DHCP relay failure

DHCP_relay_failure_1_Rule (Rule)

Knowledge Base article:

Management Pack
Summary
The DHCP Relay Agent (IPBOOTP) encountered an error in relaying a DHCP request or reply.
 
Causes
The most common reasons for this error are:
  1. The connection has been dropped, because of a network failure or because the system on the other end went down without notice.
  2. The network subsystem has failed.
  3. The Windows Sockets implementation was unable to allocate the needed resources for its internal operation.
 
Resolutions
  1. If the server is low on memory, take appropriate action to increase the available memory. See Help and Support Center for information on low memory.
  2. Stop and restart the Routing and Remote Access service.
  3. If the problem persists, restart the server.
 
Sample Event
Sample Event#1: IPBOOTP was unable to relay a DHCP REQUEST packet on the local interfacewith IP address %1; the REQUEST was to have been relayed tothe DHCP server with IP address %2.The data is the error code.
Sample Event#2: IPBOOTP was unable to relay a DHCP REPLY packet on the local interfacewith IP address %1; the REPLY was to have been relayed tothe DHCP client with hardware address %2.The data is the error code.
 
© 2004 Microsoft Corporation, all rights reserved.

Element properties:

TargetMicrosoft.Windows.RemoteAccess.2012.Class.VPNServer
CategoryEventCollection
EnabledTrue
Alert GenerateFalse
RemotableTrue
Event LogSystem

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectEvent Default

Source Code:

<Rule ID="DHCP_relay_failure_1_Rule" Enabled="true" Target="Microsoft.Windows.RemoteAccess.2012.Class.VPNServer" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>MatchesRegularExpression</Operator>
<Pattern>^(30018|30019)$</Pattern>
</RegExExpression>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>ContainsSubstring</Operator>
<Pattern>IPBOOTP</Pattern>
</RegExExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WriteToDB" TypeID="SystemCenter!Microsoft.SystemCenter.CollectEvent"/>
</WriteActions>
</Rule>