Windows DHCP Server

This SAM application monitor template assesses the status and overall health of services and performance of a Microsoft Windows DHCP server.

Prerequisites

WMI access to the target server.

Credentials

Windows Administrator on the target server.

Component monitors

Component monitors without predetermined threshold values provide guidance such as "Use the lowest threshold possible" or "Use the highest threshold possible" to help you find an appropriate threshold for your environment. See Manage thresholds in SAM.

All Windows Event Log monitors (beginning with Warning or Error) should return zero values. Returned values other than zero indicate an abnormality. Examining the Windows System log file should provide information pertaining to the issue.

Packets Received/sec

Returns the rate at which packets are received by the DHCP server.

A high value indicates heavy DHCP-related message traffic to the server.

Duplicates Dropped/sec

Returns the rate at which the DHCP server received duplicate packets.

A high value indicates that clients are probably timing out too fast or that the server is taking a great deal of time to respond.

Packets Expired/sec

Returns the rate at which packets expire in the DHCP server message queue. Packets expire because they are in the server's internal message queue too long.

A large number indicates that the server is either taking too long to process some packets while other packets are queued and becoming stale, or traffic on the network is too high for the DHCP server to handle. This suggests either a disk or memory bottleneck.

Milliseconds per Packet (Avg)

Returns the average time per packet taken by the DHCP server to send a response.

This number can vary depending upon the server hardware and its I/O subsystem. A sudden or unreasonable increase may indicate a problem, either with the I/O subsystem slowing or because of intrinsic processing overhead on the server computer.

Active Queue Length

Returns the number of packets in the processing queue of the DHCP server. This number equals the number of unprocessed messages received by the server.

A high value may indicate heavy server traffic.

Conflict Check Queue Length

Returns the number of packets waiting in the DHCP server queue due to conflict detection. This queue holds messages that have not been responded to while the DHCP server performs address conflict detection.

A high value may indicate that conflict detection attempts have been set too high in DHCP server properties or that there is heavy lease traffic at the server.

Discovers/sec

Returns the rate at which DHCP Discovers have been received by the DHCP server.

A sudden or abnormal increase indicates that a large number of clients are probably attempting to initialize and obtain an IP address lease from the server. This may indicate that a number of client computers are started at one time.

Offers/sec

Returns the rate at which DHCP Offers have been sent out by the DHCP server.

A sudden or abnormal increase in this value indicates heavy traffic on the server.

Requests/sec

Returns the rate at which DHCP Requests have been received by the DHCP server.

A sudden or abnormal increase in this value may indicate a large number of clients trying to renew their leases with the DHCP server. This may indicate that scope lease times are too short.

Informs/sec

Returns the rate at which DHCP Informs have been received by the DHCP server.

DHCP inform messages are used when the DHCP server queries the directory service for the enterprise root and when dynamic updates are being done on behalf of clients by the server.

Acks/sec

Returns the rate at which DHCP Acknowledgements have been sent by the DHCP server.

A sudden or abnormal increase in this number indicates that a large number of clients are being renewed by the DHCP server. This may indicate that scope lease times are too short.

Nacks/sec

Returns the rate at which DHCP negative acknowledgments (Nacks) have been sent by the DHCP server.

A high value may indicate potential network problems such as misconfiguration of clients or the server. One possible cause of server problems is a deactivated scope. For clients, a very high value could be caused by computers moving between subnets, such as laptop portables or other mobile devices.

Declines/sec

Returns the rate at which DHCP Declines have been received by the DHCP server.

A high value indicates that several clients have found their address to be in conflict, possibly indicating network trouble. It may help to enable conflict detection on the DHCP server. Conflict detection should only be used temporarily on the server.

Releases/sec

Returns the rate at which DHCP Releases have been received by the DHCP server.

This number is only incremented when clients manually release their address, such as when the ipconfig/release command is used at the client computer. Because clients rarely release their address, this counter should not be high for most networks and configurations.

Service: DHCP Server

Performs TCP/IP configuration for DHCP clients, including dynamic assignments of IP addresses, specification of the WINS and DNS servers, and connection-specific DNS names. If this service is stopped or disabled, the DHCP server will not perform TCP/IP configuration for clients and any services that explicitly depend on it will fail to start.

DHCP User Experience Monitor

Measures the time it takes to get a lease from a DHCP server. The monitor verifies that the DHCP responds with an IP address, but neither confirms nor accepts the lease.

Warning: Jet Database Error

Monitors events when a problem occurs with the Jet database.

Type of event: Warning. Event ID: 1014.

If the DHCP server database becomes corrupted or is lost, you should restore your backup database file.

Error: DHCP Server is Shutting Down with Error

Monitors events when the DHCP Server service is shutting down due to an error.

Type of event: Error. Event ID: 1008.

The DHCP Server service is dependent on these services: Service Controller, Global parameters initialization, Registry parameters initialization, RPC server start, Winsock data initialization. The failure of any of these services to initialize or start can cause the DHCP Server service to fail.

Error: Failed to Restore Database

Monitors events when the DHCP service failed to restore the database.

Type of event: Error. Event ID: 1018.

If the DHCP server database becomes corrupted or is lost, you should restore your backup database file.

Error: Failed to Initialize Database

Monitors events when the DHCP service failed to initialize the database.

Type of event: Error. Event ID: 1004.

If the DHCP server database becomes corrupted or is lost you should restore your backup database file.

Warning: Server Scope is Almost Full

Monitors events when the server scope is almost full and there are few free IP addresses left.

Type of event: Warning. Event ID: 1020.

If the DHCP server does not have IP addresses available to provide to the requesting client, then the request fails, and the client might not be able to communicate with other computers on the network.

To resolve this issue, you can extend the DHCP scopes or reduce the lease duration.

Error: Server Scope is Full

Monitors events when there are no IP addresses available for lease in the scope or super-scope.

Type of event: Error. Event ID: 1063.

If the DHCP server does not have IP addresses available to provide to the requesting client, then the request fails, and the client might not be able to communicate with other computers on the network. To resolve this issue, you can extend the DHCP scopes or reduce the lease duration.