如果磁盘已满或已达到最大日志大小,则 DHCP 服务器会关闭当前文件并忽略对日志审核事件的后续请求,直到午夜或磁盘状态得到改进并且不再处于已满状态为止。如果磁盘已满,则您可以增加更多物理磁盘空间,增大最大审核日志大小,或从默认日志目录 %windir%\System32\Dhcp 中删除以前的日志文件。
若要执行这些过程,您必须是管理员组的成员,或者您必须被委派了适当的权限。
若要增大最大审核日志大小,请执行以下操作:
警告:注册表编辑不当可能会严重损坏您的系统。更改注册表之前,您应备份任何有价值的数据。
单击“开始”,并在“开始搜索”中键入 regedit,单击“继续”,然后按 Enter。
在注册表树中,导航到 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\DHCPServer\Parameters,然后按 Enter。
双击“DhcpLogFilesMaxSize”,选择“十进制”,然后在“数值数据”中键入一个大于当前数字的数字。
Target | Microsoft.Windows.DHCPServer.Library.IPv4Runtime | ||
Parent Monitor | System.Health.SecurityState | ||
Category | StateCollection | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | MatchMonitorHealth | ||
Alert Priority | Normal | ||
Alert Auto Resolve | True | ||
Monitor Type | Microsoft.Windows.SingleEventLogManualReset2StateMonitorType | ||
Remotable | True | ||
Accessibility | Public | ||
Alert Message |
| ||
RunAs | Microsoft.Windows.DHCPServer.Library.ActionAccount |
<UnitMonitor ID="Microsoft.Windows.DHCPServer.Library.IPv4Runtime.UnitMonitor.Auditing.2" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.DHCPServer.Library.IPv4Runtime" ParentMonitorID="Health!System.Health.SecurityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.SingleEventLogManualReset2StateMonitorType" ConfirmDelivery="true" RunAs="Microsoft.Windows.DHCPServer.Library.ActionAccount">
<Category>StateCollection</Category>
<AlertSettings AlertMessage="Microsoft.Windows.DHCPServer.Library.IPv4Runtime.UnitMonitor.Auditing.2_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>MatchMonitorHealth</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="EventRaised" MonitorTypeStateID="EventRaised" HealthState="Warning"/>
<OperationalState ID="ManualResetEventRaised" MonitorTypeStateID="ManualResetEventRaised" HealthState="Success"/>
</OperationalStates>
<Configuration>
<ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-DHCP-Server</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">DHCPServer</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1027</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1030</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</And>
</Expression>
</Configuration>
</UnitMonitor>