NXLog Documentation

Windows DHCP client

Windows DHCP client logs are written to Windows Event Log. There are two logs for IPv4 and two for IPv6. To enable the required logs, open Event Viewer (eventvwr) and check the logs under Applications and Services Logs > Microsoft > Windows > Dhcp-Client and Applications and Services Logs > Microsoft > Windows > DHCPv6-Client. To enable a log, right-click on it and click Enable Log.

Enabling DHCP client logs in Windows Event Log

Alternatively, the following PowerShell script will check all four logs, enabling if necessary.

$LogNames = @("Microsoft-Windows-Dhcp-Client/Admin",
              "Microsoft-Windows-Dhcp-Client/Operational",
              "Microsoft-Windows-Dhcpv6-Client/Admin",
              "Microsoft-Windows-Dhcpv6-Client/Operational")
ForEach ($LogName in $LogNames) {
    $EventLog = Get-WinEvent -ListLog $LogName
    if ($EventLog.IsEnabled) {
        Write-Host "Already enabled: $LogName"
    }
    else {
        Write-Host "Enabling: $LogName"
        $EventLog.IsEnabled = $true
        $EventLog.SaveChanges()
    }
}
Example 1. Collecting Windows DHCP client logs

This configuration collects events from the IPv4 and IPv6 Admin and Operational DHCP client logs using the im_msvistalog module.

nxlog.conf
<Input dhcp_client_eventlog>
    Module  im_msvistalog
    <QueryXML>
      <QueryList>
        <Query Id="0">
          <Select Path="Microsoft-Windows-Dhcp-Client/Admin">*</Select>
          <Select Path="Microsoft-Windows-Dhcp-Client/Operational">*</Select>
          <Select Path="Microsoft-Windows-Dhcpv6-Client/Admin">*</Select>
          <Select Path="Microsoft-Windows-Dhcpv6-Client/Operational">*</Select>
        </Query>
      </QueryList>
    </QueryXML>
</Input>
Disclaimer

While we endeavor to keep the information in this topic up to date and correct, NXLog makes no representations or warranties of any kind, express or implied about the completeness, accuracy, reliability, suitability, or availability of the content represented here.

The accurateness of the content was tested and proved to be working in our lab environment at the time of the last revision with the following software versions:

Windows Server 2022
Windows Server 2019
NXLog version 5.4.7313

Last revision: 18 January 2022