Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to read the DHCP server logs in C:\Windows\System32\dhcp.

Initially, I tried to read them with nxlog, but nxlog complained that the files don't exist. Then I opened up a Python IDLE shell (as administrator) and tried listing the contents of C:\Windows\System32\dhcp (python command: os.listdir('C:\Windows\System32\dhcp')), and it says that "The system cannot find the path specified".

I'm guessing its a permissions issue, but I'm not familiar enough with Windows permissions to figure it out. The python script can list the contents of C:\Windows\System32, so I assume the permissions are ok up to that point. Right-clicking the 'dhcp' folder I see that all "Group or user names" listed have at least "Read & Execute" permissions on the folder, so I don't know what else to change.


share|improve this question
have you tried stopping the service to see if the service has the file locked? try dragging a copy out to another folder and see if you can open the copy... – MikeAWood Mar 10 '14 at 18:53

First of course, make sure those files are inside the folder. You also should check the permissions on the files directly. The permissions don't necessarily apply identically to child objects.

share|improve this answer

I am not sure if this is still an issue for you, however this appears to be solved if you use SysNative in place of System32, e.g.:

<Input dhcplogs>
    Module      im_file
    File        "C:\\Windows\\Sysnative\\dhcp\\DhcpSrvLog-*.log"
    SavePos     TRUE
    InputType   LineBased
    Exec $Message = $raw_event;

I don't completely understand it enough to break it down, but the below section from this msdn page indicates that it has to do with the interplay of 32 vs 64 bit applications:

32-bit applications can access the native system directory by substituting %windir%\Sysnative for %windir%\System32. WOW64 recognizes Sysnative as a special alias used to indicate that the file system should not redirect the access. This mechanism is flexible and easy to use, therefore, it is the recommended mechanism to bypass file system redirection. Note that 64-bit applications cannot use the Sysnative alias as it is a virtual directory not a real one.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.