Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a dhcp logfile available in osx (snow leopard or lion) where I can see when a new ip-address was received from the DHCP server?

share|improve this question
up vote 1 down vote accepted

OS X doesn't log this sort of information by default to one central file.

You will get a configd message in the /private/var/log/system.log that the network configuration has changed.

Jul 18 11:06:54 mac configd[15]: network configuration changed.

Also, the kernel will log several messages - including the base station MAC address in the case of Wi-Fi networks - that are easily viewed in the Console utility.

7/18/12 11:06:28.000 AM kernel: wlEvent: en1 en1 Link DOWN virtIf = 0
7/18/12 11:06:28.000 AM kernel: AirPort: Link Down on en1. Reason 8 (Disassociated because station leaving).
7/18/12 11:06:28.720 AM UserEventAgent: CaptiveNetworkSupport:CaptivePublishState:1211 en1 - PreProbe
7/18/12 11:06:28.778 AM configd: network configuration changed.
7/18/12 11:06:28.787 AM applepushserviced: <APSCourier: 0x108b322a0>: Stream error occurred for <APSTCPStream: 0x108b198e0>: The operation couldn’t be completed. Socket is not connected
7/18/12 11:06:53.000 AM kernel: MacAuthEvent en1   Auth result for: b8:8d:12:64:36:60  MAC AUTH succeeded
7/18/12 11:06:53.000 AM kernel: wlEvent: en1 en1 Link UP virtIf = 0
7/18/12 11:06:53.000 AM kernel: AirPort: Link Up on en1
7/18/12 11:06:53.000 AM kernel: en1: BSSID changed to cb:3e:44:64:63:60
7/18/12 11:06:53.000 AM kernel: AirPort: RSN handshake complete on en1
7/18/12 11:06:54.240 AM configd: network configuration changed.
7/18/12 11:06:54.612 AM UserEventAgent: CaptiveNetworkSupport:CaptivePublishState:1211 en1 - Probe
7/18/12 11:06:54.612 AM UserEventAgent: CaptiveNetworkSupport:CaptiveStartDetect:2343 Bypassing probe on gator because it is protected and not on the exception list
7/18/12 11:06:54.613 AM UserEventAgent: CaptiveNetworkSupport:CaptivePublishState:1211 en1 - Unknown
7/18/12 11:06:54.638 AM configd: network configuration changed.

It's not clear if the system logs a "network configuration changed" message upon expiration of a DHCP lease when the routing table doesn't change. You should be able to use the console to debug this if you have a DHCP server that you can force (or simply observe) a renewal or DHCP change when the network connection itself remains stable. The messages above were from a manual forcing off of Wi-Fi and then back on.

The current DHCP status is logged in clear text to /private/var/db/dhcpd_leases and the last lease for each network interface appears to be logged to /private/var/db/dhcpclient with a dated file beginning with enX.

It seems plausible you could use the tmutil compare function to detect a change to this file if just knowing the last successful lease time was not what you wanted.

mac:db mike$ tmutil compare /private/var/db/dhcpclient/leases ....
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.