<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 1/29/2013 12:23 PM, James M Keller
wrote:<br>
</div>
<blockquote cite="mid:5108057F.3040204@houseofzen.org" type="cite">
<pre wrap="">All,
Am am moving our DHCP infrastructure off MS DHCP and onto ISC BIND based
appliances. One of the issues was getting our internal security
auditing tools re-integrated with the log feed from ISC DHCPD vs
Windows. The only outstanding issue is windows was explicitly logging
the lease expiration in the log which was used for correlation by our
SOC. Right now with the default syslog settings we get all the DHCP
packet events (DISCOVER, REQUEST, INFORM, RELEASE, ACK, NACK, etc) but
not an internal operation like the lease expiring. Is this possible in
the stock builds?
Thanks in advance.
</pre>
</blockquote>
<br>
<tt>So I got some off-list responses that helped, </tt>I also tried
to get a custom log going but I'm not getting any log entries.
Based on another example I found I wrapped this in a class with an
always true match if expression. I'm not seeing any of these logs
in syslog. I've also tried the same if/log block in a class that
I know is matching already, and all the other dhcpd logs are in
syslog as expected... <br>
<br>
Any suggestions?<br>
<br>
<br>
class "LOGGING" {<br>
<br>
match if 1 = 1<br>
<p class="MsoNormal"> # Custom DHCP Logging<o:p></o:p></p>
<p class="MsoNormal"> #<o:p></o:p></p>
<p class="MsoNormal"> # Log Only when DHCP Message type is:<o:p></o:p></p>
<p class="MsoNormal"> # 1 - DISCOVER<o:p></o:p></p>
<p class="MsoNormal"> # 3 - REQUEST<o:p></o:p></p>
<p class="MsoNormal"> if ((option dhcp-message-type = 1) or
(option dhcp-message-type = 3)) {<o:p></o:p></p>
<p class="MsoNormal"> log(info, concat("DHCP_LOG: ",<o:p></o:p></p>
<p class="MsoNormal"> (concat("dhcp-user-class = ", option
user-class)),<o:p></o:p></p>
<p class="MsoNormal"> (concat("hardware = ", binary-to-ascii(16,
8, ":", hardware))),<o:p></o:p></p>
<p class="MsoNormal"> (concat("dhcp-client-identifier = ",
binary-to-ascii (16, 8, ":", option dhcp-client-identifier))),<o:p></o:p></p>
<p class="MsoNormal"> (concat("circuit-id-vlan = ",
binary-to-ascii(10, 16, "", substring(option
agent.circuit-id,2,2)))),<o:p></o:p></p>
<p class="MsoNormal"> (concat("circuit-id-port = ",
binary-to-ascii(10, 16, "/", substring(option
agent.circuit-id,4,4)))),<o:p></o:p></p>
<p class="MsoNormal"> (concat("remote-id = ", option
agent.remote-id)),<o:p></o:p></p>
<p class="MsoNormal"> (concat("vendor-class-identifier = ",
option vendor-class-identifier)),<o:p></o:p></p>
<p class="MsoNormal"> (concat("hostname = ", option host-name))<o:p></o:p></p>
<p class="MsoNormal"> ));<o:p></o:p></p>
}<br>
<br>
}<br>
<pre class="moz-signature" cols="72">--
---
James M Keller</pre>
</body>
</html>