<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>SPLUNK all the way!<o:p></o:p></p><p class=MsoNormal>There’s a DHCP app that can be customized to tailor your specific needs.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:navy'>Chance</span><span style='color:navy'> <o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><pre>Thanks for the feedback.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>I do already use syslog-ng, which can help, but the analysis I am wanting is <o:p></o:p></pre><pre>for making graphs and statistical reports based scopes of interest that are <o:p></o:p></pre><pre>not known in advance, and so I always want to log all DHCP activity, and <o:p></o:p></pre><pre>then extract the interesting cross section after the fact, and then produce <o:p></o:p></pre><pre>reports and graphs from it.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>--<o:p></o:p></pre><pre>Gordon A. Lang<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>----- Original Message ----- <o:p></o:p></pre><pre>From: "Randy Gordey" <<a href="https://lists.isc.org/mailman/listinfo/dhcp-users">gordey at stdio.com</a>><o:p></o:p></pre><pre>To: "'Users of ISC DHCP'" <<a href="https://lists.isc.org/mailman/listinfo/dhcp-users">dhcp-users at lists.isc.org</a>><o:p></o:p></pre><pre>Sent: Saturday, June 18, 2011 4:57 PM<o:p></o:p></pre><pre>Subject: RE: DHCP log analysis software ?<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>><i> Hoping to cut down on some of your coding and debugging time... I use<o:p></o:p></i></pre><pre>><i> syslog-ng to parse DHCP messages out of /var/log/messages and either <o:p></o:p></i></pre><pre>><i> forward<o:p></o:p></i></pre><pre>><i> them to my central logging server or at the log server put them in<o:p></o:p></i></pre><pre>><i> /var/log/dhcpd.log. One file to examine. You could also put all logs in a<o:p></o:p></i></pre><pre>><i> sub directory by machine like /var/log/dhcp/192.168.1.1.dhcp.log with<o:p></o:p></i></pre><pre>><i> syslog-ng just as easy.<o:p></o:p></i></pre><pre>><i><o:p> </o:p></i></pre><pre>><i> -----Original Message-----<o:p></o:p></i></pre><pre>><i> From: dhcp-users-bounces+gordey=<a href="https://lists.isc.org/mailman/listinfo/dhcp-users">stdio.com at lists.isc.org</a><o:p></o:p></i></pre><pre>><i> [mailto:dhcp-users-bounces+gordey=<a href="https://lists.isc.org/mailman/listinfo/dhcp-users">stdio.com at lists.isc.org</a>] On Behalf Of<o:p></o:p></i></pre><pre>><i> Gordon A. Lang<o:p></o:p></i></pre><pre>><i> Sent: Saturday, June 18, 2011 8:08 AM<o:p></o:p></i></pre><pre>><i> To: <a href="https://lists.isc.org/mailman/listinfo/dhcp-users">dhcp-users at isc.org</a><o:p></o:p></i></pre><pre>><i> Subject: DHCP log analysis software ?<o:p></o:p></i></pre><pre>><i><o:p> </o:p></i></pre><pre>><i> I was thinking about writing a program to analyze my DHCP logs.<o:p></o:p></i></pre><pre>><i> I think it was be very useful to have a filter program that accepts<o:p></o:p></i></pre><pre>><i> a raw syslog stream that includes messages from all servers of<o:p></o:p></i></pre><pre>><i> interest, collects and normalizes the DHCP messages, selects<o:p></o:p></i></pre><pre>><i> interesting messages using a regular expression, and provides<o:p></o:p></i></pre><pre>><i> a set of parameters every <n> seconds. The set of parameters<o:p></o:p></i></pre><pre>><i> would include:<o:p></o:p></i></pre><pre>><i> 1. Number of DISCOVER's<o:p></o:p></i></pre><pre>><i> 2. Number of REQUEST's<o:p></o:p></i></pre><pre>><i> 3. Number of OFFER response times less than <t1><o:p></o:p></i></pre><pre>><i> 4. Number of OFFER response times between <t1> and <t2><o:p></o:p></i></pre><pre>><i> 5. Number of OFFER response times between <t2> and <t3><o:p></o:p></i></pre><pre>><i> 6. Number of OFFER response times greater than <t3><o:p></o:p></i></pre><pre>><i> 7. Number of ACK response times less than <t4><o:p></o:p></i></pre><pre>><i> 8. Number of ACK response times between <t4> and <t5><o:p></o:p></i></pre><pre>><i> 9. Number of ACK response times between <t5> and <t6><o:p></o:p></i></pre><pre>><i> 10. Number of ACK response times greater than <t6><o:p></o:p></i></pre><pre>><i><o:p> </o:p></i></pre><pre>><i> I am picturing the output of the filter could be fed into another<o:p></o:p></i></pre><pre>><i> filter that could produce moving averages of DISCOVER and<o:p></o:p></i></pre><pre>><i> REQUEST rates as well as moving averages of each of the<o:p></o:p></i></pre><pre>><i> four response time occurrence rates for OFFER's and ACK's.<o:p></o:p></i></pre><pre>><i><o:p> </o:p></i></pre><pre>><i> I would also like to see the filter use knowledge about the failover<o:p></o:p></i></pre><pre>><i> pairs and pool associations for each to report events on a per<o:p></o:p></i></pre><pre>><i> pool basis -- things like pool depletion, excessive pool<o:p></o:p></i></pre><pre>><i> balancing, persisting pool imbalance, broadcast packets going<o:p></o:p></i></pre><pre>><i> to one server but not the other, packets going to the wrong server,<o:p></o:p></i></pre><pre>><i> server providing responses when the response was supposed<o:p></o:p></i></pre><pre>><i> to come from its partner, and whatever else.<o:p></o:p></i></pre><pre>><i><o:p> </o:p></i></pre><pre>><i> But it occurred to me that there is probably something out there<o:p></o:p></i></pre><pre>><i> already written and debugged, so why reinvent the wheel? And<o:p></o:p></i></pre><pre>><i> besides, a program like this would take a lot more time than I<o:p></o:p></i></pre><pre>><i> have available right now, and I could really use something today.<o:p></o:p></i></pre><pre>><i><o:p> </o:p></i></pre><pre>><i> Does anyone know of something available?<o:p></o:p></i></pre><pre>><i><o:p> </o:p></i></pre><pre>><i> --<o:p></o:p></i></pre><pre>><i> Gordon A. Lang<o:p></o:p></i></pre><pre>><i> _______________________________________________<o:p></o:p></i></pre><pre>><i> dhcp-users mailing list<o:p></o:p></i></pre><pre>><i> <a href="https://lists.isc.org/mailman/listinfo/dhcp-users">dhcp-users at lists.isc.org</a><o:p></o:p></i></pre><pre>><i> <a href="https://lists.isc.org/mailman/listinfo/dhcp-users">https://lists.isc.org/mailman/listinfo/dhcp-users</a><o:p></o:p></i></pre><pre>><i><o:p> </o:p></i></pre><pre>><i> _______________________________________________<o:p></o:p></i></pre><pre>><i> dhcp-users mailing list<o:p></o:p></i></pre><pre>><i> <a href="https://lists.isc.org/mailman/listinfo/dhcp-users">dhcp-users at lists.isc.org</a><o:p></o:p></i></pre><pre>><i> <a href="https://lists.isc.org/mailman/listinfo/dhcp-users">https://lists.isc.org/mailman/listinfo/dhcp-users</a><o:p></o:p></i></pre><p class=MsoNormal><o:p> </o:p></p></div></body></html>