> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/sources/windows-dhcp.md).

# Windows DHCP

The Windows DHCP Server source tails the DHCP Server service audit log files (`DhcpSrvLog-*.log`) written by the DHCP Server role and forwards the records as logs. It runs on the Windows host where the DHCP Server service writes its audit logs, optionally parsing each line into structured fields.

### Supported Telemetry

| Platform | Metrics | Logs | Traces |
| -------- | ------- | ---- | ------ |
| Windows  |         | ✓    |        |

### Prerequisites

* A Windows host running the **DHCP Server** role.
* DHCP Server **audit logging enabled**, with the log directory known. Audit logging writes daily `DhcpSrvLog-<DAY>.log` files (for example `DhcpSrvLog-Mon.log`) to the configured path, by default `C:\Windows\System32\dhcp`.
* The collector installed on that host with read access to the audit log directory.

Enable audit logging and set the log path with the `Set-DhcpServerAuditLog` PowerShell cmdlet, for example:

```powershell
Set-DhcpServerAuditLog -Enable $True -Path "C:\Windows\System32\dhcp"
```

See [Set-DhcpServerAuditLog](https://learn.microsoft.com/en-us/powershell/module/dhcpserver/set-dhcpserverauditlog) for the full cmdlet reference.

### Configuration

<figure><img src="/files/uncBEkvhn3A4Frrbt1gm" alt="Bindplane docs - Windows DHCP Server - image 1"><figcaption></figcaption></figure>

**Logs**

| Parameter    | Type    | Required | Default                                     | Description                               |
| ------------ | ------- | -------- | ------------------------------------------- | ----------------------------------------- |
| File Path(s) | Strings | Yes      | `C:/Windows/System32/dhcp/DhcpSrvLog-*.log` | File or directory paths to tail for logs. |

**Advanced**

| Parameter | Type                     | Required | Default | Description                                   |
| --------- | ------------------------ | -------- | ------- | --------------------------------------------- |
| Start At  | Enum: `beginning`, `end` | No       | `end`   | Start reading logs from `beginning` or `end`. |
| Parse     | Boolean                  | No       | `true`  | Parses the log fields into structured data.   |

### Examples

#### Collect from a non-default audit log path

When audit logging is configured to write to a directory other than the default, point File Path(s) at that location. This example reads from `D:\dhcpauditlog` and reads existing log content from the beginning.

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: windows-dhcp
spec:
  type: windowsdhcp
  parameters:
    - name: file_path
      value:
        - D:/dhcpauditlog/DhcpSrvLog-*.log
    - name: start_at
      value: beginning
    - name: parse
      value: true
```

### Configuration Tips

* Use a wildcard such as `DhcpSrvLog-*.log` so the source picks up each daily log file without reconfiguration.
* Leave **Start At** at `end` for ongoing collection. Set it to `beginning` only for an initial backfill of existing log content.
* Disable **Parse** if you want to forward the raw audit log lines unmodified instead of structured fields.

### Troubleshooting

#### No logs are collected

Symptoms: the source is running but no DHCP records arrive.

Solutions:

1. Confirm DHCP Server audit logging is enabled and writing files to the configured directory (`Get-DhcpServerAuditLog`).
2. Verify File Path(s) matches the actual log directory and file pattern, and that the collector account can read those files.

#### Existing log content is not collected

Symptoms: only new records appear after the source starts.

Solution: set **Start At** to `beginning` to read existing log file content. With the default of `end`, only records written after the source starts are collected.

### Standalone Source

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: windows-dhcp
spec:
  type: windowsdhcp
  parameters:
    - name: file_path
      value:
        - C:/Windows/System32/dhcp/DhcpSrvLog-*.log
    - name: start_at
      value: end
    - name: parse
      value: true
```

### Related Resources

* [filelogreceiver — OpenTelemetry Collector Contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/filelogreceiver)
* [Set-DhcpServerAuditLog — Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/dhcpserver/set-dhcpserverauditlog)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bindplane.com/integrations/sources/windows-dhcp.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.