Windows DHCP Server (2003)

Path Finder

We are monitoring Windows 2003 DHCP service from c:\windows\system32\dhcp and there are 7 log files, one for each day.

...and so on

At the end of the Monday, the log file closes and then logging starts anew in the Tuesday log file. For some reason, Splunk is not picking up this 'change' in the log file and does not log the Tuesday file until Splunk is restarted. I can simply restart the Splunkforwarder service every night at 12am but I'm wondering if I'm missing a configuration item.

Thanks, Mike

Tags (2)
0 Karma

Path Finder

Splunk Support answered this..

I agree that there's little reason to use a forwarder restart to manage the ingestion of Windows DHCP logs. In Splunk version 5, the inputs.conf parameter 'initcrclength' was added and certainly could be utilized once you're running on that version.
As you're on 4.3.x the best way to manage the DHCP logs is documented here:

Paying particular attention to the example monitor stanza with the whitelist entry and crcsalt:

whitelist = DhcpSrvLog.(Sun|Mon|Tue|Wed|Thu|Fri|Sat)$

crcSalt =

That should give you the bits you need to add to the existing inputs.conf monitor stanza.

0 Karma

Path Finder

Here is the monitor stanza...

disabled = false
index = win_prod
blacklist = \.(gz|bz2|z|zip)$
0 Karma

Splunk Employee
Splunk Employee

Can you include the monitor stanza you are using? My guess is you need to specify crcSalt=<SOURCE>, but I can't be sure without more information.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...