• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 12009
  • Last Modified:

remnants of spool files not being removed

Hello, we have recently been experiencing a lot of problems with our NT4 print server. It seems that [sometimes] when printing from a client PC it leaves a .SPL file of 0 bytes in the spool\printers directory. This file is also marked as read-only and as the day passes, more and more of these appear. When there are quite a few it starts creating printing problems at the client end:

On 9x clients it shows an "unknown error writing to <sharedprintername> - restart windows and try again" in a flashing "printers folders" dialogue. At this point it marks the printer as "Work Offline" but I have found that you can usually force the job through by unticking "Work Offline". A new print job throws the error again and marks it offline..

On 2k clients it reports an error printing to the printer, Access Denied. [I haven't found a workaround for this at the client end.]

I can clear the problem up temporarily by deleting all these empty .SPL files on the server but it is not long before they appear again =/
I don't know what has changed - this machine has been a print server for at least 5 years without this problem [as far as I'm aware..]

A very rough guess is that the spooler tries to create a temporary spool filename that already exists but I really don't know what's going on here..

NB I want to assign 250points to this question but the "buy points" link isn't working.. Assuming I can get it going and the "buy points" is fixed I will award another 125points to the solution provider.. TIA
0
rowanous
Asked:
rowanous
1 Solution
 
bbaoIT ConsultantCommented:
just confirm that if all SPs have been applied to both server and client sides?
0
 
bbaoIT ConsultantCommented:
moreover, if any anti-virus software is running on the server, such as McAfee Anti-Virus?
0
 
bbaoIT ConsultantCommented:
btw, i am sure your system has been changed, else it should work fine now. ;-) so the changes might not be noticed by you utill now. are you sure you system is virus free? sorry for these individual short replies...
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 
rowanousAuthor Commented:
Thanks for the replies. I am not certain about the SPs [I thought I'd posted that but it seems I forgot..] - where can I check this on the server? I do not normally administer the servers so I'm a bit green... It tells me "version 4.00.1381" in the properties of My Computer.. Other versions of windows that I've used tell me the SP there as well, maybe it's different on NT? I'm certain it has at least SP4 and quite possibly SP6a.

To my knowledge there isn't any antivirus product running on the server. I think it used to have an old version of Dr Solomons on it but that has been disabled. We use eTrust Innoculate for virus protection but that is only running on clients, not servers.

I agree with what you say about "something must have changed" but nothing springs to mind..
0
 
bbaoIT ConsultantCommented:
it seems there is another process is running backgrroud and accessing your .spl files... let us check it in detail.
0
 
rowanousAuthor Commented:
OK I posted a bit too soon.. Winver shows me the version and it is NT4 SP 6a.
Also I've managed to buy some points now and upgrade the question rating.
0
 
bbaoIT ConsultantCommented:
FIY: understanding what files are there...

Leftover SPL, SHD, and TMP Files Remain in the Spool Directory After All Print Jobs Are Complete
http://support.microsoft.com/?id=kb;en-us;264662

i think we may try find who is also accessing those files, by using a small program, FileMon for Windows. you may find more information about it and download it at:
http://www.sysinternals.com/ntw2k/source/filemon.shtml

install, have a try and let us know the result, ok?
0
 
rowanousAuthor Commented:
OK I just caught it "red-handed".. I configured filemon to filter for just the winnt\system32\spool\printers directory. I left it running for a while and then went back. Whilst I was watching, I saw a print job submitted that caused the error. The actual print job was created by a Foxpro print job from a machine on our reception. Here are the results from filemon [sorry for wrapping..] As you will see the only process touching it is SPOOLSS.EXE:

10:46:52      SPOOLSS.EXE:88      OPEN      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS      Options: Open Sequential  Access: All      
10:46:52      SPOOLSS.EXE:88      READ       C:\WINNT\System32\spool\PRINTERS\00249.SPL      END OF FILE      Offset: 0 Length: 4096      
10:46:52      SPOOLSS.EXE:88      CLOSE      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS            
10:46:52      SPOOLSS.EXE:88      OPEN      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS      Options: Open  Access: Delete      
10:46:52      SPOOLSS.EXE:88      DELETE       C:\WINNT\System32\spool\PRINTERS\00249.SPL      CANNOT DELETE            
10:46:52      SPOOLSS.EXE:88      CLOSE      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS            

Now from my point of view [watching the directory in explorer] it appeared as if the .SPL file was actually created as read-only in the first instance. The .SHD file was created/deleted fine and the print job actually came out fine. I looked in the SHD file before it was removed and I did see it was one of these "Remote downlevel documents" - I've never quite got to the bottom of why sometimes it is one of those and sometimes it isn't.. Since the .SPL file contains the actual data to be spooled and it was read-only right from the moment of creation; I wonder how the printer received the data and printed it OK?

I'm now back to favouring a [mis]configuration problem somewhere.. Any ideas where I go from here? TIA..
0
 
bbaoIT ConsultantCommented:
it seems we got on a right and efficient approach... :) lets go on.
0
 
rowanousAuthor Commented:
Quick followup, I've just seen 5 more documents "go wrong" - they were all remote downlevel documents. I've also seen 5 documents clear up properly - none of them were remote downlevel documents.

I've seen remote downlevel documents and non-remote downlevel documents coming from the same user on the same PC [in the space of a few minutes.]
I've also seen in the print queue [on my own PC in fact] a print job get added with the name of the application. Then in the print queue I've watched the job be replaced with a Remote Downlevel Document.

Maybe I'm jumping to a conclusion a little too easily but it does look to me as if it's to do with these Remote Downlevel Documents.. What are they and how do they differ from "normal" print jobs?
0
 
bbaoIT ConsultantCommented:
FYI:
Print Jobs to Windows NT Servers Named "Remote Downlevel Doc."
http://support.microsoft.com/?id=kb;en-us;Q134779
0
 
rowanousAuthor Commented:
Thanks, I read that, it says "upgrade your print server to v3.51" - if I'm not mistaken this is version 4? How can I tell?

It doesn't seem to be happening from 2k clients, although once there are a lot of these files it certainly affects the 2k clients. We have a mixture of Win95, Win98SE, NT4 Workstation, Win2000Pro and WinXP Pro clients.

It is definately happening with at least some Win95 and Win98SE clients. It doesn't seem to happen on every print job.


I just printed this page from my [win95] machine. Watching the queue I first see a document name of "http://www.experts-exchange.com [etc.]" Then a couple of seconds later a Remote Downlevel Document apppears underneath, the printer whirs into life, then both jobs disappear together from the queue. A quick look at the server shows me another read-only .SPL file left behind.
I have tried spool format EMF and RAW as well as "print directly" on my machine - all produce the remote downlevel document and create the read-only file. I think "print directly" might not work as expected from a 9x machine over a network - it still creates a spool job but definately on a 2k machine a spool job isn't created on the server [probably the 2k machine itself is the server in this case.]

I'm struggling to find info on remote downlevel documents, I keep finding a load of webpages where people seem generally unhappy with it [eg "the dreaded..." etc.] or a load of samba documentation..
0
 
bbaoIT ConsultantCommented:
hehe, dont worry about that, they are just for your reference, to understand what about "remote downlevel document". :) yest, it is really a strange word. i just had a study on it, since too many relevant links, i list some official ones and the search results from newsgroup to you, again for your reference:

http://support.microsoft.com/?id=kb;en-us;Q104923
http://support.microsoft.com/?id=kb;en-us;Q162447
http://support.microsoft.com/?id=kb;en-us;Q312015

http://www.jsiinc.com/SUBC/tip1200/rh1242.htm

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=utf-8&q=%22remote+downlevel+document%22&sa=N&tab=wg

as you and MSKB articles said, it is a windows 9x relevant issue.

hope it helps,
bbao
0
 
rowanousAuthor Commented:
bbao,
I've sourced the problem.. It's a combination of the eTrust antivirus and win9x.. You mentioned antivirus in your first post and just before lunch I also read this
http://www.crk.umn.edu/people/services/CAREER/regalsreport/99-00/10-25-99/regal102599.html
right near the end of that page you will see something that says "PRINTING PROBLEMS"...

I have a suspicion it is the "protect network drives" option as per that link but I can't reconfigure anything, it is all locked off from the "network distribution/proflie manager" application and I don't have access to it [as per my original post, I'm not the administrator..]

So I uninstalled it from my machine and guess what, no more remote downlevel documents and no more 0byte spool files from my computer.

I'll leave a note for the administrator, I won't see him until after Christmas but probably it just needs this "protect network drives" unchecked or similar.

Thanks! Once again this site proves its worth.
0
 
bbaoIT ConsultantCommented:
you are welcome and thanks for your points! just noticed, this is the first time you ask EE for help, so i am glad to become your first helper. :-)

as i mentioned in the posts, there is such a unknown process running to access those printer files. commonly, it may be an antivirus program. those programs often act like its enemies, be hidden and do things pretty quietly. hehe.

ok, enjoy EE, hope we may help each other later.

0
 
Zebis_nzCommented:
Hi everyone,

rowanous well done! I have the EXACT same problem, and im hoping your suggestion will fix this.

We have "Protect network drives" locked 'on' with all computers in our domain (Servers and Clients).... Ive just now unticked it only on the clients - deleted the spool directory, and will wait and see how the 9X clients go. (There is a central administration program which I use - and probably your administrator - to adjust the settings on all machines.

In case you are curious we are running Etrust Antivirus 7.0 - We are also using the Exchange Option on our exchange server.
0
 
bbaoIT ConsultantCommented:
hope you may find a workable solution from these threads, and post your opinions at here. if you still have problems, just ask a new question at this TA, a lot of experts will help you in munites. enjoy EE :)
0
 
rowanousAuthor Commented:
I should really follow up and tell you that we seem to have solved about 99% of the problem; it is still happening very infrequently. I've yet to find out if this is limited to a couple of workstations or whatever but I think the next thing we will try is excluding the extensions ".SHD" and ".SPL" in the eTrust settings..

As I say; it is many, many times better but not quite 100% at the moment.. Glad if you found this useful..
0
 
bbaoIT ConsultantCommented:
rowanous, nice to hear it. so i think filemon is really a very good tool to catch something, right? :)
0
 
mhoukCommented:
I have the same issue, 98, 2000, and XP clients with 2000 network lpr shared printers (vary) mostly hp. etrust also - Did anyone find a fix?
0
 
bbaoIT ConsultantCommented:
mhouk, have you tried the ways mentioned above?
0
 
rowanousAuthor Commented:
Just another followup..

We did put "SHD" and "SPL" in the exclusion list and this seemed to fix the problem completely.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now