Windows DHCP Server (2003)

[mdavis43]

We are monitoring Windows 2003 DHCP service from c:\windows\system32\dhcp and there are 7 log files, one for each day.

DhcpSrvLog-Mon.log
DhcpSrvLog-Tue.log
...and so on

At the end of the Monday, the log file closes and then logging starts anew in the Tuesday log file. For some reason, Splunk is not picking up this 'change' in the log file and does not log the Tuesday file until Splunk is restarted. I can simply restart the Splunkforwarder service every night at 12am but I'm wondering if I'm missing a configuration item.

Thanks, Mike

[mdavis43]

Splunk Support answered this..

I agree that there's little reason to use a forwarder restart to manage the ingestion of Windows DHCP logs. In Splunk version 5, the inputs.conf parameter 'initcrclength' was added and certainly could be utilized once you're running on that version.
As you're on 4.3.x the best way to manage the DHCP logs is documented here:

http://splunk-base.splunk.com/answers/1568/windows-dhcp-log-files-too-small-to-match-seekptr-checksu...

Paying particular attention to the example monitor stanza with the whitelist entry and crcsalt:

whitelist = DhcpSrvLog.(Sun|Mon|Tue|Wed|Thu|Fri|Sat)$

crcSalt =

That should give you the bits you need to add to the existing inputs.conf monitor stanza.

[mdavis43]

Here is the monitor stanza...

[monitor://C:\Windows\system32\dhcp\Dhcp*.log]
disabled = false
index = win_prod
sourcetype=DhcpSrvLog
blacklist = \.(gz|bz2|z|zip)$

[araitz]

Can you include the monitor stanza you are using? My guess is you need to specify crcSalt=<SOURCE>, but I can't be sure without more information.