Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. dhcp
  5. DhcpSrvLog-<jour>.log
LogRisk: Caution
  • Windows Server

DhcpSrvLog-<jour>.log C:\Windows\System32\dhcp\DhcpSrvLog-<jour>.log

DhcpSrvLog-<day>.log: DHCP server audit log, one text file per weekday (leases, renewals, denials). Tells you who held which IP.

Updated on By AltF4 Formation

What it’s for

The DhcpSrvLog-*.log files are the audit log of the DHCP server role. They trace lease assignments, renewals, releases and denials, exhausted scopes and service stops. You open them to find out which machine (MAC address, host name) held which IP address at a given moment.

What it contains

One file per weekday: DhcpSrvLog-Mon.log, DhcpSrvLog-Tue.log, and so on. IPv6 files are called DhcpV6SrvLog-*.log. Each line describes an event: code, date, time, description, IP address, host name, MAC address, then more fields depending on the version.

Common codes: 10 (new lease), 11 (renewal), 12 (release), 13 (address already in use), 14 (scope exhausted), 15 (denied). Codes 00, 01 and 02 mark the log starting, stopping and being paused for lack of disk space.

Risks and best practices

  • Host names and MAC addresses identify devices, so restrict access to these files.
  • Each file is overwritten the following week. To keep more than seven days, copy them to central storage before they are overwritten.
  • Do not edit them while the service runs. To change the path or the limits, use Set-DhcpServerAuditLog.
  • When free space on the volume drops below the configured threshold (20 MB by default), the service pauses logging, so a nearly full disk loses events without any visible error.

Useful commands

Fenêtre de terminal
# Current audit settings (path, maximum size, minimum disk space)
Get-DhcpServerAuditLog


# Last lines of today's log (as administrator)
Get-Content -Path "$env:windir\System32\dhcp\DhcpSrvLog-$((Get-Date).ToString('ddd', [Globalization.CultureInfo]::InvariantCulture)).log" -Tail 30


# Search for the events of a host or MAC address
Select-String -Path "$env:windir\System32\dhcp\DhcpSrvLog-*.log" -Pattern 'HOSTNAME'


# Monday's new leases (code 10) as objects
$h = 'ID','Date','Time','Description','IP Address','Host Name','MAC Address'
Get-Content "$env:windir\System32\dhcp\DhcpSrvLog-Mon.log" | Where-Object { $_ -match '^\d' } |
  ConvertFrom-Csv -Header $h | Where-Object ID -eq 10

Format

Plain text, comma-separated values, with an explanatory header at the top of the file. The available fields depend on the Windows Server version.

Rotation and archiving

Rotation is automatic: the service writes to the file for the current weekday, which is reused the following week. The overall maximum size (70 MB by default) and the disk space check are set with Set-DhcpServerAuditLog or in the DHCP server properties. Copy the files to archive them.

How to read it

An editor or Get-Content is enough for a quick search. For analysis, import the data lines with ConvertFrom-Csv and explicit headers, as above. The table of event codes is in the header of each file.

Report a mistake