---
title: "dhcp.microsoft"
canonical: "https://docs.devo.com/space/latest/340819973/dhcp.microsoft"
format: markdown
---
> Macro (toc)

## Purpose

Use tags in this category to identify events generated by [Microsoft DHCP](https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/dhcp-top) services.

## Send it

Data may be sent using the [NXlog](https://docs.devo.com/space/latest/94658800/NXLog) or the [Devo Relay](https://docs.devo.com/space/latest/96468993/Devo+Relay).

Create a simple rule on your Devo Relay that applies the `dhcp.microsoft` tag to all events arriving on a specified port.

### Example [relay rules](https://docs.devo.com/space/latest/96469377/Defining+a+relay+rule)

For CSV logs:

```
         Source message: 
            Source data: DHCPLog
             Source tag: 
             Target tag: dhcp.microsoft.ip4
Sent without syslog tag: true
```

For JSON logs:

```
         Source message: 
            Source data: \"log_type\":\"dhcpv4\"
             Source tag: 
             Target tag: dhcp.microsoft.ip4.filebeat
Sent without syslog tag: true
```


### Example NXLog configuration

```
## NXLog config for Windows DHCP Server and standard Windows Logs

define ROOT C:\Program Files\nxlog
#define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension json>
    Module      xm_json
</Extension>

<Extension _syslog>
    Module      xm_syslog
</Extension>

<Input in>
    Module          im_msvistalog
    ReadFromLast     True
    Query            <QueryList>\
            <Query Id="0">\
                <Select Path="Application">*</Select>\
                <Select Path="System">*</Select>\
                <Select Path="Security">*</Select>\
                <Select Path="Windows PowerShell">*</Select>\
            </Query>\
        </QueryList>

    <Exec>
        $Message = to_json(); $SourceName="box.win_nxlog."+lc($Channel); delete($ProcessID);
    </Exec>

</Input>

<Input dhcp_server_auditv4>
    Module          im_file
    # Change filepath to directory containing DHCP logfiles
    File 'C:\DhcpSrvLog-*.log'
    <Exec>
        # Only process lines that begin with an event ID
        if $raw_event =~ /^\d+,/
        {
            $SourceName="dhcp.microsoft.ip4";
            $EventTime = strptime($Date + ' ' + $Time, '%m/%d/%y %H:%M:%S');
        }
        # Discard header lines (which do not begin with an event ID)
        else
        {
                drop();
        }

    </Exec>
</Input>

<Input dhcp_server_auditv6>
    Module          im_file
    # Change filepath to directory containing DHCP logfiles
    File 'C:\DhcpV6SrvLog-*.log'
    <Exec>
        # Only process lines that begin with an event ID
        if $raw_event =~ /^\d+,/
        {
            $SourceName="dhcp.microsoft.ip6";
            $EventTime = strptime($Date + ' ' + $Time, '%m/%d/%y %H:%M:%S');
        }
        # Discard header lines (which do not begin with an event ID)
        else
        {
                drop();
        }

    </Exec>
</Input>

<Output devo_relay>
    Module      om_tcp
    # Devo relay IP, replace 127.0.0.1 with the appropriate IP for your org
    Host        127.0.0.1
    Port        13000
    Exec        to_syslog_bsd();
</Output>

<Route 1>
    Path        in => devo_relay
</Route>

<Route 2>
    Path        dhcp_server_auditv4 => devo_relay
</Route>

<Route 3>
    Path        dhcp_server_auditv6 => devo_relay
</Route>
```

## Secure It

The [dhcp.all](https://docs.devo.com/space/latest/181043251/dhcp.all) union tables help monitor events from this table.

## Tags and ables 

| **[Tags](https://docs.devo.com/space/latest/95126204/About+Devo+tags)** | **[Data tables](https://docs.devo.com/space/latest/94764298/Run+a+search+using+a+finder)** |
| --- | --- |
| `dhcp.microsoft.ip4` | `dhcp.microsoft.ip4` |
| `dhcp.microsoft.ip4.filebeat` | `dhcp.microsoft.ip4` |
| `dhcp.microsoft.ip6` | `dhcp.microsoft.ip6` |
| `dhcp.microsoft.ip6.filebeat` | `dhcp.microsoft.ip6` |