diff --git a/doc/guide/hooks.xml b/doc/guide/hooks.xml
index 8cff24886f..198148cc82 100644
--- a/doc/guide/hooks.xml
+++ b/doc/guide/hooks.xml
@@ -462,8 +462,64 @@ hardware address: hwtype=1 08:00:2b:02:3f:4e, client-id: 17:34:e2:ff:09:92:54
connected via relay at address: 192.2.16.33, identified by circuit-id:
68:6f:77:64:79 and remote-id: 87:f6:79:77:ef
-
+
+
+ In addition to logging lease activity driven by DHCPv4 client traffic, it also
+ logs entries for the following lease management control channel commands:
+ lease4-add, lease4-update, and lease4-del. Each entry is a single string
+ with no embedded end-of-line markers and they will typically have the following
+ forms:
+
+
+ lease4-add:
+
+Administrator added a lease of address: *address* to a device with hardware address: *device-id*
+
+ Dependent on the arguments of the add command, it may also include the
+ client-id and duration.
+
+
+ Example:
+
+Administrator added a lease of address: 192.0.2.202 to a device with hardware address: 1a:1b:1c:1d:1e:1f for 1 days 0 hrs 0 mins 0 secs
+
+
+
+ lease4-update:
+
+Administrator updated information on the lease of address: *address* to a device with hardware address: *device-id*
+
+ Dependent on the arguments of the update command, it may also include the
+ client-id and lease duration.
+
+
+ Example:
+
+Administrator updated information on the lease of address: 192.0.2.202 to a device with hardware address: 1a:1b:1c:1d:1e:1f, client-id: 1234567890
+
+
+
+ lease4-del:
+ Deletes have two forms, one by address and one by identifier and identifier type:
+
+Administrator deleted the lease for address: *address*
+
+ or
+
+Administrator deleted a lease for a device identified by: *identifier-type* of *identifier*
+
+ Currently only a type of @b hw-address (hardware address) is supported.
+
+
+ Examples:
+
+Administrator deleted the lease for address: 192.0.2.202
+
+Administrator deleted a lease for a device identified by: hw-address of 1a:1b:1c:1d:1e:1f
+
+
+
DHCPv6 Log Entries
@@ -515,7 +571,60 @@ DUID: 17:34:e2:ff:09:92:54 and hardware address: hwtype=1 08:00:2b:02:3f:4e
link address: 3001::1, hop count: 1, identified by remote-id:
01:02:03:04:0a:0b:0c:0d:0e:0f and subscriber-id: 1a:2b:3c:4d:5e:6f
-
+
+
+ In addition to logging lease activity driven by DHCPv6 client traffic, it also
+ logs entries for the following lease management control channel commands:
+ lease6-add, lease6-update, and lease6-del. Each entry is a single string
+ with no embedded end-of-line markers and they will typically have the following
+ forms:
+
+
+ lease6-add:
+
+ Administrator added a lease of address: *address* to a device with DUID: *DUID*
+
+ Dependent on the arguments of the add command, it may also include the hardware address and duration.
+
+
+ Example:
+
+Administrator added a lease of address: 2001:db8::3 to a device with DUID: 1a:1b:1c:1d:1e:1f:20:21:22:23:24 for 1 days 0 hrs 0 mins 0 secs
+
+
+
+ lease6-update:
+
+Administrator updated information on the lease of address: *address* to a device with DUID: *DUID*
+
+ Dependent on the arguments of the update command, it may also include the hardware address and lease duration.
+
+
+ Example:
+
+Administrator updated information on the lease of address: 2001:db8::3 to a device with DUID: 1a:1b:1c:1d:1e:1f:20:21:22:23:24, hardware address: 1a:1b:1c:1d:1e:1f
+
+
+
+ lease6-del:
+ Deletes have two forms, one by address and one by identifier and identifier type:
+
+Administrator deleted the lease for address: *address*
+
+ or
+
+Administrator deleted a lease for a device identified by: *identifier-type* of *identifier*
+
+ Currently only a type of DUID is supported.
+
+
+Examples:
+
+Administrator deleted the lease for address: 2001:db8::3
+
+Administrator deleted a lease for a device identified by: duid of 1a:1b:1c:1d:1e:1f:20:21:22:23:24
+
+
Configuring the Forensic Log Hooks