Windows server 2016 dhcp parse


i needed to deal with parse DHCP logs on Windows server 2016. i saw someione solved it with nxlog
and I’d like to inform that I’m no NXLog expert, so I’m trying to change this solution and I’m stuck.

i would like to send DHCP log to graylog (GELF UDP and i needed to advise what else do i have change in this configuration

and there is the message example:
thank you for answer.

Please post the complete example message which has been sent to Graylog using your NXLOG configuration.
There are certainly more fields than just the “message” field.

until now, i send message to graylog with sidecar collector and with input from DHCP content pack

But the message was not parsed and seems like this

That’s why I started looking for another option to parse the message.

The content pack correctly adds the ID_Description field.

Other than that, you can use a split extractor to extract the fields you are interested in. The log format can be found here: [ server log file format]( server log file format)

the log format may differ with different server versions (later Windows servers, more fields) so the extractor in the content pack might not work for that reason.

thanks jtkarvo,

i split the message and works fine :slight_smile:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.