Performance, Audit Logging, and Fixes to the DHCP Service

This article was previously published under Q188027
This article has been archived. It is offered "as is" and will no longer be updated.
You may experience one or more of the following problems with a DHCPserveror you may have need of one or more of the following features in a DHCPserver:

  • The performance of DHCP server has been enhanced by using a faster algorithm for traversing a large number of scopes, better management of the DHCP database, and buffered Audit logging. New features have been added for audit logging allowing administrators to specify DHCP log file locations, maximum log file size, and so on, using new registry parameters.

    For more information, please see the MORE INFORMATION section below.
  • Addresses marked BAD because of duplicate address detection are automatically returned to the pool of available addresses after a lease time corresponding to the scope they belong to expires.
  • When compacting the database using Jetpack, a "duplicate key error - 1605" may occur. For more information, please see the following article in the Microsoft Knowledge Base:
    ARTICLE-ID: 191922
    TITLE : Error 1605 When Jetpacking DHCP Database
  • DHCP NACK behavior has been modified. Prior to Windows NT 4.0 Service Pack 3 (and including some Post-SP3 hotfixes), when a DHCP server received a request for an IP address for which the corresponding scope did not exist on the DHCP server, it would incorrectly issue a NACK.

    Currently, if the DHCP server receives a request for an IP address belonging to a subnet about which the DHCP server knows nothing, and the DHCP server knows that the subnet really exists (trusts GIADDR to be valid, or by its own interface card being on that subnet), the DHCP server stays silent.
  • There is a problem adding more than 682 client reservations.
  • Under stress, the DHCP service may stop responding (hang) because of a deadlock. This occurs when audit logging is enabled.
  • While processing a DHCP decline packet and checking for a badly formatted packet, DHCP server also checks the "requested address" field in the DhcpOption field. RFC 2131 requires this option to be present but RFC 1541 does not mandate it.
To resolve this problem, obtain the latest service pack for Windows NT 4.0 or Windows NT Server 4.0, Terminal Server Edition. For additional information, click the following article number to view the article in theMicrosoft Knowledge Base:
152734 How to Obtain the Latest Windows NT 4.0 Service Pack

Microsoft has confirmed that this is a problem in Windows NT 4.0 and Windows NT Server 4.0, Terminal Server Edition. This problem was first corrected in Windows NT 4.0 Service Pack 4.0 and Windows NT Server 4.0, Terminal Server Edition Service Pack 4.

Server Behavior

Depending on the day when the server logs, the file is named DHCP serverlog for {Monday, Tuesday, and so on}.

On startup or whenever a new day begins (midnight local time), the serverenters the log header to denote the start of logging. If the file alreadyexists without modification for more than a day, it is overwritten. If thefile already exists, but was modified within the last 24 hours, it isappended to the end.

Every N logs (where N is specified by DhcpLogDiskSpaceCheckInterval), theserver checks to see if the disk space is full. It is considered full ifeither the MinSpaceOnDisk limit is reached or if the file is larger thanthe FilesMaxSize/7 size.

In either case, the server closes the file handle (after logging a pauseevent) and ignores further requests until midnight. But it still checksevery N logs to see if anything has improved. If it has, it opens the logagain and enters the log header and keeps going.

At midnight local time, the server closes the existing log and moves overto the log for the new day.

New registry settings under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\DHCPServer\Parameters:
DhcpLogFilePath - REG_SZ - Gives the directory where the audit log is to be saved. Defaults to the same folder where the database is stored. This path, if specified, must be a full path name including drive specification.

DhcpLogDiskSpaceCheckInterval - REG_DWORD - Gives the number of times to log an event without checking for disk space and new day (each day has a different log file). Defaults to 50.

DhcpLogFilesMaxSize - REG_DWORD - Gives the number of megabytes of space that can be held for all the log files put together. (Currently the check is done for just one/seventh of this size against each file.) Defaults to 7 MB.

DhcpLogMinSpaceOnDisk - REG_DWORD - Gives the number of megabytes of Free space on disk required for logging to continue. Defaults to 20 MB.

Article ID: 188027 - Last Review: 10/09/2013 17:36:53 - Revision: 1.2

Microsoft Windows NT Server 4.0, Terminal Server Edition, Microsoft Windows NT Server 4.0 Standard Edition, Microsoft Windows NT Server 4.0 Enterprise Edition

  • kbnosurvey kbarchive kbhotfixserver kbqfe kbbug kbfix kbwinnt400sp4fix KB188027