I ran into this problem a couple years ago. What did was move the dhcp logs and config to something like c:\dhcp the in the ossec config call out as you did each log file. There is something about being buried in system32 that ossec can work with well, on win2008.
- [ossec-list] MS DHCP Logs? Brian Sims
- [ossec-list] MS DHCP Logs? Derek Morris
- [ossec-list] Re: MS DHCP Logs? Brian Sims
- [ossec-list] Re: MS DHCP Logs? Chris H