Solved

remnants of spool files not being removed

Posted on 2003-12-09
22
11,832 Views
Last Modified: 2013-12-19
Hello, we have recently been experiencing a lot of problems with our NT4 print server. It seems that [sometimes] when printing from a client PC it leaves a .SPL file of 0 bytes in the spool\printers directory. This file is also marked as read-only and as the day passes, more and more of these appear. When there are quite a few it starts creating printing problems at the client end:

On 9x clients it shows an "unknown error writing to <sharedprintername> - restart windows and try again" in a flashing "printers folders" dialogue. At this point it marks the printer as "Work Offline" but I have found that you can usually force the job through by unticking "Work Offline". A new print job throws the error again and marks it offline..

On 2k clients it reports an error printing to the printer, Access Denied. [I haven't found a workaround for this at the client end.]

I can clear the problem up temporarily by deleting all these empty .SPL files on the server but it is not long before they appear again =/
I don't know what has changed - this machine has been a print server for at least 5 years without this problem [as far as I'm aware..]

A very rough guess is that the spooler tries to create a temporary spool filename that already exists but I really don't know what's going on here..

NB I want to assign 250points to this question but the "buy points" link isn't working.. Assuming I can get it going and the "buy points" is fixed I will award another 125points to the solution provider.. TIA
0
Comment
Question by:rowanous
22 Comments
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
just confirm that if all SPs have been applied to both server and client sides?
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
moreover, if any anti-virus software is running on the server, such as McAfee Anti-Virus?
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
btw, i am sure your system has been changed, else it should work fine now. ;-) so the changes might not be noticed by you utill now. are you sure you system is virus free? sorry for these individual short replies...
0
 

Author Comment

by:rowanous
Comment Utility
Thanks for the replies. I am not certain about the SPs [I thought I'd posted that but it seems I forgot..] - where can I check this on the server? I do not normally administer the servers so I'm a bit green... It tells me "version 4.00.1381" in the properties of My Computer.. Other versions of windows that I've used tell me the SP there as well, maybe it's different on NT? I'm certain it has at least SP4 and quite possibly SP6a.

To my knowledge there isn't any antivirus product running on the server. I think it used to have an old version of Dr Solomons on it but that has been disabled. We use eTrust Innoculate for virus protection but that is only running on clients, not servers.

I agree with what you say about "something must have changed" but nothing springs to mind..
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
it seems there is another process is running backgrroud and accessing your .spl files... let us check it in detail.
0
 

Author Comment

by:rowanous
Comment Utility
OK I posted a bit too soon.. Winver shows me the version and it is NT4 SP 6a.
Also I've managed to buy some points now and upgrade the question rating.
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
FIY: understanding what files are there...

Leftover SPL, SHD, and TMP Files Remain in the Spool Directory After All Print Jobs Are Complete
http://support.microsoft.com/?id=kb;en-us;264662

i think we may try find who is also accessing those files, by using a small program, FileMon for Windows. you may find more information about it and download it at:
http://www.sysinternals.com/ntw2k/source/filemon.shtml

install, have a try and let us know the result, ok?
0
 

Author Comment

by:rowanous
Comment Utility
OK I just caught it "red-handed".. I configured filemon to filter for just the winnt\system32\spool\printers directory. I left it running for a while and then went back. Whilst I was watching, I saw a print job submitted that caused the error. The actual print job was created by a Foxpro print job from a machine on our reception. Here are the results from filemon [sorry for wrapping..] As you will see the only process touching it is SPOOLSS.EXE:

10:46:52      SPOOLSS.EXE:88      OPEN      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS      Options: Open Sequential  Access: All      
10:46:52      SPOOLSS.EXE:88      READ       C:\WINNT\System32\spool\PRINTERS\00249.SPL      END OF FILE      Offset: 0 Length: 4096      
10:46:52      SPOOLSS.EXE:88      CLOSE      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS            
10:46:52      SPOOLSS.EXE:88      OPEN      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS      Options: Open  Access: Delete      
10:46:52      SPOOLSS.EXE:88      DELETE       C:\WINNT\System32\spool\PRINTERS\00249.SPL      CANNOT DELETE            
10:46:52      SPOOLSS.EXE:88      CLOSE      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS            

Now from my point of view [watching the directory in explorer] it appeared as if the .SPL file was actually created as read-only in the first instance. The .SHD file was created/deleted fine and the print job actually came out fine. I looked in the SHD file before it was removed and I did see it was one of these "Remote downlevel documents" - I've never quite got to the bottom of why sometimes it is one of those and sometimes it isn't.. Since the .SPL file contains the actual data to be spooled and it was read-only right from the moment of creation; I wonder how the printer received the data and printed it OK?

I'm now back to favouring a [mis]configuration problem somewhere.. Any ideas where I go from here? TIA..
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
it seems we got on a right and efficient approach... :) lets go on.
0
 

Author Comment

by:rowanous
Comment Utility
Quick followup, I've just seen 5 more documents "go wrong" - they were all remote downlevel documents. I've also seen 5 documents clear up properly - none of them were remote downlevel documents.

I've seen remote downlevel documents and non-remote downlevel documents coming from the same user on the same PC [in the space of a few minutes.]
I've also seen in the print queue [on my own PC in fact] a print job get added with the name of the application. Then in the print queue I've watched the job be replaced with a Remote Downlevel Document.

Maybe I'm jumping to a conclusion a little too easily but it does look to me as if it's to do with these Remote Downlevel Documents.. What are they and how do they differ from "normal" print jobs?
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
FYI:
Print Jobs to Windows NT Servers Named "Remote Downlevel Doc."
http://support.microsoft.com/?id=kb;en-us;Q134779
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 

Author Comment

by:rowanous
Comment Utility
Thanks, I read that, it says "upgrade your print server to v3.51" - if I'm not mistaken this is version 4? How can I tell?

It doesn't seem to be happening from 2k clients, although once there are a lot of these files it certainly affects the 2k clients. We have a mixture of Win95, Win98SE, NT4 Workstation, Win2000Pro and WinXP Pro clients.

It is definately happening with at least some Win95 and Win98SE clients. It doesn't seem to happen on every print job.


I just printed this page from my [win95] machine. Watching the queue I first see a document name of "http://www.experts-exchange.com [etc.]" Then a couple of seconds later a Remote Downlevel Document apppears underneath, the printer whirs into life, then both jobs disappear together from the queue. A quick look at the server shows me another read-only .SPL file left behind.
I have tried spool format EMF and RAW as well as "print directly" on my machine - all produce the remote downlevel document and create the read-only file. I think "print directly" might not work as expected from a 9x machine over a network - it still creates a spool job but definately on a 2k machine a spool job isn't created on the server [probably the 2k machine itself is the server in this case.]

I'm struggling to find info on remote downlevel documents, I keep finding a load of webpages where people seem generally unhappy with it [eg "the dreaded..." etc.] or a load of samba documentation..
0
 
LVL 37

Accepted Solution

by:
Bing CISM / CISSP earned 251 total points
Comment Utility
hehe, dont worry about that, they are just for your reference, to understand what about "remote downlevel document". :) yest, it is really a strange word. i just had a study on it, since too many relevant links, i list some official ones and the search results from newsgroup to you, again for your reference:

http://support.microsoft.com/?id=kb;en-us;Q104923
http://support.microsoft.com/?id=kb;en-us;Q162447
http://support.microsoft.com/?id=kb;en-us;Q312015

http://www.jsiinc.com/SUBC/tip1200/rh1242.htm

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=utf-8&q=%22remote+downlevel+document%22&sa=N&tab=wg

as you and MSKB articles said, it is a windows 9x relevant issue.

hope it helps,
bbao
0
 

Author Comment

by:rowanous
Comment Utility
bbao,
I've sourced the problem.. It's a combination of the eTrust antivirus and win9x.. You mentioned antivirus in your first post and just before lunch I also read this
http://www.crk.umn.edu/people/services/CAREER/regalsreport/99-00/10-25-99/regal102599.html
right near the end of that page you will see something that says "PRINTING PROBLEMS"...

I have a suspicion it is the "protect network drives" option as per that link but I can't reconfigure anything, it is all locked off from the "network distribution/proflie manager" application and I don't have access to it [as per my original post, I'm not the administrator..]

So I uninstalled it from my machine and guess what, no more remote downlevel documents and no more 0byte spool files from my computer.

I'll leave a note for the administrator, I won't see him until after Christmas but probably it just needs this "protect network drives" unchecked or similar.

Thanks! Once again this site proves its worth.
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
you are welcome and thanks for your points! just noticed, this is the first time you ask EE for help, so i am glad to become your first helper. :-)

as i mentioned in the posts, there is such a unknown process running to access those printer files. commonly, it may be an antivirus program. those programs often act like its enemies, be hidden and do things pretty quietly. hehe.

ok, enjoy EE, hope we may help each other later.

0
 
LVL 1

Expert Comment

by:Zebis_nz
Comment Utility
Hi everyone,

rowanous well done! I have the EXACT same problem, and im hoping your suggestion will fix this.

We have "Protect network drives" locked 'on' with all computers in our domain (Servers and Clients).... Ive just now unticked it only on the clients - deleted the spool directory, and will wait and see how the 9X clients go. (There is a central administration program which I use - and probably your administrator - to adjust the settings on all machines.

In case you are curious we are running Etrust Antivirus 7.0 - We are also using the Exchange Option on our exchange server.
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
hope you may find a workable solution from these threads, and post your opinions at here. if you still have problems, just ask a new question at this TA, a lot of experts will help you in munites. enjoy EE :)
0
 

Author Comment

by:rowanous
Comment Utility
I should really follow up and tell you that we seem to have solved about 99% of the problem; it is still happening very infrequently. I've yet to find out if this is limited to a couple of workstations or whatever but I think the next thing we will try is excluding the extensions ".SHD" and ".SPL" in the eTrust settings..

As I say; it is many, many times better but not quite 100% at the moment.. Glad if you found this useful..
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
rowanous, nice to hear it. so i think filemon is really a very good tool to catch something, right? :)
0
 

Expert Comment

by:mhouk
Comment Utility
I have the same issue, 98, 2000, and XP clients with 2000 network lpr shared printers (vary) mostly hp. etrust also - Did anyone find a fix?
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
mhouk, have you tried the ways mentioned above?
0
 

Author Comment

by:rowanous
Comment Utility
Just another followup..

We did put "SHD" and "SPL" in the exclusion list and this seemed to fix the problem completely.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

This is the first one of a series of articles I’ll be writing to address technical issues that are always referred to as network problems. The network boundaries have changed, therefore having an understanding of how each piece in the network  puzzl…
Resolve DNS query failed errors for Exchange
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now