DHCP logs filling up hard drive – Can I delete DHCP log files ?

Today’s challenge involved a Domain Controller (DC) with a hard drive that was gradually filling up. Domain Controllers shouldn’t really increase in this way so some investigation was needed.

The obvious search for large files proved fruitless so I began to look at Event Viewer. The errors that were present pointed towards an issue with DHCP. See below.

“The DHCP service encountered the following error when backing up the database : An error occurred while accessing the DHCP database. Look at the DHCP server event log for more information on this error”.

The next step was to locate the DHCP logs which can be found in %windir%\System32\Dhcp (C:\Windows\System32\Dhcp). When I came to this location I noticed the whole directory was full of old log files and a ‘Backup folder’. Inside the backup folder was another folder called ‘old’. In total the whole Dhcp directory equalled 17GB.
Having checked the DHCP directory on our other DC I could see that the folder should be around 20 MB not 17 GB so I knew this was the reason the drive was filling up. After some Googling I came to learn that DHCP writes to log files before it commits them to the database, therefore, if for some reason it can’t write to the database it will continue creating logs.
My initial thought was “Can I delete DHCP log files ?”. I believe the answer is ‘Yes’ but in the end I didn’t need to because I found the root of the problem and made the server rectify the issue.

The solution
1. Restart DHCP server service
2. Restart DHCP client service
3. Do a manual backup of DHCP by going to DHCP on the server > Open the DHCP management console > Right click the server name in the tree view on the left and choose backup. It will default to C:\Windows\System32\Dhcp\backup as the location to back up to. This is fine so click OK.
You will see that the logs have now cleared and there are no further errors in Event Viewer.