DHCP Failover Events and Performance
Applies To: Windows Server 2012 R2, Windows Server 2012
Windows Server® 2012 introduces new event logging and performance counters to support monitoring and troubleshooting of DHCP failover. See the following sections in this topic for more information:
Note
DHCP failover-related events are also logged to the DHCP Audit Log, which by default is located at %windir%\System32\Dhcp. A DHCP-failover informational event that is commonly recorded in the DHCP Audit Log is event ID 36: 36,<date>,<time>,Packet dropped because of Client ID hash mismatch or standby server… This event is only informational and can be safely ignored. It does not indicate an error. In DHCP failover, the client messages which are broadcast are received by both the DHCP failover servers. However, only one server responds to the client messages. In case of load balance mode, the servers will hash the MAC address of a DHCP client to establish which of them must respond. In hot standby mode, only the active server responds. In both cases, the DHCP server which does not respond to the client logs this message in the audit log.
DHCP server event channels
The following DHCP Server event channels are available using Event Viewer with the path: Applications and Services Logs\Microsoft\Windows\DHCP-Server.
Admin channel (Microsoft-Windows-DHCP Server Events/Admin): This channel provides DHCP server administrative event logging. For example, events are logged to this channel if a DHCP failover state of a server changes. For more information, see Administrative event logging.
FilterNotifications channel (Microsoft-Windows-DHCP Server Events/FilterNotifications): This channel provides DHCP server link-layer based filtering event logging. This event channel is not used for DHCP failover related events.
Operational channel (Microsoft-Windows-DHCP Server Events/Operational): This channel provides DHCP configuration auditing. For example, an event is logged if a scope on the DHCP server is added or removed from a DHCP failover relationship. For more information, see Operational event logging.
New DHCP failover-specific events have been added to these channels for administrative and operational (configuration audit) event logging.
Administrative event logging
Event Tracing for Windows (ETW) events are logged for state transition of the local server, or its partner server. These events are logged to the DHCP server Admin channel. The following data is provided as part of each state change event.
The previous state of the server
The current state of the server
The failover relationship name
The server host name or IP address
In addition to logging its own state change, the server will log changes in the state of its failover partner server. This information is communicated by state messages from the failover partner. The following table lists the values populated for the various fields in the event log.
Event Field |
Value |
||
|---|---|---|---|
Event ID |
20252 (example ID) |
||
Date and Time |
Time of the state change |
||
Computer |
DHCP server host name or IP address |
||
User |
NETWORK SERVICE |
||
Description |
The failover state of server: <host name> for failover relationship: <relationship name> changed from: <previous state> to <current state>. The server IP address or host name corresponds to the server that has changed state. This can be the host name or IP address of the local DHCP server or the failover partner.
|
||
OpCode |
FailoverStateChange |
||
Task Category |
DHCP Failover |
||
Level |
|
||
Keywords |
.jpeg)
NoteSee the following example event.
.jpeg)
The following type of event data is logged when a server detects that it is out of time synchronization with its partner server.
Event Field |
Value |
|---|---|
Event ID |
20253 |
Date and Time |
Time of detection of time being out of sync with partner server |
Computer |
DHCP server host name |
User |
NETWORK SERVICE |
Description |
The server detected that it is out of time synchronization with partner server: <host name> for failover relationship: <relationship name>. The time is out of sync by: <# of seconds> seconds. |
OpCode |
TimeOutOfSync |
Task Category |
DHCP Failover |
Level |
Error |
Keywords |
An event will also be logged when a connection is established and when a connection is lost between DHCP failover partners.
Level |
Opcode |
Task Category |
Description |
|---|---|---|---|
Error |
CommDown |
DHCP Failover |
Server has lost contact with failover partner server: <host name> for relationship: <relationship name>. |
Information |
CommUp |
DHCP Failover |
Server has established contact with failover partner server: <host name> for relationship: <relationship name>. |
Operational event logging
The following information-level configuration audit events are logged to the DHCP server Operational channel.
Event Type |
OpCode |
Description |
|---|---|---|
Creation of Failover Relationship |
CreateFailover |
A failover relationship has been created between servers: <host name> and <host name> with the following configuration parameters: Name: <value> Mode: <mode>, Maximum Client Lead Time: <value> seconds, Load Balance percentage on this server/Reserve Address percentage on standby server: <value>, Auto state switchover interval: <value> seconds Standby server: <host name> |
Deletion of Failover Relationship |
DeleteFailover |
Failover relationship <relationship name> between <host name> and <host name> has been deleted |
Addition of a scope to an existing failover relationship |
AddFailoverScope |
Scope <scope ID> has been added to the failover relationship <relationship name> with server <host name> |
Removal of a scope from an existing failover relationship |
RemoveFailoverScope |
Scope <scope ID> has been removed from the failover relationship <relationship name> with server <host name> |
Change MCLT |
ChangeFailoverConfig |
The failover configuration parameter MCLT for failover relationship <relationship name> with server <host name> has been changed from <old value> seconds to <new value> seconds |
Change Auto state switchover interval |
ChangeFailoverConfig |
The failover configuration parameter Auto State switchover interval for failover relationship <relationship name> with server <host name> has been changed from <old value> seconds to <new value> seconds |
Change Reserve Address percentage |
ChangeFailoverConfig |
The failover configuration parameter Reserve Address Percentage on standby server for failover relationship <relationship name> with server <host name> has been changed from <old value> to <new value> |
Change Mode of failover relationship |
ChangeFailoverConfig |
The failover configuration parameter Mode for failover relationship <relationship name> with server <host name> has been changed from <old value> to <new value> |
Change Load Balance percentage |
ChangeFailoverConfig |
The failover configuration parameter Load Balance percentage for failover relationship <relationship name> with server <host name> has been changed from <old value> to <new value> on this server |
See the following example event.
.jpeg)
Performance counters
Windows Server 2012 introduces the following new DHCP failover-related performance counters to the DHCP server counters:
Binding Updates sent per minute
Binding Acks received per minute
Binding Updates received per minute
Binding Acks sent per minute
Number of pending outbound binding updates on this server
Number of transitions into COMMUNICATION INTERRUPTED state
Number of transitions into PARTNER DOWN state
Number of transitions into RECOVER state
Number of Binding Update queue running at 90% of the maximum queue size
Number of Binding Updates dropped