Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows Server 2012 system that is running a DHCP server. Attempting to stop the service took over 1 hour to complete. It was writing gigabytes of .LOG files to C:\Windows\System32\dhcp every day (currently it's around 16 gb in size).

Has anyone seen such an issue and how do you fix it?

No events appear in the Windows Event Log Viewer in the DHCP server area, so I'm not sure what these files really are. They are binary files named like this:

j5000A1C.log j5000A1D.log

Each file that starts with the first letter j is 1 meg in size and there are about 16 gigabytes of them.

There are ALSO some human readable logs, including two for today which I'm showing snippets from:

This appears to be activity for the DHCP-for-ip-v4 log for today:

ID,Date,Time,Description,IP Address,Host Name,MAC Address,User Name, TransactionID, QResult,Probationtime, CorrelationID,Dhcid,VendorClass(Hex),VendorClass(ASCII),UserClass(Hex),UserClass(ASCII),RelayAgentInformation.
24,02/19/13,00:00:45,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,00:00:45,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,00:00:45,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,00:15:38,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,00:15:38,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,00:15:38,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,01:30:48,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,01:30:48,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,01:30:48,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,02:45:45,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,02:45:45,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,02:45:45,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,04:01:00,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,04:01:00,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,04:01:00,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,05:15:59,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,05:15:59,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,05:15:59,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,06:31:09,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,06:31:09,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,06:31:09,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,07:46:10,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,07:46:10,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,07:46:10,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,09:01:14,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,09:01:14,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,09:01:14,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,10:16:16,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,10:16:16,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,10:16:16,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,11:31:26,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,11:31:26,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,11:31:26,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,12:47:42,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,12:47:42,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,12:47:42,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
24,02/19/13,14:02:37,Database Cleanup Begin,,,,,0,6,,,,,,,,
25,02/19/13,14:02:37,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
25,02/19/13,14:02:37,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,
01,02/19/13,14:37:23,Stopped,,,,,0,6,,,,,,,,
00,02/19/13,14:42:54,Started,,,,,0,6,,,,,,,,
55,02/19/13,14:42:54,Authorized(servicing),,rentalpoint.local,,,0,6,,,,,,,,

This one appears to be a DHCP-for-ip-v6 log for today:

ID,Date,Time,Description,IPv6 Address,Host Name,Error Code, Duid Length, Duid Bytes(Hex),User Name,Dhcid,Subnet Prefix.
11020,02/19/13,00:15:38,DHCPV6 Database Cleanup Begin,,,,,,,,,,
11019,02/19/13,00:15:38,DHCPV6 0 leases expired and 0 leases deleted,,,,,,,,,,
11021,02/19/13,00:15:38,DHCPV6 Database Cleanup End,,,,,,,,,,
11030,02/19/13,00:30:48,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11030,02/19/13,01:45:45,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11030,02/19/13,03:01:00,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11030,02/19/13,04:15:59,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11030,02/19/13,05:31:09,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11030,02/19/13,06:46:10,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11030,02/19/13,08:01:14,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11030,02/19/13,09:16:16,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11030,02/19/13,10:31:26,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11030,02/19/13,11:47:42,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11030,02/19/13,13:02:37,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11030,02/19/13,14:17:31,0 DHCPV6 Stateless client records purged,,,,,,,,,,
11011,02/19/13,14:37:23,DHCPV6 Stopped,,,,,,,,,,

I'm really stumped by what these "j.log" files are all about.

I have both ipv4 and ipv6 DHCP servers running, but the ipv6 server has NO options configured. that means what I see is no checkboxes checked, so I guess, 100% default options for DHCP-for-ip-v6:

enter image description here

It appears that the DHCP server was in a "runaway train" mode, and that restarting the service has made it stop doing the above. However I'd like to know what causes this, and if I can somehow watch what it's writing to all those log files. (Someone in comments tells me this is MS Access format transaction-log files, used for the DHCP Service Database) Update Insane Windows Server 2012 DHCP server behaviour has not reappeared. It appears to have been a one time freak-out.

share|improve this question
1  
Those are the DHCP Database Transaction Logs... Very not normal. What doe the activity logs say is going on DhcpSvrLog-$DAY.log in the same directory? Do you have DHCPv6 configured (possibly with an incredibly short lease time)?? –  Chris S Feb 19 '13 at 19:43
    
TechNet about DHCP Service Database Files: technet.microsoft.com/en-us/library/cc958926.aspx –  jscott Feb 19 '13 at 19:43
    
I have posted the activity logs above, the whole things, for *-tues.log –  Warren P Feb 19 '13 at 19:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.