Share via

Analyze DHCP Server Log Files

Applies To: Windows Server 2008

Analyzing server log files

In Windows Server 2008, DHCP server log files are designed to use audit logging to permit log files to remain enabled for use without additional monitoring or administering to manage log file growth or conserve disk resources. DHCP audit logs are located by default at %windir%\System32\Dhcp.

The following section outlines the format of these log files and how they can be used to gather more information about DHCP Server service operations on the network.

DHCP server log file format

DHCP server logs are comma-delimited text files with each log entry representing a single line of text. Following are the fields (and the order in which they appear) in a log file entry:

ID, Date, Time, Description, IP Address, Host Name, MAC Address

Each of these fields is described in detail in the following table:

Field Description


A DHCP server event ID code.


The date on which this entry was logged on the DHCP server.


The time at which this entry was logged on the DHCP server.


A description of this DHCP server event.

IP Address

The IP address of the DHCP client.

Host Name

The host name of the DHCP client.

MAC Address

The media access control address used by the network adapter hardware of the client.

DHCP server log: Common event codes

DHCP server audit log files use reserved event ID codes to provide information about the type of server event or activity logged. The following table describes these event ID codes in more detail.

Event ID Description


The log was started.


The log was stopped.


The log was temporarily paused due to low disk space.


A new IP address was leased to a client.


A lease was renewed by a client.


A lease was released by a client.


An IP address was found in use on the network.


A lease request could not be satisfied because the address pool of the scope was exhausted.


A lease was denied.


A BOOTP address was leased to a client.

DNS dynamic update events

When the DHCP server is configured to perform DNS dynamic updates on behalf of DHCP clients, you can use the DHCP audit logs to monitor update requests by the DHCP server to the DNS server, DNS record update successes, and DNS record update failures. The following event IDs are used for DNS dynamic update events:

ID number DHCP Event


DNS dynamic update request


DNS dynamic update failed


DNS dynamic update successful

The IP address of the DHCP client computer is included in the DHCP audit log so you can track the source in the event of a denial of service attack.

DHCP server logs: Server authorization events

The following are additional server log event ID codes and descriptions. These events can appear in logs made by DHCP servers running Windows Server 2008. They pertain to the applicable DHCP server and its authorization status when deployed in Active Directory environments.

Event ID Description


Unreachable domain

The DHCP server could not locate the applicable domain for its configured Active Directory installation.


Authorization succeeded

The DHCP server was authorized to start on the network.


Upgraded to a Windows Server 2008 operating system

The DHCP server was recently upgraded to a Windows Server 2008 operating system, and, therefore, the unauthorized DHCP server detection feature (used to determine whether the server has been authorized in Active Directory) was disabled.


Cached Authorization

The DHCP server was authorized to start using previously cached information. AD DS could not be found at the time the server was started on the network.


Authorization failed

The DHCP server was not authorized to start on the network. When this event occurs, it is likely followed by the server being stopped.


Authorization (servicing)

The DHCP server was successfully authorized to start on the network.


Authorization failure, stopped servicing

The DHCP server was not authorized to start on the network and was shut down by the operating system. You must first authorize the server in the directory before starting it again.


Server found in domain

Another DHCP server exists and is authorized for service in the same domain.


Server could not find domain

The DHCP server could not locate the specified domain.


Network failure

A network-related failure prevented the server from determining if it is authorized.


No DC is DS Enabled

No domain controller running Windows Server 2008 was located. For detecting whether the server is authorized, a domain controller that is enabled for AD DS is required.


Server found that belongs to DS domain

Another DHCP server was found on the network that belongs to the Active Directory domain.


Another server found

Another DHCP server was found on the network.


Restarting rogue detection

The DHCP server is trying once more to determine whether it is authorized to start and provide service on the network.


No DHCP enabled interfaces

The DHCP server has its service bindings or network connections configured so that it is not enabled to provide service. This usually means one of the following:

  • The network connections of the server are either not installed or not actively connected to a network.

  • The server has not been configured with at least one static IP address for one of its installed and active network connections.

  • All of the statically configured network connections for the server are disabled.

Example: Excerpt from a sample DHCP server audit log

The following is a brief excerpt of sample log activity from an audit log generated by the DHCP Server service:

ID Date,Time,Description,IP Address,Host Name,MAC Address
60,04/19/99,12:43:21,No DC is DS Enabled,,MYDOMAIN,
63,04/19/99,12:43:28,Restarting rogue detection,,,

In this sample, the DHCP server could not be authorized when initially started and is subsequently stopped. After it is authorized, the server is then able to start and service clients.