Is there any way to see the leases file on an FVS336Gv3 or to save the DHCP log somewhere?

Question

I am trying to use the DHCP logs in my&nbsp;FVS336Gv3, and it's frustrating because the entries keep getting deleted out every few minutes. If I come back every few minutes and display the log and copy the stuff out into a text file, over time I can get a reasonably complete log. But I have an actual job to do, and can't spend my day clicking on links in the web interface and copying and pasting little chunks of text. Is this stuff getting saved somewhere?
&nbsp;
To back up and say why I need this...&nbsp;When I look at the DHCP log&nbsp;I will see a line like
Jun 6 16:11:42 [FVS336GV3] local7.info [DHCPD]: DHCPACK on 10.10.10.10 to 6c:96:cf:b0:07:52 (BrittanysiPhone) via eth0.1
and what it will tell me is that the device on&nbsp;10.10.10.10&nbsp;with MAC&nbsp;6c:96:cf:b0:07:52 is&nbsp;Brittany's iPhone. But when I come back, sometimes as short a time as 5 or 10 minutes later, those lines have been wiped out and there might be some more recent traffic. What I am trying to find is some way -- any way -- to&nbsp;look at a MAC address and find out what&nbsp;name&nbsp;it had whenever it was in the DHCP log before it got deleted from the display that I can see by&nbsp;clicking the DHCP Log link. 
&nbsp;
Is there any place that this information is being saved, and can I get to it?

JohnC_V · Answer

Hi&nbsp;cathyf,

&nbsp;

Welcome to our community! :)

&nbsp;

Logs are saved in the flash memory of the firewall and it just refreshed from time to time. Once you reboot the firewall, all the logs will be lost. I suggest you to enable and schedule emailing of logs&nbsp;so that it will automatically be sent to your email and have a copy of it.

&nbsp;

Regards,

cathyf · Answer

Thanks -- that's helpful!
&nbsp;
I've got about a hundred of these routers at different sites. I've seen DHCP logs with entries going back as long as 3 days, but I have other sites where the DHCP log gets wiped out every minute or two. And it's not a matter of filling a buffer -- on some routers the log is a few hundred lines long, while on those where it's refreshing every minute there are never more that about 10 lines and often it's just empty. Is there a setting somewhere that I can lengthen the refresh cycle? Refreshing once per day would be great, a little longer even better.
&nbsp;
As for emailing the logs to me, what I need is any line which contains a MAC address followed by the hostname -- I am trying to identify devices attached to the network. Of this list:

Change of time by NTP
Login attempts
Secure Login attempts
Reboots
All Unicast Traffic
All Broadcast/Multicast Traffic
WAN Status
Resolved DNS Names
VPN

will any of those give me those two pieces of information related to each other?

JohnC_V · Answer

cathyf,

&nbsp;

If you wanted to identify the devices attached to your network, you may also try to check the "View the Attached Devices". It includes the MAC address and the hostname.

&nbsp;

Regards,

&nbsp;

cathyf · Answer

&nbsp;I'm actually starting with the "Known PCs and Devices" shown on the LAN Groups listing, and what I am trying to find&nbsp;are the names of the devices which show up as "Unknown" in the LAN Groups. I know that if I go to the DHCP log, and&nbsp;am lucky and catch it&nbsp;before the router erases it, I can often catch DHCP traffic where it will show the MAC address followed by a host name in parentheses. (I have not figured out&nbsp;the exact rules&nbsp;for when a device shows up as "Unknown" in the&nbsp;"Known PCs and Devices" listing even though DHCP knows the device name, but it happens a lot.)
&nbsp;
I'm looking for the host names that are in parentheses in the DHCP log when the&nbsp;"Known PCs and Devices" shows&nbsp;"Unknown". My problem is that the only place I know to find this info is behind the tedious manual web interface -- refreshing the DHCP log by clicking on buttons in the web page is a full-time job. If this information is in some other log or I can get it in some other way, that would be fabulous. If there is a way to get the contents of the DHCP log without continually pushing buttons on the user interface and then copy/pasting the lines into another file that would be fabulous. I don't need the full DHCP log -- I just need&nbsp;each name and the MAC address that goes with it.
&nbsp;
I have tracked down a manual for the CLI at&nbsp;https://www.downloads.netgear.com/files/GDC/FVS336GV2/FVS336Gv2_CLI_20Mar2014.pdf (it's technically for the&nbsp;FVS336Gv2 and not the&nbsp;FVS336Gv3, but I have some&nbsp;FVS336Gv2s in addition to the several dozen&nbsp;FVS336Gv3s, and the CLI seems to work exactly the same on both devices.) This&nbsp;manual says that there is a command&nbsp;show net lan dhcp logs&nbsp;but when I run that command on the command line of either&nbsp;FVS336Gv2&nbsp;or FVS336Gv3 it gives no output.&nbsp;
&nbsp;
FVS336Gv2&gt; show net lan dhcp logs
FVS336Gv2&gt;
&nbsp;
FVS336Gv3&gt; show net lan dhcp logs
FVS336Gv3&gt; 
 (Other documented commands like&nbsp;show net lan dhcp leased_clients list give output that I expect. For that one I get a list of IPs and MACs but there are no names at all in that list.)
&nbsp;
I am trying to build up a list of the host names that go along with the MAC addresses on my networks. The router clearly knows them, if even only briefly, but It seems that every trick I try to save this elusive hostname info is a dead end.&nbsp;

SamirD · Answer

I don't know exactly how much information you'll get from it, but I'd set up a syslog server and let the routers send debug information to the syslog server.&nbsp; This way, you'll have the contigious information you need. :)
&nbsp;

Forum Discussion

Is there any way to see the leases file on an FVS336Gv3 or to save the DHCP log somewhere?

6 Replies

Related Content

RS700 IPv4 Lease Not Renewing (still not fixed).

FVS336Gv3 SSLVPN

XR500 DHCP lease change

FVS336GV3 loses WAN connection

FVS336Gv2 vs FVS336Gv3

NETGEAR Academy

ProSupport for Business