After audit logging starts, the DHCP server performs disk checks at regular intervals to ensure both the ongoing availability of server disk space and that the current audit log file does not become too large or that log-file growth is not occurring too rapidly.
The DHCP server performs a full disk check whenever either of the following conditions occurs:
A set number of server events are logged.
The date changes on the server computer.
By default, the DHCP server performs a periodic disk-space check for every 50 events it writes to the audit log. A date change can also be detected by the DHCP server when the server computer reaches 12:00 a.m. on its locally set Date/Time clock.
Each time a disk check is completed, the server determines whether disk space is filled. The disk is considered full if either of the following conditions is true:
Disk space on the server computer is lower than the required minimum amount for DHCP audit logging.
By default, if the amount of disk space remaining on the server disk reaches less than 20 megabytes, audit logging is halted.
The current audit log file is larger than one-seventh (1/7) of the maximum allotted space or size for the combined total of all audit logs currently stored on the server.
At the time of the disk check, the DHCP server compares the exact size (in megabytes) of the current audit log file with a value obtained by dividing the current value for the maximum number of log files the server permits to be stored simultaneously before overwriting and discarding of older log files. By default, seven is the maximum number of log files the server permits to be stored, one for each day of the week. Assuming that the default is set, the largest size that the current audit log file can reach is one megabyte.
In either case, if the disk is full, the DHCP server closes the current file and ignores further requests to log audit events until either 12:00 a.m. or until disk status is improved and the disk is no longer full.
Even if audit-logged events are ignored because of a disk-full condition, the DHCP server continues disk-checking every 50 events (or the currently set interval) to determine whether disk conditions have improved. If subsequent disk checks determine that the required amount of server disk space is available, the DHCP server reopens the current log file and resumes logging.