Partager via

Analyzing server log files

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Analyzing server log files

In Windows Server 2003 family, DHCP server log files are designed to use Audit logging to permit log files to remain enabled for use without requiring added monitoring or administering to manage log file growth or conserve disk resources. DHCP audit logs are located by default at %windir%\System32\Dhcp.

The following section outlines the format of these log files and how they can be used to gather more information about DHCP Server service operations on the network.

DHCP server log file format

DHCP server logs are comma-delimited text files with each log entry representing a single line of text. Following are the fields (and the order in which they appear) in a log file entry:

ID, Date, Time, Description, IP Address, Host Name, MAC Address

Each of these fields is described in detail in the following table:

Field Description

ID

A DHCP server event ID code.

Date

The date on which this entry was logged on the DHCP server.

Time

The time at which this entry was logged on the DHCP server.

Description

A description of this DHCP server event.

IP Address

The IP address of the DHCP client.

Host Name

The host name of the DHCP client.

MAC Address

The media access control address used by the network adapter hardware of the client.

DHCP server log: Common event codes

DHCP server audit log files use reserved event ID codes to provide information about the type of server event or activity logged. The following table describes these event ID codes in more detail.

Event ID Description

00

The log was started.

01

The log was stopped.

02

The log was temporarily paused due to low disk space.

10

A new IP address was leased to a client.

11

A lease was renewed by a client.

12

A lease was released by a client.

13

An IP address was found in use on the network.

14

A lease request could not be satisfied because the address pool of the scope was exhausted.

15

A lease was denied.

20

A BOOTP address was leased to a client.

DNS dynamic update events

When the DHCP server is configured to perform DNS dynamic updates on behalf of DHCP clients, you can use the DHCP audit logs to monitor update requests by the DHCP server to the DNS server, DNS record update successes, and DNS record update failures. The following event ID's are used for DNS dynamic update events:

ID number DHCP Event

30

DNS dynamic update request

31

DNS dynamic update failed

32

DNS dynamic update successful

The IP address of the DHCP client computer is included in the DHCP audit log, providing the ability to track the source in the event of a denial of service attack.

DHCP server logs: Server authorization events

The following are additional server log event ID codes and descriptions. These events can appear in logs made by DHCP servers running Windows Server 2003 . They pertain to the applicable DHCP server and its authorization status when deployed in Active Directory environments.

Event ID Description

50

Unreachable domain

The DHCP server could not locate the applicable domain for its configured Active Directory installation.

51

Authorization succeeded

The DHCP server was authorized to start on the network.

52

Upgraded to a Windows Server 2003 operating system

The DHCP server was recently upgraded to a Windows Server 2003 operating system, and, therefore, the unauthorized DHCP server detection feature (used to determine whether the server has been authorized in Active Directory) was disabled.

53

Cached Authorization

The DHCP server was authorized to start using previously cached information. Active Directory was not currently visible at the time the server was started on the network.

54

Authorization failed

The DHCP server was not authorized to start on the network. When this event occurs, it is likely followed by the server being stopped.

55

Authorization (servicing)

The DHCP server was successfully authorized to start on the network.

56

Authorization failure, stopped servicing

The DHCP server was not authorized to start on the network and was shut down by the operating system. You must first authorize the server in the directory before starting it again. For more information, see Authorize a DHCP server in Active Directory.

57

Server found in domain

Another DHCP server exists and is authorized for service in the same domain.

58

Server could not find domain

The DHCP server could not locate the specified domain.

59

Network failure

A network-related failure prevented the server from determining if it is authorized.

60

No DC is DS Enabled

No Windows Server 2003 domain controller (DC) was located. For detecting whether the server is authorized, a DC that is enabled for Active Directory is needed.

61

Server found that belongs to DS domain

Another DHCP server was found on the network that belongs to the Active Directory domain.

62

Another server found

Another DHCP server was found on the network.

63

Restarting rogue detection

The DHCP server is trying once more to determine whether it is authorized to start and provide service on the network.

64

No DHCP enabled interfaces

The DHCP server has its service bindings or network connections configured so that it is not enabled to provide service. This usually means one of the following:

  1. The network connections of the server are either not installed or not actively connected to a network.

  2. The server has not been configured with at least one static IP address for one of its installed and active network connections. For more information, see Configure TCP/IP for static addressing.

  3. All of the statically configured network connections for the server are disabled. For more information, see Multihomed DHCP servers.

Example: Excerpt from a sample DHCP server audit log

The following is a brief excerpt of sample log activity from an audit log generated by the DHCP Server service:

ID Date,Time,Description,IP Address,Host Name,MAC Address
00,04/19/99,12:43:06,Started,,,
60,04/19/99,12:43:21,No DC is DS Enabled,,MYDOMAIN,
63,04/19/99,12:43:28,Restarting rogue detection,,,
01,04/19/99,13:11:13,Stopped,,,
00,04/19/99,12:43:06,Started,,,
55,04/19/99,12:43:54,Authorized(servicing),,MYDOMAIN,

In this sample, the DHCP server could not be authorized when initially started and is subsequently stopped. Once authorized, the server is then able to start and service clients.

Note