System management audit log snapshot

1. A method to detect tampering with functional components of an information handling system (IHS), the method comprising:

randomly generating a unique code;

a host processor subsystem creating a time-stamped system log entry for a last authorized configuration change of locally-available information handling resources;

storing the time-stamped system log entry in a system memory of the IHS;

generating, by a service processor of a remote access controller (RAC) of the IHS, a system management audit (SMA) log snapshot of the time-stamped system log entry combined with the unique code, the generating comprising:

accessing the time-stamped log entry and the unique code in the system memory by the service processor via a RAC service manager executed by the host processor subsystem; and

storing, by the RAC, the SMA log snapshot in persistent memory of the RAC, which memory is not readable from an external device;

providing the SMA log snapshot to an audit device prior to transit of the IHS, the provided SMA log snapshot for use by the audit device in determining if tampering has occurred with the IHS during transit of the IHS or after the IHS arrives at an end user destination prior to use by an intended end user;

in response to powering up at least a portion of the IHS after transit:

obtaining from the IHS a current SMA log snapshot that includes a current SMA log entry and a current unique code; and

providing access to the current SMA log snapshot by the audit device, which performs a comparison of the current SMA log snapshot with the SMA log snapshot provided to the audit device prior to transit of the IHS to identify whether there has been tampering with the IHS during transit or prior to use by the intended end user.

2. The method of claim 1 , further comprising:

presenting the SMA log entry and the unique code on a user interface device of the audit device in human-readable form, wherein the audit device separately conveys the SMA log snapshot to a recipient of the IHS in a shipping or transmission channel that is apart from the IHS.

3. The method of claim 1 , further comprising:

determining respective identifiers of one or more information handling resources that are locally available to the IHS during: (i) each start-up; and (ii) each hot plugging event during runtime;

in response to detecting a configuration change in the one or more information handling resources, dynamically creating a new time-stamped system log entry, wherein a new time-stamped system log entry is automatically generated for each detected configuration change;

determining whether any prior time-stamped system log entry exist; and

in response to determining that a prior time-stamped system log entry does not exist, generating a new unique code that is stored with the new time-stamped system log entry in an updated SMA log snapshot.

4. The method of claim 1 , further comprising:

prior to powering down the IHS for transit:

deleting any prior time-stamped system log entry in the system memory;

creating the last authorized time-stamped system log entry with the unique code;

storing the last authorized time-stamped system log entry in system memory; and

generating the SMA log snapshot that is locally stored in RAC memory and shared with the remote audit device.

5. The method of claim 1 , further comprising:

prior to powering down the IHS for transit, transmitting the SMA log snapshot to a remote storage device;

subsequent to powering up, providing access to a management console of the recipient of the IHS to: (i) the current SMA log snapshot stored on the IHS; and (ii) the transmitted SMA log snapshot stored on the remote storage device.

6. The method of claim 1 , wherein:

randomly generating the new unique code and creating the time-stamped log entry comprises:

determining whether a reset trigger is received by a host processor subsystem from the remote access controller (RAC); and

in response to determining that the reset trigger is received by the host processor: (i) clearing any time-stamped log entries in system memory; and (ii) generating a new unique code; and

the method comprises: generating the SMA log snapshot using the new unique code and a current time-stamped log entry; and providing, by the RAC to the audit device, the SMA log snapshot via a network interface of the IHS.

7. A controller comprising:

an interface in communication with an audit device;

a processor subsystem which executes a system management audit (SMA) agent that configures the processor subsystem to:

randomly generate a unique code;

create a time-stamped system log entry in a system memory of the IHS for a last authorized configuration change of locally-available information handling resources; and a service processor which:

generates a SMA log snapshot of the time-stamped system log entry combined with the unique code;

stores the SMA log snapshot in a persistent memory that is not readable from an external device;

provides the SMA log snapshot to the audit device prior to transit for use in determining if tampering has occurred with the IHS during transit of the IHS or at an end user destination;

in response to powering up at least the controller of the IHS after transit, obtains a current SMA log snapshot that includes a current SMA log entry and a current unique code; and

provides access to the current SMA log snapshot by the audit device to enable comparison of the current SMA log snapshot to the SMA log snapshot from prior to transit for identifying when there has been tampering with the IHS during transit or prior to use by the intended end user.

8. The controller of claim 7 , wherein the SMA agent executed by the processor subsystem provides the SMA log entry and the unique code to a user interface device of the audit device in human-readable form and the audit device separately conveys the SMA log snapshot to a recipient of the IHS in a shipping or transmission channel that is apart from the IHS.

9. The controller of claim 7 , wherein the SMA agent executed by the processor subsystem:

determines respective identifiers of one or more information handling resources that are locally available to the IHS during: (i) each start-up; and (ii) each hot plugging event during runtime;

in response to detecting a configuration change in the one or more information handling resources, dynamically creates a new time-stamped system log entry;

determining whether any prior time-stamped system log entry exist; and

in response to determining that a prior time-stamped system log entry does not exist, generates a new unique code that is stored with the new time-stamped system log entry in an updated SMA log snapshot.

10. The controller of claim 7 , wherein the SMA agent executed by the processor subsystem:

prior to powering down the IHS for transit:

deletes any prior time-stamped system log entry in the system memory;

creates the last authorized time-stamped system log entry with the unique code;

stores the last authorized time-stamped system log entry in system memory; and

generates the SMA log snapshot that is locally stored in RAC memory and shared with the remote audit device.

11. The controller of claim 7 , wherein the SMA agent executed by the processor subsystem:

prior to powering down the IHS for transit, transmits the SMA log snapshot to a remote storage device;

subsequent to powering up after transit, provides access to a management console of the recipient of the IHS to: (i) the current SMA log snapshot stored on the IHS; and (ii) the transmitted SMA log snapshot stored on the remote storage device.

12. The controller of claim 7 , wherein:

the processor subsystem comprises: (i) a host processor subsystem coupled to system memory; and (ii) a service processor of a remote access controller (RAC) coupled to persistent memory;

the SMA agent is executed in part by the host processor and in part by the service processor;

the host processor subsystem randomly generates the new unique code and creates the time-stamped log entry by:

determining whether a reset trigger is received;

in response to determining that the reset trigger is received: (i) clears any time-stamped log entries in system memory; and (ii) generates a new unique code;

the service processor generates the SMA log snapshot by:

accesses the time-stamped log entry and the unique code in system memory via a RAC service manager executed by the host processor subsystem; and

stores, by the RAC, the SMA log snapshot in persistent memory of the RAC; and

providing, by the RAC, the SMA log snapshot in persistent memory via a network interface of the IHS to the audit device.

13. An information handling system (IHS) comprising:

an interface that enables communication with an audit device;

locally-available information handling resources;

system memory;

a processor subsystem which executes a system management audit (SMA) agent that configures the processor subsystem to:

randomly generate a unique code;

create a time-stamped system log entry in the system memory of the IHS for a last authorized configuration change of locally-available information handling resources; and

a service processor of a remote access controller that:

generates a SMA log snapshot of the time-stamped system log entry combined with the unique code;

stores the SMA log snapshot in a component that is not readable from an external device;

provides the SMA log snapshot to the audit device prior to transit for use in determining if tampering has occurred with the IHS during transit of the IHS or at an end user destination;

powers down the IHS for transit;

in response to powering up at least the controller of the IHS after transit, obtains a current SMA log snapshot from the current SMA log snapshot including a current SMA log entry and a current unique code; and

provides access to the current SMA log snapshot by an audit device, which performs a comparison of the current SMA log snapshot to the SMA log snapshot received prior to transit of the IHS to identify when there has been tampering with the IHS during transit or prior to use by the intended end user.

14. The IHS of claim 13 , wherein the SMA agent executed by the processor subsystem provides the SMA log entry and the unique code to a user interface device of the audit device in human-readable form and the audit device separately conveys the SMA log snapshot to a recipient of the IHS in a shipping or transmission channel that is apart from the IHS.

15. The IHS of claim 13 , wherein the SMA agent executed by the processor subsystem:

determines respective identifiers of one or more information handling resources that are locally available to the IHS during: (i) each start-up; and (ii) each hot plugging event during runtime;

in response to detecting a configuration change in the one or more information handling resources, dynamically creates a new time-stamped system log entry;

determining whether any prior time-stamped system log entry exist; and

in response to determining that a prior time-stamped system log entry does not exist, generates a new unique code that is stored with the new time-stamped system log entry in an updated SMA log snapshot.

16. The IHS of claim 13 , wherein the SMA agent executed by the processor subsystem:

prior to powering down the IHS for transit:

deletes any prior time-stamped system log entry in the system memory;

creates the last authorized time-stamped system log entry with the unique code;

stores the last authorized time-stamped system log entry in system memory; and

generates the SMA log snapshot that is locally stored in RAC memory and shared with the remote audit device.

17. The IHS of claim 13 , wherein the SMA agent executed by the processor subsystem:

prior to powering down the IHS for transit, transmits the SMA log snapshot to a remote storage device;

subsequent to powering up after transit, provides access to a management console of the recipient of the IHS to: (i) the current SMA log snapshot stored on the IHS; and (ii) the transmitted SMA log snapshot stored on the remote storage device.

18. The IHS of claim 13 , wherein:

the processor subsystem comprises: (i) a host processor subsystem coupled to system memory; and (ii) a service processor of a remote access controller (RAC) coupled to persistent memory;

the SMA agent is executed in part by the host processor subsystem and in part by the service processor;

the host processor subsystem randomly generates the new unique code and creates the time-stamped log entry by:

determining whether a reset trigger is received;

in response to determining that the reset trigger is received: (i) clears any time-stamped log entries in system memory; and (ii) generates a new unique code;

the service processor generates the SMA log snapshot by:

accesses the time-stamped log entry and the unique code in system memory via a RAC service manager executed by the host processor subsystem; and

stores, by the RAC, the SMA log snapshot in persistent memory of the RAC; and

enables access, by the RAC, to the SMA log snapshot in persistent memory via a network interface of the IHS the interface.

19. The method of claim 1 , wherein in response to the comparison, the audit device generates a notification to a user interface of whether or not tampering has been affirmatively detected.

20. The method of claim 1 , wherein generating a SMA log snapshot of the time-stamped system log entry combined with the unique code comprises concatenating the unique code with the time-stamped system log entry and storing the time-stamped system log entry concatenated with the unique code in system memory.