I'm trying to read the DHCP server logs in C:\Windows\System32\dhcp.

Initially, I tried to read them with nxlog, but nxlog complained that the files don't exist. Then I opened up a Python IDLE shell (as administrator) and tried listing the contents of C:\Windows\System32\dhcp (python command: os.listdir('C:\Windows\System32\dhcp')), and it says that "The system cannot find the path specified".

I'm guessing its a permissions issue, but I'm not familiar enough with Windows permissions to figure it out. The python script can list the contents of C:\Windows\System32, so I assume the permissions are ok up to that point. Right-clicking the 'dhcp' folder I see that all "Group or user names" listed have at least "Read & Execute" permissions on the folder, so I don't know what else to change.


  • have you tried stopping the service to see if the service has the file locked? try dragging a copy out to another folder and see if you can open the copy...
    – MikeAWood
    Mar 10 '14 at 18:53

First of course, make sure those files are inside the folder. You also should check the permissions on the files directly. The permissions don't necessarily apply identically to child objects.


I am not sure if this is still an issue for you, however this appears to be solved if you use SysNative in place of System32, e.g.:

<Input dhcplogs>
    Module      im_file
    File        "C:\\Windows\\Sysnative\\dhcp\\DhcpSrvLog-*.log"
    SavePos     TRUE
    InputType   LineBased
    Exec $Message = $raw_event;

I don't completely understand it enough to break it down, but the below section from this msdn page indicates that it has to do with the interplay of 32 vs 64 bit applications:

32-bit applications can access the native system directory by substituting %windir%\Sysnative for %windir%\System32. WOW64 recognizes Sysnative as a special alias used to indicate that the file system should not redirect the access. This mechanism is flexible and easy to use, therefore, it is the recommended mechanism to bypass file system redirection. Note that 64-bit applications cannot use the Sysnative alias as it is a virtual directory not a real one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.