DHCP “Server Scope is Full” not alerting (Event ID 20287) in SAM Event Log Monitor

Overview of the configuration involved

• Template: Windows DHCP Server (or a derived/custom DHCP SAM template).

• Component: “Error: Server Scope is Full” (Windows Event Log Monitor).

• Intended behavior (per template documentation):

  • Monitor DHCP “scope full” events (classic Event ID 1063, and in this case 20287).

  • When a matching event occurs, the component status changes (Down/Critical/Warning) and alerts are raised.

In this scenario:

• • Log to Monitor is still set to System, so only the System event log is queried.

  • DHCP “scope full” events are written under DhcpAdminEvents, and are never evaluated.
    
    

    Symptoms

    • DHCP scope on DHCP‑01 becomes full (no IPs available for lease), but no corresponding “Server Scope is Full” alert is raised in SAM.

    • The Windows DHCP server shows repeated “scope full” errors in its event logs.

    • In SAM, the Windows Event Log Monitor component “Error: Server Scope is Full” remains Up, and any alert based on that component status never fires.

1. Wrong Windows log configured in the component

   • The SAM component is configured with Log to Monitor = System.

   • The DHCP scope‑full errors are written to the DHCP Admin log:

     • Display path: Microsoft-Windows-DHCP Server Events/Admin

     • Full log name: typically DhcpAdminEvents (visible in Event Viewer → log Properties).

2. Log not defined as a custom “deep” log via RPC

   • Applications and Services logs such as the DHCP Admin log are ETW/deep logs, not classic Application/System/Security logs.

   • These require the Windows Event Log Monitor to be configured with:

     • Log to Monitor = Custom

     • Custom Log to Monitor = DhcpAdminEvents (exact full name)

     • Fetching Method = RPC (Remote Procedure Call)

Because the monitor is pointed at the wrong log, it never sees Event ID 20287, so the test shows no matches, the component stays Up, and the alert never fires.

1. Confirm the correct log name on the DHCP server

   • On DHCP‑01, open Event Viewer.

   • Navigate to:
     Applications and Services Logs → Microsoft → Windows → DHCP‑Server → Microsoft‑Windows‑DHCP Server Events/Admin.

   • Open Properties on that log and note the Full Name (for example: DhcpAdminEvents).

2. Edit the SAM component

   • In the SolarWinds web console, go to:
     Settings → SAM Settings → Manage Templates.

   • Edit your Windows DHCP Server (or custom) template.

   • Open the component “Error: Server Scope is Full.”

3. Point the monitor to the DHCP Admin log via RPC

   • Set Log to Monitor = Custom.

   • Set Custom Log to Monitor = <Full Name from step 1> (for example, DhcpAdminEvents).

   • Set Fetching Method = RPC (Remote Procedure Call) for this component.

4. Verify event criteria

   • Event ID: 1063, 20287 (to cover both the standard scope‑full event and the observed 20287).

   • Event Type: Error.

   • Number of past polling intervals to search for events: at least 1 (more if you want a wider detection window).

5. Test from SAM

   • Use the Test button for this component against DHCP‑01.

   • Confirm that:

     • Matching Event ID 20287/1063 entries are now found.

     • The component status changes according to your “If a match is found” setting (Down / Critical / Based on Event Types).

6. Confirm alert wiring and visibility

   • In Alerts & Activity → Manage Alerts, ensure you have an alert like:

     • Object type: Component

     • Trigger: Component Status = Down or Component Status = Critical

     • **AND Component Name = "Error: Server Scope is Full"`

   • After the next scope‑full event:

     • Check Alerts & Activity → Alerts → All Active Alerts filtered to Node = DHCP‑01.

     • Check Alerts & Activity → Alert History for the time window of the error.

     • On the DHCP application’s Application Details page, confirm the component and its alert history reflect the event.