DHCP IPv4 Runtime Auditing Log Full Monitor

Microsoft.Windows.DHCPServer.Library.IPv4Runtime.UnitMonitor.Auditing.2 (UnitMonitor)

Knowledge Base article:

Resolutions

If the disk is full or the maximum log size is reached, the DHCP server closes the current file and ignores further requests to log audit events until either midnight or until disk status is improved and the disk is no longer full.If the disk is full, you can add more physical disk space, increase the maximum audit log size,or delete old log files fromthe default log directory:%windir%\System32\Dhcp.

To perform these procedures, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.

Toincrease the maximum audit log size:

Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.

Click Start, type regedit in Start Search, click Continue, and then press ENTER.
In the registry tree, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters, and then press ENTER.
Double click DhcpLogFilesMaxSize, select Decimal, and then type anumber greater thanthe current numberin Value data.

Element properties:

Target

Microsoft.Windows.DHCPServer.Library.IPv4Runtime

Parent Monitor

System.Health.SecurityState

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

MatchMonitorHealth

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.SingleEventLogManualReset2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

DHCP IPv4 Runtime Audit Log Full Alert

{0}

RunAs

Microsoft.Windows.DHCPServer.Library.ActionAccount

Source Code:

<UnitMonitor ID="Microsoft.Windows.DHCPServer.Library.IPv4Runtime.UnitMonitor.Auditing.2" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.DHCPServer.Library.IPv4Runtime" ParentMonitorID="Health!System.Health.SecurityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.SingleEventLogManualReset2StateMonitorType" ConfirmDelivery="true" RunAs="Microsoft.Windows.DHCPServer.Library.ActionAccount">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.DHCPServer.Library.IPv4Runtime.UnitMonitor.Auditing.2_AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="EventRaised" MonitorTypeStateID="EventRaised" HealthState="Warning"/>

    <OperationalState ID="ManualResetEventRaised" MonitorTypeStateID="ManualResetEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>System</LogName>

    <Expression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">Microsoft-Windows-DHCP-Server</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">DHCPServer</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1027</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1030</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </Expression>

  </Configuration>

</UnitMonitor>