WINS and DHCP Preventive Maintenance

If you are or ever were a user (i.e., victim) of Windows NT 3.5x's Windows Internet Naming Service (WINS) and Dynamic Host Configuration Protocol (DHCP), you know that regular maintenance tasks such as periodic jetpacking of the database and checking of log files and event logs are crucial to keeping these important infrastructure services functioning. Even if your firm uses the best networking practices, NT 3.5x's WINS and DHCP quirks probably periodically cause you stress.

Life is much better for administrators of NT 4.0's WINS and DHCP. Proper network maintenance can keep DHCP and WINS running fairly smoothly in NT 4.0, and Service Pack 4 (SP4) provides tools that help in the administration of these services. Several tools and practices can help you proactively manage WINS and DHCP within an NT 4.0 enterprise.

Jet Files
WINS and DHCP rely on Microsoft's Jet database engine to store information about their services. WINS stores the records that clients register and the records it replicates from other WINS servers in a Jet database, which is usually in %systemroot%\system32\wins. WINS servers keep important configuration options that relate to their replication partners and their name registration behavior in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WINS Registry subkey.

DHCP uses a Jet database to keep track of which IP addresses the server has leased. DHCP relies heavily on the Registry for storage of scope definitions (the ranges of IP addresses DHCP can distribute) and reservations (the address assignments DHCP hard-codes using machines' media access control—MAC—addresses). DHCP stores its scope and configuration information in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\DHCP-Server Registry key. The DHCP database is in %systemroot%\system32\dhcp. WINS and DHCP servers hold several files that relate to each service's database.

Wins.mdb or dhcp.mdb. The wins.mdb file is the main database file that holds records for WINS. Dhcp.mdb is the main database file that holds DHCP records.

J*.log. Within the DHCP or WINS directory, you'll find at least two J*.log files, which are transaction files for the database. When you change a WINS or DHCP database, the software writes your change to the current log file. You can verify this fact by viewing the WINS or DHCP database directory. The directory's files with the most recent modification dates are the log files; the database files reflect the date and time when the WINS or DHCP service last terminated gracefully (i.e., via a shutdown or termination of the service).

When you first install these services, you'll probably see a J50.log file. J50.log is the current transaction log for the database. Each log holds a maximum of 1MB. When the current log fills, the DHCP or WINS service copies it to a backup log. The software usually calls these backup logs J50xxxxx.log, in which xxxxx is a sequential hexadecimal number. DHCP usually generates more frequent log file backups than WINS generates, because DHCP generates a new series of logs (and backups) every time it backs up the DHCP database. By default, DHCP backs up its database hourly.

J*.chk. You use J*.chk to checkpoint the log (i.e., to keep track of which J*.log transactions DHCP or WINS has written to the database). J*.chk is useful when the database needs to back out of a set of transactions during a recovery, because the file keeps track of which transactions the software has committed since it last wrote to the database.

Res1.log and res2.log. These files are placeholders; they reserve space for future logs in case the WINS or DHCP disk partition becomes full. Res1.log and res2.log are usually each 1MB. They guarantee that you have enough space to create log files for DHCP and WINS to properly operate.

Dhcpsrvlog.xxx. When you select the DHCP configuration option that enables logging, DHCP creates a file in the database directory that details each client request for a new (or renewed) address and the server's response to the request. On DHCP servers without SP4, the log is one file named dhcpsrvlog. SP4 writes a different log file for each day of the week using the filename extension to designate the file's logging day (e.g., dhcpsrvlog.fri). Dhcpsrvlog files are simple text files that you can view in Notepad.

Care of the Jet Databases
DHCP and WINS Jet databases can be sources of much grief for NT administrators. As DHCP and WINS databases grow, they become less efficient at servicing requests and more susceptible to corruption. If a database becomes corrupted, the WINS or DHCP server simply stops servicing requests. You can usually find evidence of database corruption within NT's system event log, which you use Event Viewer to view. When a crucial event log error suggests that your database is corrupted, your choices for recovery are limited and probably painful.

WINS is especially problematic, because it is very active in medium to large environments. During business hours, WINS servers are always working with the database. If the servers aren't registering or renewing client computers' name registrations, they're replying to name queries. And every time users log on to a machine that uses WINS, the system registers their username with that machine in WINS. (Look for records in the form username[03h] in your WINS database to see these username registrations.) In addition, large NT infrastructures might contain several WINS servers that replicate their databases to one another. As a result of all this activity, WINS databases are subject to fragmentation. As WINS writes and rewrites records to the database, wins.mdb often becomes fragmented and actually grows in size as a result of the fragmentation. Over time, the database can become quite large if you don't care for it properly.