How to get Windows Server DHCP logs



I have a problem with Windows Server 2008 r2 DHCP Logs.
I used Filebeat to watch over the files in C:\Windows\System32\dhcp* folder.

When a new IP got leased the file does not change its time. That means filebeat never recognizes if somenthing is added. So i do not get the dhcp logs.

Is there a way how to get these logs in realtime?

Best regards,


(ruflin) #2

Unfortunately that is a "known" issue related to Windows. Also look here: Filebeat Not harvesting, file didn't change - do not use modification time We are trying to find ways around this in the future.


Ok maybe I have to use another solution until it´s available with beats.


(system) #4