A. To enable enhanced DHCP logging, perform the following steps:
- Start the DHCP administration tool (go to Start, Programs, Administrative Tools, and click DHCP).
- Right-click the DHCP server, and select Properties from the context menu.
- Select the General tab.
- Select the "Enable DHCP audit logging" check box.
Click here to view image
- Click OK.
Windows 2000 will now create a DHCP log file in the %systemroot%\system32\dhcp directory for each day using a DhcpSrvLog.XXX file format.
Common audit codes that might appear in the log include
- 00—The log was started.
- 01—The log was stopped.
- 02—The log was temporarily paused due to low disk space.
- 10—A new IP address was leased to a client.
- 11—A lease was renewed by a client.
- 12—A lease was released by a client.
- 13—An IP address was found to be in use on the network.
- 14—A lease request could not be satisfied because the scope's
address pool was exhausted.
- 15—A lease was denied.
- 16—A lease was deleted.
- 17—A lease was expired.
- 20—A BOOTP address was leased to a client.
- 21—A dynamic BOOTP address was leased to a client.
- 22—A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted.
- 23—A BOOTP IP address was deleted after verifying that it wasn't in use.
The DHCP Server uses codes above 50 for Rogue Server Detection information.