# How to get Windows Server DHCP logs

**URL:** <https://discuss.elastic.co/t/how-to-get-windows-server-dhcp-logs/51425>\
**Category:** Beats\
**Created:** [May 31, 2016, 12:09pm UTC](https://discuss.elastic.co/t/how-to-get-windows-server-dhcp-logs/51425 "2016-05-31T12:09:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)\
**Post date:** [May 31, 2016, 12:09pm UTC](https://discuss.elastic.co/t/how-to-get-windows-server-dhcp-logs/51425/1 "2016-05-31T12:09:27Z")

</div>

Hi.

I have a problem with Windows Server 2008 r2 DHCP Logs.  
I used Filebeat to watch over the files in C:\Windows\System32\dhcp\* folder.

When a new IP got leased the file does not change its time. That means filebeat never recognizes if somenthing is added. So i do not get the dhcp logs.

Is there a way how to get these logs in realtime?

Best regards,

Malte

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [June 2, 2016, 6:52am UTC](https://discuss.elastic.co/t/how-to-get-windows-server-dhcp-logs/51425/2 "2016-06-02T06:52:38Z")

</div>

Unfortunately that is a "known" issue related to Windows. Also look here: [Filebeat Not harvesting, file didn't change - do not use modification time](https://discuss.elastic.co/t/filebeat-not-harvesting-file-didnt-change-do-not-use-modification-time/49834/7) We are trying to find ways around this in the future.

---

<div class="post-metadata">

**Author:** ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)\
**Post date:** [June 2, 2016, 7:08am UTC](https://discuss.elastic.co/t/how-to-get-windows-server-dhcp-logs/51425/3 "2016-06-02T07:08:42Z")

</div>

Ok maybe I have to use another solution until it´s available with beats.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:51pm UTC](https://discuss.elastic.co/t/how-to-get-windows-server-dhcp-logs/51425/4 "2017-07-05T21:51:20Z")

</div>


