Windows DHCP Server (updated)

Windows DHCP Server

This template assesses the status and overall health of services and performance of a Microsoft DHCP server.

Prerequisites: WMI access to the target server.

Credentials: Windows Administrator on the target server.

Monitored Components

Note: You need to set thresholds for counters according to your environment. It is recommended that you monitor counters for a length of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415.

Note: All Windows Event Log monitors (beginning with Warningor Error) should return zero values. Returned values other than zero indicate an abnormality. Examining the Windows System log file should provide information pertaining to the issue.

Packets Received/sec

This component monitor returns the rate at which packets are received by the DHCP server.

A high value indicates heavy DHCP-related message traffic to the server.

Duplicates Dropped/sec

This component monitor returns the rate at which the DHCP server received duplicate packets.

A high value indicates that clients are probably timing out too fast or that the server is taking a great deal of time to respond.

Packets Expired/sec

This component monitor returns the rate at which packets expire in the DHCP server message queue. Packets expire because they are in the server's internal message queue too long.

A large number indicates that the server is either taking too long to process some packets while other packets are queued and becoming stale, or traffic on the network is too high for the DHCP server to handle. This suggests either a disk or memory bottleneck.

Milliseconds per Packet (Avg)

This component monitor returns the average time per packet taken by the DHCP server to send a response.

This number can vary depending upon the server hardware and its I/O subsystem. A sudden or unreasonable increase may indicate a problem, either with the I/O subsystem slowing or because of intrinsic processing overhead on the server computer.

Active Queue Length

This component monitor returns the number of packets in the processing queue of the DHCP server. This number equals the number of unprocessed messages received by the server.

A high value may indicate heavy server traffic.

Conflict Check Queue Length

This component monitor returns the number of packets waiting in the DHCP server queue due to conflict detection. This queue holds messages that have not been responded to while the DHCP server performs address conflict detection.

A high value may indicate that conflict detection attempts have been set too high in DHCP server properties or that there is heavy lease traffic at the server.

Discovers/sec

This component monitor returns the rate at which DHCP Discovers have been received by the DHCP server.

A sudden or abnormal increase indicates that a large number of clients are probably attempting to initialize and obtain an IP address lease from the server. This may indicate that a number of client computers are started at one time.

Offers/sec

This component monitor returns the rate at which DHCP Offers have been sent out by the DHCP server.

A sudden or abnormal increase in this value indicates heavy traffic on the server.

Requests/sec

This component monitor returns the rate at which DHCP Requests have been received by the DHCP server.

A sudden or abnormal increase in this value may indicate a large number of clients trying to renew their leases with the DHCP server. This may indicate that scope lease times are too short.

Informs/sec

This component monitor returns the rate at which DHCP Informs have been received by the DHCP server.

DHCP inform messages are used when the DHCP server queries the directory service for the enterprise root and when dynamic updates are being done on behalf of clients by the server.

Acks/sec

This component monitor returns the rate at which DHCP Acknowledgements have been sent by the DHCP server.

A sudden or abnormal increase in this number indicates that a large number of clients are being renewed by the DHCP server. This may indicate that scope lease times are too short.

Nacks/sec

This component monitor returns the rate at which DHCP negative acknowledgments (Nacks) have been sent by the DHCP server.

A high value may indicate potential network problems such as misconfiguration of clients or the server. One possible cause of server problems is a deactivated scope. For clients, a very high value could be caused by computers moving between subnets, such as laptop portables or other mobile devices.

Declines/sec

This component monitor returns the rate at which DHCP Declines have been received by the DHCP server.

A high value indicates that several clients have found their address to be in conflict, possibly indicating network trouble. It may help to enable conflict detection on the DHCP server. Conflict detection should only be used temporarily on the server.

Releases/sec

This component monitor returns the rate at which DHCP Releases have been received by the DHCP server.

This number is only incremented when clients manually release their address, such as when the ipconfig/releasecommand is used at the client computer. Because clients rarely release their address, this counter should not be high for most networks and configurations.

Service: DHCP Server

This component monitor performs TCP/IP configuration for DHCP clients, including dynamic assignments of IP addresses, specification of the WINS and DNS servers, and connection-specific DNS names. If this service is stopped or disabled, the DHCP server will not perform TCP/IP configuration for clients and any services that explicitly depend on it will fail to start.

DHCP User Experience Monitor

This component monitor measures the time it takes to get a lease from a DHCP server. The monitor verifies that the DHCP responds with an IP address, but neither confirms nor accepts the lease.

Warning: Jet Database Error

This component monitors events when a problem occurs with the Jet database.

Type of event: Warning. Event ID: 1014.

If the DHCP server database becomes corrupted or is lost, you should restore your backup database file. More information can be found here: http://technet.microsoft.com/en-us/library/cc726907(WS.10).aspx.

Error: DHCP Server is Shutting Down with Error

This component monitors events when the DHCP Server service is shutting down due to the error.

Type of event: Error. Event ID: 1008.

The Dynamic Host Configuration Protocol (DHCP) Server service is dependent on these services: Service Controller, Global parameters initialization, Registry parameters initialization, RPC server start, Winsock data initialization. The failure of any of these services to initialize or start can cause the DHCP Server service to fail.

Information how to resolve this issue can be found here: http://technet.microsoft.com/en-us/library/cc726880(WS.10).aspx.

Error: Failed to Restore Database

This component monitors events when the DHCP service failed to restore the database.

Type of event: Error. Event ID: 1018.

If the DHCP server database becomes corrupted or is lost, you should restore your backup database file. More information can be found here: http://technet.microsoft.com/en-us/library/cc726928(WS.10).aspx.

Error: Failed to Initialize Database

This component monitors events when the DHCP service failed to initialize the database.

Type of event: Error. Event ID: 1004.

If the DHCP server database becomes corrupted or is lost you should restore your backup database file. More information can be found here: http://technet.microsoft.com/en-us/library/cc726910(WS.10).aspx.

Warning: Server Scope is Almost Full

This component monitors events when the server scope is almost full and there are few free IP addresses left.

Type of event: Warning. Event ID: 1020.

If the DHCP server does not have IP addresses available to provide to the requesting client, then the request fails, and the client might not be able to communicate with other computers on the network.

To resolve this issue, you can extend the DHCP scopes or reduce the lease duration. More information can be found here: http://social.technet.microsoft.com/wiki/contents/articles/event-id-1020-microsoft-windows-dhcp-server.aspx.

Error: Server Scope is Full

This component monitors events when there are no IP addresses available for lease in the scope or superscope.

Type of event: Error. Event ID: 1063.

If the DHCP server does not have IP addresses available to provide to the requesting client, then the request fails, and the client might not be able to communicate with other computers on the network.

To resolve this issue you can extend the DHCP scopes or reduce the lease duration. More information can be found here: http://technet.microsoft.com/en-us/library/cc774806(WS.10).aspx

Portions of this document were originally created by and are excerpted from the following sources:

Microsoft Corporation, “MSDN Library,” Copyright Copyright 2012 Microsoft Corporation.  All rights reserved. Available at

http://msdn.microsoft.com/en-us/library/ms803971.aspx