How to get Windows Server DHCP logs

Elastic Stack Beats
1

Hi.

I have a problem with Windows Server 2008 r2 DHCP Logs.
I used Filebeat to watch over the files in C:\Windows\System32\dhcp* folder.

When a new IP got leased the file does not change its time. That means filebeat never recognizes if somenthing is added. So i do not get the dhcp logs.

Is there a way how to get these logs in realtime?

Best regards,

Malte

2

Unfortunately that is a "known" issue related to Windows. Also look here: Filebeat Not harvesting, file didn't change - do not use modification time We are trying to find ways around this in the future.

1 Like
3

Ok maybe I have to use another solution until it´s available with beats.

Thanks