none
DHCP Log Audit Paused RRS feed

  • Question

  • Hi all,

    I have a strange situation issue with our DHCP Server Audit Log. All log files stop logging more information after their sizes reach ~ 29.263 MB even I have the MaxMBFileSize of 200 MB configured.

    PS C:\Users\net_sys> Get-DhcpServerAuditLog -ComputerName abcdef.localhost.com
    
    
    Path              : C:\Windows\system32\dhcp
    Enable            : True
    MaxMBFileSize     : 200
    DiskCheckInterval : 50
    MinMBDiskSpace    : 20

    When I remove/delete thousands of log lines (to get the file size reduced), the file resumes logging normally but again stops at ~ 29.261 MB.

    I have an idea to change the logfile path to another location/folder to see whether the issue is fixed or not. However, I would like to understand what is really wrong.

    Any advice/suggestion is highly appreciated. Thank you






    • Edited by net_sys Tuesday, March 5, 2019 10:23 PM
    Tuesday, March 5, 2019 9:51 PM

Answers

  • Hello!

    Which operating system are you running? It does sound like disk space issues, did you you check that there is sufficient disk space available?

    How did you change the log file size? Are you sure the MaxMBFileSize got changed successfully? 

    You can also try changing in the Windows Registry (DO BACKUP THE REGISTRY BEFORE!):

    Registry Path:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\DHCPServer\Parameters

    Registry Key:DhcpLogFilesMaxSize


    Note: This change will require a reboot to take effect though.

    Best regards,
    Leon


    Blog: https://thesystemcenterblog.com LinkedIn:

    • Marked as answer by net_sys Friday, March 15, 2019 11:40 AM
    Tuesday, March 5, 2019 10:21 PM

All replies

  • Hello!

    Which operating system are you running? It does sound like disk space issues, did you you check that there is sufficient disk space available?

    How did you change the log file size? Are you sure the MaxMBFileSize got changed successfully? 

    You can also try changing in the Windows Registry (DO BACKUP THE REGISTRY BEFORE!):

    Registry Path:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\DHCPServer\Parameters

    Registry Key:DhcpLogFilesMaxSize


    Note: This change will require a reboot to take effect though.

    Best regards,
    Leon


    Blog: https://thesystemcenterblog.com LinkedIn:

    • Marked as answer by net_sys Friday, March 15, 2019 11:40 AM
    Tuesday, March 5, 2019 10:21 PM
  • Hello Leon,

    It is Windows Server 2012. I use the PS command Set-DhcpServerAuditLog to set the MaxMBFileSize. I believe it was successfully changed (as is the output of Get-DhcpServerAuditLog).

    Thanks!

    Tuesday, March 5, 2019 10:33 PM
  • Okay, thanks for the information, the Set-DhcpServerAuditLog PowerShell cmdlet should be fine, what about the disk space?

    Did you restart the DHCP Server service after running the above cmdlet? It might need that.

    In addition, if you try moving the location of the DHCP Audit log, you will have to make sure you give the NT SERVICE\DHCP Server "Full Control" permissions to the new location.


    Blog: https://thesystemcenterblog.com LinkedIn:

    Tuesday, March 5, 2019 10:41 PM
  • Thanks Leon! I will keep us updated as soon as I get it resolved.

    Wednesday, March 6, 2019 1:42 PM
  • Hi,

    Thanks for your question.

    Looking forward to your reply.

    Please feel free to let me know if you need any assistance.

    Best Regards,

    Eric


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, March 7, 2019 9:03 AM
  • Hi,

       

    Was your issue resolved?

    If you resolved it using other’s reply, please "mark it as answer" to help other community members find the helpful reply quickly.

    If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.

    If no, please reply and tell us the current situation in order to provide further help.

       

    Best Regards,

    Eric


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, March 11, 2019 9:02 AM
  • Hello Leon,

    I got a chance to increase the MaxMBFileSize up to 300 MB and then restart the DHCP service. The file resumed logging again but stopped after it got 14-15 MB (of log data/lines) more.

    Would you please help me with the following points?

    • Is MaxMBFileSize for each log file (DhcpSrvLog-Tue or DhcpSrvLog-Wed) or for the entire C:\Windows\System32\dhcp folder? My current dhcp folder size is close to 300 MB.

    • Should I try again to increase it up to 500 MB or 600 MB?

    • Or should I change the logfile path to another location/folder? If yes, how could I find the NT SERVICE\DHCP Server?. Under current dhcp folder, I can see DHCPServer, when I try with other folders, I could not locate this account in our AD but only DHCP Adminitrators and DHCP Users.

    Thanks again!

      



    • Edited by net_sys Wednesday, March 13, 2019 12:48 PM
    Wednesday, March 13, 2019 12:24 PM
  • Hello Eric,

    Unfortunately, the issue persists. I will let us know as soon as I have chances to test other solutions.

    Thanks!

    Wednesday, March 13, 2019 12:27 PM
  • Hi,

    You could try increasing the MaxMBFileSize even more yeah.

    I tested in my lab environment and I couldn't find the DHCPServer local account on Windows Server 2016 or newer, only on Windows Server 2012 R2 at least.


    Blog: https://thesystemcenterblog.com LinkedIn:

    Wednesday, March 13, 2019 1:51 PM
  • Hi Leon,

    Okay. I will try to increase the MaxMBFileSize up to 800 MB (or even 1 GB) and will let us know.

    Thanks!

    Wednesday, March 13, 2019 2:06 PM
  • Hello Leon,

    The issues seems to be resolved after we increased the MaxMBFileSize up to 1 GB :)

    Thanks again!

    Friday, March 15, 2019 11:40 AM
  • Great to hear, you’re welcome!

    Blog: https://thesystemcenterblog.com LinkedIn:

    Friday, March 15, 2019 11:42 AM