( subtype eq dhcp ) and ( severity eq critical )

( eventid eq if-clear ) and ( object eq 'ethernet1/1' ) and ( description contains 'DHCP client cleared IP address on interface:ethernet1/1 due to: All Request retries exhausted.' )

( subtype eq dhcp ) and ( severity eq medium )

( eventid eq server-no-free-ip ) and ( description contains 'DHCP server runs out of ip pool interface ethernet1/2' )

( eventid eq ip-already-in-use ) and ( description contains 'ip address is already in use ip 192.168.1.11 interface ethernet1/3' )

( subtype eq dhcp ) and ( severity eq informational )

( eventid eq lease-start ) and ( description contains 'DHCP lease started ip 192.168.1.2 --> mac 18:ff:ff:ff:ff:86 - hostname [Unavailable], interface ethernet1/8.19' )

( eventid eq lease-end ) and ( description contains 'DHCP lease ended ip 192.168.1.2 --> mac 00:ff:ff:ff:c0:14 - hostname android-6i8762ba, interface ethernet1/8.19' )

( eventid eq server-on ) and ( description contains 'DHCP server on. interface ethernet1/8.19' )

( eventid eq server-auto-probe-on ) and ( description contains 'DHCP server auto-probe finished, turn on DHCP server since no offer received. interface ethernet1/3.209' )

VM in Azure

( eventid eq if-update-ok ) and ( object eq 'ethernet1/1' ) and ( description contains 'DHCP client  assigned IP: 192.168.1.1 on interface: ethernet1/1 for lease time of: 49710 days 6h:28m:15s from server: 11.22.33.44. Subnet mask:255.255.255.0 DNS1:22.22.22.22 DNS Suffix:asdfasfasdfasdfasddfasdf.cx.internal.cloudapp.net ' )