Skip to main content
kjiye
Staff & Editor
Staff & Editor
August 6, 2025

Technical Tip: 'Edit system.dhcp.server 1' log occurs even though it has never been modified

  • August 6, 2025
  • 0 replies
  • 277 views
Description This article explains the phenomenon in which the 'Edit system.dhcp.server 1' log occurs even though there are no modifications to the DHCP server.
Scope FortiGate.
Solution

This occurs when the interface settings (allowaccess, etc.) are changed in the GUI.

The log remains as below:

 

edit_dhcp.jpg

 

date=2025-08-05 time=16:21:00 eventtime=1754385660358625200 tz="+0700" logid="0100044547" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI(1.1.1.1)" action="Edit" cfgtid=11993151 cfgpath="system.dhcp.server" cfgobj="1" cfgattr="ip-range:1[<Delete>start-ip[2.2.2.1]end-ip[2.2.2.10]]" msg="Edit system.dhcp.server 1"
date=2025-08-05 time=16:20:39 eventtime=1754385638553779380 tz="+0700" logid="0100044547" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI(1.1.1.1)" action="Edit" cfgtid=11993143 cfgpath="system.interface" cfgobj="Internal" 

 

The reason is that the GUI always reconfigures the DHCP server when interface settings are changed. If the interface has enabled the DHCP server and any attributes are changed in the interface, the message 'Edit system.dhcp.server 1' may appear. 

To find which object has been changed, the 'cfgattr' has to be checked from the log field. This will show the appropriate change made in that DHCP server enabled interface. 

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.