topic Re: Windows DHCP Server (2003) in Installation

Windows DHCP Server (2003)

mdavis43 — Wed, 07 Nov 2012 17:12:26 GMT

We are monitoring Windows 2003 DHCP service from c:\windows\system32\dhcp and there are 7 log files, one for each day.

DhcpSrvLog-Mon.log
DhcpSrvLog-Tue.log
...and so on

At the end of the Monday, the log file closes and then logging starts anew in the Tuesday log file. For some reason, Splunk is not picking up this 'change' in the log file and does not log the Tuesday file until Splunk is restarted. I can simply restart the Splunkforwarder service every night at 12am but I'm wondering if I'm missing a configuration item.

Thanks, Mike

Re: Windows DHCP Server (2003)

araitz — Thu, 08 Nov 2012 15:34:33 GMT

Can you include the monitor stanza you are using? My guess is you need to specify crcSalt=<SOURCE>, but I can't be sure without more information.

Re: Windows DHCP Server (2003)

mdavis43 — Thu, 08 Nov 2012 17:29:15 GMT

Here is the monitor stanza...

[monitor://C:\Windows\system32\dhcp\Dhcp*.log]
disabled = false
index = win_prod
sourcetype=DhcpSrvLog
blacklist = \.(gz|bz2|z|zip)$

Re: Windows DHCP Server (2003)

mdavis43 — Fri, 09 Nov 2012 22:09:09 GMT

Splunk Support answered this..

I agree that there's little reason to use a forwarder restart to manage the ingestion of Windows DHCP logs. In Splunk version 5, the inputs.conf parameter 'initcrclength' was added and certainly could be utilized once you're running on that version.
As you're on 4.3.x the best way to manage the DHCP logs is documented here:

http://splunk-base.splunk.com/answers/1568/windows-dhcp-log-files-too-small-to-match-seekptr-checksum

Paying particular attention to the example monitor stanza with the whitelist entry and crcsalt:

whitelist = DhcpSrvLog.(Sun|Mon|Tue|Wed|Thu|Fri|Sat)$

crcSalt =

That should give you the bits you need to add to the existing inputs.conf monitor stanza.