Auditing DHCP server on Windows and Linux
The Dynamic Host Configuration Protocol (DHCP) server is a vital part of any network infrastructure. Auditing client-server exchanges that occur when IP addresses are allotted is useful to network administrators. Information on successful or failed lease grants, depletion of the server's IP pool, or requests for messages and their corresponding acknowledgements helps in network management. In addition, admins can track security information such as authorization messages (where relevant) and warning messages to implement security measures.
EventLog Analyzer for DHCP servers
EventLog Analyzer can read and report on DHCP server logs of both Windows and Linux systems. It provides various reports that simplifies network administration. These reports detail all DHCP-related communication (discover and offer messages), activity (logging, authorization, and DNS updates), and error events. EventLog Analyzer also brings you overview and Top N reports, including lists on active clients and MAC addresses.
DHCP monitoring in Windows
- Dedicated reports list actions on leases such as granted, renewed, or denied.
- DNS server reports show success and failure for server updates, following DHCP IP address assignments.
- Reports detail the DHCP server's connection to, and authorization within, the Active Directory domain.
- The DHCP server works with a pool of IP addresses that are assigned around the network. EventLog Analyzer reports specify whether this pool is expanded or exhausted.
- Independent reports collate events of varying severity, such as critical, error, or warning.
- top N reports help identify the most active clients and MAC addresses.
- Reports on the DHCP logging process and a general overview on all of the above events are also available.
Lease renewed by client | Lease denied | Lease Granted | Lease Released | Lease Expired | Lease Deleted | IP Found To Use in Network | Pool Exhausted | DNS Update Request | DNS Update failed | DNS update successful | Unreachable domain | BOOTP Lease Report | Authorization succeeded | Authorization failed | Server found in domain | Network failure | DHCP Logging started | DHCP Logging stopped | DHCP logging paused due to low disk | Critical Events Report | Error Reports | Warning Reports | Top Clients | Top Mac Address | DHCP Reports Overview
DHCP monitoring in Linux
- Each step in the exchange of client-server messages can be viewed in its own report.
- All information messages are listed in a single report.
- Most active IP addresses, MAC addresses, gateways, and operations are displayed in the top N reports.
- An overview report summarizes all DHCP log events.
Discovers | Offers | Requests | Acknowledges | Releases | Negative Acknowledges | Abandoning IP | Information Report | DHCP Linux Overview | Top Operation | Top Ip Address | Top MAC Address | Top Gateway