Windows Server 2003 Network Administration

Appendix B. DHCP Audit Log Identifiers

DHCP audit logging provides a wide variety of informative messages about the state of the DHCP server, the protocol interactions, the address pool, DNS interactions, authorization, and more. The audit log is a text file that contains audit entries one per line. Each audit entry has a two-digit numeric identifier that indicates the type of message being logged. (See Chapter 5 for a description of the structure of audit log entries.)

Table B-1 lists all of the log identifiers in numeric order and provides a short description of the purpose of each type of log entry.

Table B-1. Audit log identifiers

Identifier	Description
00	Logging started at the specified date and time.
01	Logging stopped at the specified date and time.
02	The DHCP server suspended logging because available disk space is less than the value set in the DhcpLogMinSpaceOnDisk registry key or because the current log file is larger than 1/7 of the value set in the DhcpLogFilesMaxSize registry key.
10	The specified IP address was leased to the client.
11	The client renewed the lease on the specified address.
12	The client released the lease on the specified address.
13	The specified IP address conflict was detected.
14	All addresses in the scope’s address pool have been exhausted.
15	The specified lease request was denied.
16	The specified address lease was deleted.
17	The specified address lease has expired.
20	The specified BOOTP address was leased to the client.
21	The specified dynamic BOOTP address was leased ...