Client side DHCP log

Solution 1:

OS X doesn't log this sort of information by default to one central file.

You will get a configd message in the /private/var/log/system.log that the network configuration has changed.

Jul 18 11:06:54 mac configd[15]: network configuration changed.

Also, the kernel will log several messages - including the base station MAC address in the case of Wi-Fi networks - that are easily viewed in the Console utility.

7/18/12 11:06:28.000 AM kernel: wlEvent: en1 en1 Link DOWN virtIf = 0
7/18/12 11:06:28.000 AM kernel: AirPort: Link Down on en1. Reason 8 (Disassociated because station leaving).
7/18/12 11:06:28.720 AM UserEventAgent: CaptiveNetworkSupport:CaptivePublishState:1211 en1 - PreProbe
7/18/12 11:06:28.778 AM configd: network configuration changed.
7/18/12 11:06:28.787 AM applepushserviced: <APSCourier: 0x108b322a0>: Stream error occurred for <APSTCPStream: 0x108b198e0>: The operation couldn’t be completed. Socket is not connected
7/18/12 11:06:53.000 AM kernel: MacAuthEvent en1   Auth result for: b8:8d:12:64:36:60  MAC AUTH succeeded
7/18/12 11:06:53.000 AM kernel: wlEvent: en1 en1 Link UP virtIf = 0
7/18/12 11:06:53.000 AM kernel: AirPort: Link Up on en1
7/18/12 11:06:53.000 AM kernel: en1: BSSID changed to cb:3e:44:64:63:60
7/18/12 11:06:53.000 AM kernel: AirPort: RSN handshake complete on en1
7/18/12 11:06:54.240 AM configd: network configuration changed.
7/18/12 11:06:54.612 AM UserEventAgent: CaptiveNetworkSupport:CaptivePublishState:1211 en1 - Probe
7/18/12 11:06:54.612 AM UserEventAgent: CaptiveNetworkSupport:CaptiveStartDetect:2343 Bypassing probe on gator because it is protected and not on the exception list
7/18/12 11:06:54.613 AM UserEventAgent: CaptiveNetworkSupport:CaptivePublishState:1211 en1 - Unknown
7/18/12 11:06:54.638 AM configd: network configuration changed.

It's not clear if the system logs a "network configuration changed" message upon expiration of a DHCP lease when the routing table doesn't change. You should be able to use the console to debug this if you have a DHCP server that you can force (or simply observe) a renewal or DHCP change when the network connection itself remains stable. The messages above were from a manual forcing off of Wi-Fi and then back on.

The current DHCP status is logged in clear text to /private/var/db/dhcpd_leases and the last lease for each network interface appears to be logged to /private/var/db/dhcpclient with a dated file beginning with enX.

It seems plausible you could use the tmutil compare function to detect a change to this file if just knowing the last successful lease time was not what you wanted.

mac:db mike$ tmutil compare /private/var/db/dhcpclient/leases ....