DHCP Logs and best approach to capture them.

Follow

Technology Support

• February 16, 2017 21:19

I am looking to analyze the DHCP logs from a windows AD environment. Does anyone have a best practice on how to capture these logs and get them into Sumo Logic? The goal would be to create a report or complete a comparative query that would allow us to understand what devices are on our network and if they are approved devices.

0

• 

  1 - Sumo Admin

  • April 10, 2017 21:36

  We don't use AD for DHCP, but i do gather these logs. I place them into their own partition and then create a aggregated incremental view of this partition every 15m. I can then search back through this quickly and / or create CSV lookups for comparisions etc from that.

  0

  Comment actions Permalink
• 

  Teagan Pacheco

  • September 13, 2022 23:07

  Hello welcome to 2022. I have been tasked with collecting Windows DHCP logs as well. Good to see that others are struggling just as much as myself. I'll keep on keepin' on. 

  0

  Comment actions Permalink
• 

  Scott Shipley

  • December 01, 2022 22:51

  This is a pretty fundamental logging thing that should also not have permissions set to "everyone" for a remote share.  It would be more appropriate to be able to specify credentials like we do for event logs and other metrics. This is pretty disappointing.

  0

  Comment actions Permalink

Please sign in to leave a comment.