Firmware quirks

Every entry here is encoded in the server’s behavior or docstrings; this page is the human-readable ledger.

Things that behave differently across iDRAC9 firmware lines (3.x → 7.x), or that fail in confusing ways. Check idrac_ping output for the firmware version before debugging.

Auth and sessions

• IP-block lockout: repeated failed logins (default: 3 fails in 60s) block the SOURCE IP for 60s, extending while attempts continue. A retry loop with bad credentials locks you out indefinitely. If auth suddenly fails with valid-looking credentials, STOP and wait a minute. Controlled by iDRAC attributes Lockdown.1.* / IPBlocking.1.*.
• Session limits: iDRAC9 allows ~8 concurrent web/Redfish sessions. mcidrac opens one per tool call and always DELETEs it, so leakage is unlikely from this server — but browsers with the web UI open, other scripts, and console viewers share the same pool.
• Idle timeout: default 30 min. A leaked session self-heals eventually.

Virtual media

• HTTPS ISO + self-signed cert fails silently-ish: InsertMedia accepts the URL, but the mount errors unless RFS.1.IgnoreCertWarning is Enabled (idrac_attributes_set). Plain HTTP on a management LAN avoids the issue entirely.
• Path moved at firmware 6.00, and iDRAC10 finished the move: virtual media members historically lived at Managers/iDRAC.Embedded.1/VirtualMedia/{CD,RemovableDisk}; 6.00+ prefers Systems/System.Embedded.1/VirtualMedia/1, and member names changed. On iDRAC10 the Manager path is GONE entirely — 404 (confirmed against Dell’s R770/R7725/XE9712 fw 1.10–1.30 captures). mcidrac tries the Manager collection, falls back to the System collection on 404, and matches devices by MediaTypes — but if you script raw paths, don’t hardcode either location.
• One image per device: InsertMedia on an occupied device fails; eject first (idrac_boot_to_iso does this automatically).
• The iDRAC streams, not copies: the HTTP/NFS server must stay up for the entire install. Range-request support required (Python’s http.server: fine; some minimal containers: not).

Boot control

• Standard Cd override can hit the physical drive: on boxes with a real optical drive, BootSourceOverrideTarget=Cd boots whichever CD device the BIOS enumerates first. Dell’s OEM attributes ServerBoot.1.BootOnce=Enabled + ServerBoot.1.FirstBootDevice=VCD-DVD target the VIRTUAL CD unambiguously — that’s what idrac_boot_to_iso uses.
• Boot-once clears itself after one boot; the mounted ISO does NOT auto-eject. Forgetting to unmount means the next manual reboot with boot-order changes can re-enter the installer.

Power

• PowerCycle ResetType (full off/on cycle) only exists on newer firmware. idrac_power_status shows what this box actually allows; idrac_power validates before posting.
• On when already on returns an error (not a no-op) on most firmware. Check power state first.

BIOS and attributes

• Validation happens at APPLY, not at PATCH: idrac_bios_set can return success for an invalid value; the config job then fails during POST with the real error message. Always poll the job after a BIOS change.
• Names and enum values are case-sensitive: Disabled works, disabled fails (at apply time, see above). Copy exact spellings from idrac_bios_get.
• DellAttributes partial success: PATCHing several attributes where one is read-only can return 200 with per-attribute complaints in @Message.ExtendedInfo. idrac_attributes_set surfaces these as messages — check them.

$expand and OData

• $expand=*($levels=1) needs firmware >= 4.10; older firmware returns 400 or silently ignores it. mcidrac falls back to per-member GETs automatically.

SCP (Server Configuration Profile)

• Export task morphs: while running, GET on the task returns TaskState JSON; when done, the SAME URI returns the SCP document itself.
• Import with ShutdownType=NoReboot leaves the job in Scheduled until a manual reboot — it looks stuck but isn’t.
• RAID sections in an SCP are applied literally — importing another box’s SCP with virtual-disk definitions can rebuild (= wipe) arrays. Always preview=true first.

HTML5 console

• GetKVMSession (temp-credential direct console URL) needs roughly firmware 5.x+. Older firmware: log into the web UI and launch from the dashboard. Temp credentials are single-use and expire in ~1 minute.

When the iDRAC itself is wedged

• The SSH CLI (ssh root@<idrac>) is a separate daemon from the web server — it often still works when HTTPS/Redfish is hung. From there: racadm racreset soft reboots only the iDRAC; the HOST KEEPS RUNNING.
• From the host OS: racadm racreset (OpenManage) or ipmitool mc reset cold.
• Physical: hold the front-panel i button ~15s.