Windows DHCP

The Windows DHCP Server source tails the DHCP Server service audit log files (DhcpSrvLog-*.log) written by the DHCP Server role and forwards the records as logs. It runs on the Windows host where the DHCP Server service writes its audit logs, optionally parsing each line into structured fields.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Windows		✓

Prerequisites

• A Windows host running the DHCP Server role.
• DHCP Server audit logging enabled, with the log directory known. Audit logging writes daily DhcpSrvLog-<DAY>.log files (for example DhcpSrvLog-Mon.log) to the configured path, by default C:\Windows\System32\dhcp.
• The collector installed on that host with read access to the audit log directory.

Enable audit logging and set the log path with the Set-DhcpServerAuditLog PowerShell cmdlet, for example:

Set-DhcpServerAuditLog -Enable $True -Path "C:\Windows\System32\dhcp"

See Set-DhcpServerAuditLog for the full cmdlet reference.

Configuration

Logs

Parameter	Type	Required	Default	Description
File Path(s)	Strings	Yes	C:/Windows/System32/dhcp/DhcpSrvLog-*.log	File or directory paths to tail for logs.

Advanced

Parameter	Type	Required	Default	Description
Start At	Enum: beginning, end	No	end	Start reading logs from beginning or end.
Parse	Boolean	No	true	Parses the log fields into structured data.

Examples

Collect from a non-default audit log path

When audit logging is configured to write to a directory other than the default, point File Path(s) at that location. This example reads from D:\dhcpauditlog and reads existing log content from the beginning.

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: windows-dhcp
spec:
  type: windowsdhcp
  parameters:
    - name: file_path
      value:
        - D:/dhcpauditlog/DhcpSrvLog-*.log
    - name: start_at
      value: beginning
    - name: parse
      value: true

Configuration Tips

• Use a wildcard such as DhcpSrvLog-*.log so the source picks up each daily log file without reconfiguration.
• Leave Start At at end for ongoing collection. Set it to beginning only for an initial backfill of existing log content.
• Disable Parse if you want to forward the raw audit log lines unmodified instead of structured fields.

Troubleshooting

No logs are collected

Symptoms: the source is running but no DHCP records arrive.

Solutions:

1. Confirm DHCP Server audit logging is enabled and writing files to the configured directory (Get-DhcpServerAuditLog).
2. Verify File Path(s) matches the actual log directory and file pattern, and that the collector account can read those files.

Existing log content is not collected

Symptoms: only new records appear after the source starts.

Solution: set Start At to beginning to read existing log file content. With the default of end, only records written after the source starts are collected.

Standalone Source

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: windows-dhcp
spec:
  type: windowsdhcp
  parameters:
    - name: file_path
      value:
        - C:/Windows/System32/dhcp/DhcpSrvLog-*.log
    - name: start_at
      value: end
    - name: parse
      value: true

Related Resources

• filelogreceiver — OpenTelemetry Collector Contrib
• Set-DhcpServerAuditLog — Microsoft Learn