Those of you that use splunk to monitor the dhcdp server (linux) what files should you monitor? and what settings do you use in the dhcpd config files?
Generally, dhcpd logs are sent via syslog from the dhcpd server to Splunk.
The linux/unix conf file /etc/dhcpd.conf contains configuration settings for, among other items, logging wherein you can specify the facility that dhcpd logs to and then use the system syslog instance to control how those facilities are handled (socket, file, etc)