Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to read the DHCP server logs in C:\Windows\System32\dhcp.

Initially, I tried to read them with nxlog, but nxlog complained that the files don't exist. Then I opened up a Python IDLE shell (as administrator) and tried listing the contents of C:\Windows\System32\dhcp (python command: os.listdir('C:\Windows\System32\dhcp')), and it says that "The system cannot find the path specified".

I'm guessing its a permissions issue, but I'm not familiar enough with Windows permissions to figure it out. The python script can list the contents of C:\Windows\System32, so I assume the permissions are ok up to that point. Right-clicking the 'dhcp' folder I see that all "Group or user names" listed have at least "Read & Execute" permissions on the folder, so I don't know what else to change.

Thanks

share|improve this question
    
have you tried stopping the service to see if the service has the file locked? try dragging a copy out to another folder and see if you can open the copy... –  MikeAWood Mar 10 at 18:53

3 Answers 3

First of course, make sure those files are inside the folder. You also should check the permissions on the files directly. The permissions don't necessarily apply identically to child objects.

share|improve this answer

I am not sure if this is still an issue for you, however this appears to be solved if you use SysNative in place of System32, e.g.:

<Input dhcplogs>
    Module      im_file
    File        "C:\\Windows\\Sysnative\\dhcp\\DhcpSrvLog-*.log"
    SavePos     TRUE
    InputType   LineBased
    Exec $Message = $raw_event;
</Input>

I don't completely understand it enough to break it down, but the below section from this msdn page indicates that it has to do with the interplay of 32 vs 64 bit applications:

32-bit applications can access the native system directory by substituting %windir%\Sysnative for %windir%\System32. WOW64 recognizes Sysnative as a special alias used to indicate that the file system should not redirect the access. This mechanism is flexible and easy to use, therefore, it is the recommended mechanism to bypass file system redirection. Note that 64-bit applications cannot use the Sysnative alias as it is a virtual directory not a real one.

share|improve this answer

Permissions can be complicated depending on group membership, etc. Here is some documentation that may help you.

http://technet.microsoft.com/en-us/library/bb727008.aspx

http://technet.microsoft.com/en-us/library/dd183591%28v=ws.10%29.aspx

share|improve this answer
    
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  EEAA Mar 10 at 18:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.