unless you enable debugs, you wont be able to capture any logs since "ip helper" doesnt generate any logs.
what best you could do is, disable "debug logging" for console and buffer and enable debug only for syslog. this way, all the ip helper related logs would be redirected to syslog server.
keep in mind, whenevet the switch needs to send logs to the syslog server, the CPU need to generate the packets, which will result in high CPU utilization. so, enable as less debug as possible so that you wont chock the switch CPU.
Here are the steps to collect the debug outputs.
1. Run a syslog server in the network.
2. Disable debug level for buffer, session and console logging. (check the current status using “show log”
Default behavior:
switch#sho log
Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
<<snip>>
Console logging: level debugging, 43 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 43 messages logged, xml disabled,
filtering disabled
<<snip>>
To be changed to:
Change the level to “Informational” for console, monitor and buffer logging.
6500-1(config)#logging buffered informational
6500-1(config)#logging console informational
6500-1(config)#logging monitor informational
6500-1(config)#logging trap debug <-- enable debug level only for syslog.
3. Enable syslog logging in the switch.
Router# configure terminal
Router(config)# service timestamps debug datetime localtime show-timezone
Router(config)# service timestamps log datetime localtime show-timezone
Router(config)#logging host <IP address or host name of syslog server.>
Enabling the required debugs for DHCP
6500-1#debug ip dhcp server ?
class Class-based address allocation
events Report address assignments, lease expirations, etc.
linkage Show database linkage
packet Decode message receptions and transmissions
redundancy DHCP server redundancy events
snmp DHCP server snmp events
how about enabling events alone?
