Explicitly log lease expiration

James M Keller jmkeller at houseofzen.org
Tue Jan 29 17:23:11 UTC 2013


All,

Am am moving our DHCP infrastructure off MS DHCP and onto ISC BIND based
appliances.   One of the issues was getting our internal security
auditing tools re-integrated with the log feed from ISC DHCPD vs
Windows.   The only outstanding issue is windows was explicitly logging
the lease expiration in the log which was used for correlation by our
SOC.   Right now with the default syslog settings we get all the DHCP
packet events (DISCOVER, REQUEST, INFORM, RELEASE, ACK, NACK, etc) but
not an internal operation like the lease expiring.   Is this possible in
the stock builds?

Thanks in advance.

-- 
---
James M Keller



More information about the dhcp-users mailing list