Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to archive the file data for legal purposes. I need to retain all the dhcp lease information with the UID from the 1st day.

According to man page this file is over written from time to time, however it does not mention the frequency or on what condition is over written. I would like to find out what will be the best way to archive the file?
I do have the file and the backup on the system available, but no sure on how often this file is updated -- should I be archiving it weekly, monthly or some other way?

share|improve this question
Strange requirement. I've never seen this type of logging mandated. – ewwhite Aug 15 '12 at 16:20

Unless you're obligated to specifically keep copies of dhcp.leases, which is highly unlikely, you will be much better off keeping a copy of your dhcp daemon's log.

The dhcp.leases files is written to (and changed) every time a new lease is granted. The log is instead appended, may contain more information (such as DHCPNAK messages) and can be rotated so that is it no longer being written too. There are more virtues of logs, but I think that should be sufficient for now.

share|improve this answer
Thanks, but I need to log the uid, which is not shown in the daemon log, by default at least. The dhcp clients are on an LNS, and I only see LNS's mac address as uid for each leased IP, but I need to see the uid, which is the username of the client, and is contained in the dhcpd.leases file. – Rax Aug 14 '12 at 10:24
To be clear, by uid you mean the dhcp-client identifier and not the user account used to log into a L2TP Network Server, yes? – 84104 Aug 14 '12 at 15:45
sorry, I should have been clear. Yes by "uid" I meant the user account used to log into an L2TP network. – Rax Aug 15 '12 at 9:07
excerpt from file; <lease xx.xx.xx.xx { starts 2 2012/08/14 11:07:11; ends 2 2012/08/14 12:07:11; binding state active; next binding state free; hardware ethernet xxxxxxxxxxxxxxxxxx; uid "\user@dsl"; " – Rax Aug 15 '12 at 9:09

You'll be much better off by reconfiguring your DHCP server to log the user account information.

Take a look at the log configuration option offered by isc-dhcpd. For example, here is a fairly simple example of how to log when a particular device is detected on the network:

class "SPA942" {
   log(info, "Linksys SPA942 detected");
   match if option vendor-class-identifier = "LINKSYS SPA-942";
   option tftp-server-name "";
share|improve this answer

If you really want to archive the dhcpd.leases file you need to use something like famd to monitor it and copy it when it changes/gets replaced.
There is some good documentation on using famd around on the internet - This old Linux Dev Center article is probably a good starting point.

Archiving this way is likely to be space (or at least file/inode) intensive - Based on your comments to 84104's answer you are probably better off logging the user ID from whatever service is performing authentication for your L2TP tunnels. (If you're not performing authentication then the whole thing is pointless: I could send whatever the heck I want as my UID and you'd just log it, so my UID is HaHa@HackedYou :-)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.