| Event Id | 1030 |
| Source | Microsoft-Windows-DHCP-Server |
| Description | The audit log file could not be backed up. The following error occurred:1% |
| Event Information | According to Microsoft : Cause : This event is logged when the audit log file could not be backed up. Resolution : Remove old audit log files or increase the maximum audit log size. If the disk is full or the maximum log size is reached, the DHCP server closes the current file and ignores further requests to log audit events until either midnight or until disk status is improved and the disk is no longer full. If the disk is full, you can add more physical disk space, increase the maximum audit log size, or delete old log files from the default log directory: %windir%\System32\Dhcp. To perform these procedures, you must be a member of theAdministrators group, or you must have been delegated the appropriate authority. To increase the maximum audit log size: 1.ClickStart, typeregedit inStart Search, clickContinue, and then press ENTER. 2.In the registry tree, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\DHCPServer\Parameters, and then press ENTER. 3.Double click DhcpLogFilesMaxSize, selectDecimal, and then type a number greater than the current number inValue data. Verify : To verify that the DHCP audit log is functioning correctly: 1.At the DHCP server, click Start, type Windows Explorer in Start Search, and then press ENTER. 2.Navigate the Windows Explorer tree to %windir%\System32\Dhcp. 3.View and record the most recent DHCP log file date stamps. They should be recent. Repeat this process at regular intervals and note whether new events are being logged. |
| Reference Links | Event ID 1030 from Source Microsoft-Windows-DHCP-Server |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.