Adding ISC Kea DHCP Server via Syslog

Updated October 20, 2026 16:00

Purpose

This guide explains how to send ISC Kea DHCPv4 server logs to Logsign USO. Kea (kea-dhcp4) is the DHCP server from ISC that replaces the older ISC DHCP server (dhcpd). Its log format is different from dhcpd, so Kea logs are not parsed by the Linux DHCP integration. Add Kea servers with the dedicated ISC / Kea DHCP integration described here.

Prerequisites

Root or sudo access to the Kea server and its configuration file (usually kea-dhcp4.conf).
Network connectivity from the Kea server (or from the rsyslog relay) to the Logsign USO collector on your syslog port (TCP or UDP 514 by default).
A Logsign USO release that includes the ISC Kea DHCP parser. Contact Logsign Support if you are not sure which release you run.

Step 1: Forward Kea Logs to Logsign USO

You can send Kea logs to Logsign USO in two ways. Use the one that fits your server. The Kea logger settings below follow the ISC Kea Administrator Reference Manual. Check the manual for your Kea release if the options differ.

Option A: Kea syslog output

Open kea-dhcp4.conf and find the loggers list inside the Dhcp4 object.
For the kea-dhcp4 logger, add an entry with "output": "syslog" (or "syslog:local0" to use a specific facility) under output_options. Set severity to INFO or lower so that lease events are written.
Restart Kea, for example with systemctl restart kea-dhcp4.
Configure the local syslog daemon (rsyslog or syslog-ng) to forward these messages to the IP address and port of the Logsign USO collector.

Example logger entry:

"loggers": [
  {
    "name": "kea-dhcp4",
    "output_options": [ { "output": "syslog" } ],
    "severity": "INFO"
  }
]

Option B: Kea log file read by rsyslog

If Kea already writes to a log file (for example /var/log/kea/kea-dhcp4.log), keep that file and let rsyslog read it with the imfile module. Then forward the messages to Logsign USO.

module(load="imfile")
input(type="imfile" File="/var/log/kea/kea-dhcp4.log" Tag="kea-dhcp4:" Severity="info" Facility="local0")
local0.* @@<Logsign-collector-IP>:514

Replace <Logsign-collector-IP> with the IP address of your collector. Use @@ for TCP or @ for UDP. Restart rsyslog after the change.

Step 2: Add the Data Source in Logsign USO

Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select ISC as the vendor and Kea DHCP as the product, and enter the IP address that the Kea logs arrive from as the host. Click Save.

If you added the Kea server earlier as a Linux DHCP source, change that source to ISC / Kea DHCP. A Kea server that stays on Linux DHCP shows its events as not parsed or with empty fields.

Supported Message Formats

Logsign USO parses Kea lines in these forms:

The native Kea log line, as Kea writes it to a file.
The same line behind an RFC 3164 (BSD) syslog header, as produced by Kea syslog output or by rsyslog imfile.
The same line behind an RFC 5424 syslog header.

Only lines with a Kea logger name in square brackets (for example [kea-dhcp4.leases/992]) are accepted. Examples:

2026-10-19 10:48:21.513 INFO  [kea-dhcp4.leases/992] DHCP4_LEASE_ALLOC [hwtype=1 aa:bb:cc:00:00:44], cid=[01:aa:bb:cc:00:00:44], tid=0x11aa22bb: lease 192.0.2.70 has been allocated for 259200 seconds
Oct 19 10:48:21 dhcp01 kea-dhcp4[992]: INFO  [kea-dhcp4.packets/992] DHCP4_PACKET_RECEIVED [hwtype=1 aa:bb:cc:00:00:44], cid=[01:aa:bb:cc:00:00:44], tid=0x11aa22bb: DHCPREQUEST (type 3) received from 192.0.2.3 to 198.51.100.27 on interface ens33

The RFC 3164 timestamp has no year and no time zone. When the line also carries the Kea timestamp, Logsign USO keeps the Kea timestamp as well.

Notes and Limits

This integration covers the DHCPv4 server (kea-dhcp4). DHCPv6 (kea-dhcp6) messages have no dedicated event classification.
Kea writes many packet and failure messages only at DEBUG level. If you need them, set the logger severity to DEBUG and a suitable debuglevel, and take the higher volume into account when you plan EPS.
If you use RFC 3164 without the Kea timestamp, set the server clock to the same time zone as Logsign USO so that Time.Generated is correct.
The Linux DHCP integration is for ISC DHCP (dhcpd) and is not changed. Use it only for dhcpd servers.

Verification

In Logsign USO, open Settings > Data Collection and confirm that the ISC Kea DHCP source is receiving data.
Renew a DHCP lease on a client. In Logsign USO, go to Search and look for events with Vendor ISC and Product Kea DHCP. A new lease appears with EventMap Network / DHCP / Lease and the client IP and MAC in Source.IP and Source.MAC.
If the source receives data but events are not parsed, check that the source is set to ISC / Kea DHCP and not Linux DHCP, and that a relay does not change the Kea line.