (SEL is full), whose documented action is to back up and then clear.
Keep a record with work notes
Go to Dashboard > Notes > add note, type up to 255 characters and click Save. The note is stored in the Lifecycle Log as an event. Work notes cannot be deleted, so write them as you would a change record, for example "Replaced drive bay 3, case number ...".
Frequently asked questions
Why do I see the same event in both logs?
By design. Dell states that a SEL entry is also available in the Lifecycle Log, which adds storage, update, configuration and audit events on top.
Why can I not see older Lifecycle Log entries?
They were archived when the log passed 800 KB. Export the log to get active and archived entries in one file.
Checklist
- iDRAC time checked before reading timestamps.
- SEL reviewed and saved; Lifecycle Log filtered by severity and category.
- Message IDs looked up in the EEM Reference Guide; recommended actions noted.
- Lifecycle Log exported (.xml.gz) when archived entries or a support case are involved.
- SEL cleared only after export, by an account with Clear Logs permission.
- Work note added for any repair or change.
Skyline can supply, configure and maintain Dell, HPE and Huawei servers under an annual maintenance contract (AMC). Contact us.
Comments
0 total · 0 threads