Windows Server 2003 : Monitoring DHCP Through Audit Logging

Exploring DHCP Audit Logging

By default, the DHCP Server service writes daily audit logs to the folder WINDOWS\System32\Dhcp. These audit log files are text files named after the day of the week. For example, DhcpSrvLog-Mon is the log file that records all DHCP server activity between midnight and 11:59 P.M. on Monday, and DhcpSrvLog-Tue is the log file that records all DHCP server activity between midnight and 11:59 P.M. on Tuesday. Audit log files are typically overwritten after seven days, at which time a new log file of the same name is created. For example, the audit log file named DhcpSrvLog-Tue that is created at midnight on January 5 is replaced by a new file of the same name that is created at midnight on January 12.

You can modify the location of these log files on the Advanced tab of the DHCP server properties dialog box, shown in Figure 1. To do so, adjust the value in the Audit Log File Path text box.

The DHCP console also allows you to disable audit logging completely on the General tab of the DHCP server properties dialog box, shown in Figure 2. To perform this task, clear the Enable DHCP Audit Logging check box. (Audit Logging is enabled by default.)

Assuming the default is set, the largest size that the current audit log file can reach is 1 MB. Also by default, if the amount of disk space remaining on the server disk falls below 20 MB, audit logging is halted. When sufficient space again becomes available, DHCP audit logging resumes.

Understanding DHCP Server Log File Format

DHCP server logs are comma-delimited text files with each log entry representing a single line of text. Figure 3 shows a sample audit log file.

A log file entry contains the fields of ID, Date, Time, Description, IP Address, Host Name, and MAC Address. A comma is used to separate each field, even when a field is empty. For example, in the following log entry, two commas in a row indicate that both the IP Address and MAC Address fields are empty:

55,06/03/03,09:08:57,Authorized(servicing),,domain1.local,,

Table 1 describes the values of DHCP server log fields.

Common Event Codes

DHCP server audit log files use reserved event ID codes to provide information about the type of server event or activity logged. Event IDs lower than 50 are described in the log file itself and therefore do not need to be memorized.

Server Authorization Events

Table 2 presents additional server log event ID codes and descriptions. These codes pertain to the Active Directory authorization status of the DHCP server. Unlike the preceding events, these events are not described in the log file. Therefore, you should become familiar with these codes or use Windows Server 2003 Help to assist you when you need to determine what a code represents.

Excerpts from a Sample DHCP Server Audit Log

The following excerpt shows a normal start and authorization of a DHCP server with no errors. The first two events correspond to the successful authorization at startup. The last two events correspond to the periodic DHCP database cleanup that occurs every 60 minutes.

ID,Date,Time,Description,IP Address,Host Name,MAC Address
00,06/03/03,09:08:57,Started,,,,
55,06/03/03,09:08:57,Authorized(servicing),,domain2.local,,
11,06/03/03,09:48:25,Renew,192.168.0.11,server2.domain2.local,0003FFBC3B46,
24,06/03/03,10:08:58,Database Cleanup Begin,,,,
25,06/03/03,10:08:58,0 leases expired and 0 leases deleted,,,,

In the following excerpt, the DHCP server is found not to be authorized when it is started. This situation can happen, for example, when a new server is installed. In this example, the DHCP server is authorized in Active Directory 10 minutes after startup, after which the server is able to begin servicing clients.

ID,Date,Time,Description,IP Address,Host Name,MAC Address
00,06/08/03,22:35:10,Started,,,,
56,06/08/03,22:35:10,Authorization failure, stopped servicing,,domain1.local,,
55,06/08/03,22:45:38,Authorized(servicing),,domain1.local,,		  

Tip