Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1016 Source: DHCP

Source
Level
Description
The DHCP service encountered the following error while backing up the database: <error description>.
Comments
 
In my case the old folder was corrupt. I deleted it and DHCP began working.
- Error: "An error occurred while accessing the DHCP database. Look at the DHCP server log for more information on this error" - I received this event along with Event 1014 from source DhchServer. I believe the problem was originally caused by the AV scanning the DHCP directory. However, turning off the AV scanning did not clear the errors. They still appeared every day and on the DHCP Server service restart. To clear the error, I stopped the DHCP Server service and then I renamed the DHCP.mdp file in %systemroot%\system32\dhcp and also the backup one at %systemroot%\system32\dhcp\backup\old\jet. After this was done, I restarted the service and allowed it to rebuild the DHCP database. When doing this, make sure you have conflict detection enabled on the DHCP server or you may see duplicate IP addresses being assigned.
According to Microsoft, this error occurs when you move the Dynamic Host Configuration Protocol (DHCP) database and its backup directories from the default location. See MSW2KDB for more details on this event.

As per Microsoft: "The DHCP service uses a JET database to store configuration and lease information. The service creates a backup copy of its database at a regular interval. Any program or service other than the DHCP service gaining access to the files in the DHCP directory may cause a sharing violation. As a result of the sharing violation, the DHCP service stops processing all client requests because it requires exclusive access to its database and log files". This applies to Win NT 4.0. See ME216793 and ME193819 for more details.

ME173396 gives information on how to restore a corrupted DHCP database file.

From a newsgroup post: "I also had this problem. In my situation, this event was followed by ESENT errors in the Application log. A corrupted directory in System32/Windows/dhcp/backup directory caused the problem. Most likely, the problem appeared because the AntiVirus scanned the dhcp.mdb file. Exclude the dhcp directory or dhcp.mdb file from real-time antivirus scans. Jetpack the dhcp.mdb file and unauthorize the DHCP server. Stop the dhcp services and start them over. It should rebuild the dhcp.mdb file and the backup directory. In my opinion, the key is to keep the AntiVirus from scanning the DHCP directory. My issue was resolved after following the steps described above".
Our Windows 2000 DHCP server had been running happily for over a year, then suddenly started recording 1014 and 1016 errors. The DHCP service appeared to be working ok; clients were leasing addresses without problems.
The 1014 errors were: The JET Database call returned the following error : -1032. Additional Debug Information: JetBackup.
The 1016 errors were: The DHCP service encountered the following error when backing up the database: An error occurred while accessing the DHCP database. Look at the DHCP server event log for more information on this error.
This occurred whenever the DHCP service attempted to back up the database. I confirmed that the AV software was excluding the “system32\dhcp” folder from its real-time scanning.
I could stop the DHCP service and manually compact the database but the error would recur the next time DHCP tried to automatically back itself up.
I used sysinternal’s "Handle" and "Filemon" tools to determine that the content indexing service was holding onto the folder “system32\dhcp\backup\jet\old”. Attempts to access this folder via Explorer or the command prompt resulted in a "file in use" type of error.
I restarted the indexing service. After that, I got a 524 jet error, which KB 266361 indicates is "Could not delete backup file".
I then disabled content indexing on that folder (I do not know why it was enabled in the first place). Since then the DHCP service stops and starts perfectly without any errors.
This error occurs when you move the Dynamic Host Configuration Protocol (DHCP) database and its backup directories from the default location. When the DHCP service is initially installed, its database is stored in the \System32\DHCP folder, and the backup folder is set to \System32\DHCP\Backup\Jet. The DHCP database tracks all attached database directories and files in the System.mdb file. If the database and backup directories are moved, the backup fails. It does so because it tries to back up the database from the old and new locations but cannot find the database file in the old location.

User Action: Copy the original Windows 2000 system.md_ file from the Windows 2000 compact disc to your hard drive. Then run the Systemroot\System32\Expand.exe program to expand System.md_ to System.mdb. Next, copy System.mdb to the new database location.


Error: "An error occurred while accessing the DHCP database. Look at the DHCP server log for more information on this error." - I stopped the DHCPServer service and restarted and it seemed to cure the problem.
Error: "An error occurred while accessing the DHCP database. Look at the DHCP server log for more information on this error." - From a newsgroup post: "I found that I am having a conflict with computer Associates InoculateIT version 4.53. Called CA they said that 4.53 does not have exclude folder feature. I need to upgrade to version 6.0. The problem is that InoculateIt is scanning the DHCP databases and that is not a good thing to have an antivirus product scan databases. We need to exclude the DHCP folders from virus scanning. So I stopped the InoculateIT services and the error disappeared."

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...