Solved

remnants of spool files not being removed

Posted on 2003-12-09
22
11,876 Views
Last Modified: 2013-12-19
Hello, we have recently been experiencing a lot of problems with our NT4 print server. It seems that [sometimes] when printing from a client PC it leaves a .SPL file of 0 bytes in the spool\printers directory. This file is also marked as read-only and as the day passes, more and more of these appear. When there are quite a few it starts creating printing problems at the client end:

On 9x clients it shows an "unknown error writing to <sharedprintername> - restart windows and try again" in a flashing "printers folders" dialogue. At this point it marks the printer as "Work Offline" but I have found that you can usually force the job through by unticking "Work Offline". A new print job throws the error again and marks it offline..

On 2k clients it reports an error printing to the printer, Access Denied. [I haven't found a workaround for this at the client end.]

I can clear the problem up temporarily by deleting all these empty .SPL files on the server but it is not long before they appear again =/
I don't know what has changed - this machine has been a print server for at least 5 years without this problem [as far as I'm aware..]

A very rough guess is that the spooler tries to create a temporary spool filename that already exists but I really don't know what's going on here..

NB I want to assign 250points to this question but the "buy points" link isn't working.. Assuming I can get it going and the "buy points" is fixed I will award another 125points to the solution provider.. TIA
0
Comment
Question by:rowanous
22 Comments
 
LVL 37

Expert Comment

by:bbao
ID: 9908442
just confirm that if all SPs have been applied to both server and client sides?
0
 
LVL 37

Expert Comment

by:bbao
ID: 9908464
moreover, if any anti-virus software is running on the server, such as McAfee Anti-Virus?
0
 
LVL 37

Expert Comment

by:bbao
ID: 9908490
btw, i am sure your system has been changed, else it should work fine now. ;-) so the changes might not be noticed by you utill now. are you sure you system is virus free? sorry for these individual short replies...
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 

Author Comment

by:rowanous
ID: 9910746
Thanks for the replies. I am not certain about the SPs [I thought I'd posted that but it seems I forgot..] - where can I check this on the server? I do not normally administer the servers so I'm a bit green... It tells me "version 4.00.1381" in the properties of My Computer.. Other versions of windows that I've used tell me the SP there as well, maybe it's different on NT? I'm certain it has at least SP4 and quite possibly SP6a.

To my knowledge there isn't any antivirus product running on the server. I think it used to have an old version of Dr Solomons on it but that has been disabled. We use eTrust Innoculate for virus protection but that is only running on clients, not servers.

I agree with what you say about "something must have changed" but nothing springs to mind..
0
 
LVL 37

Expert Comment

by:bbao
ID: 9910843
it seems there is another process is running backgrroud and accessing your .spl files... let us check it in detail.
0
 

Author Comment

by:rowanous
ID: 9910916
OK I posted a bit too soon.. Winver shows me the version and it is NT4 SP 6a.
Also I've managed to buy some points now and upgrade the question rating.
0
 
LVL 37

Expert Comment

by:bbao
ID: 9911033
FIY: understanding what files are there...

Leftover SPL, SHD, and TMP Files Remain in the Spool Directory After All Print Jobs Are Complete
http://support.microsoft.com/?id=kb;en-us;264662

i think we may try find who is also accessing those files, by using a small program, FileMon for Windows. you may find more information about it and download it at:
http://www.sysinternals.com/ntw2k/source/filemon.shtml

install, have a try and let us know the result, ok?
0
 

Author Comment

by:rowanous
ID: 9911287
OK I just caught it "red-handed".. I configured filemon to filter for just the winnt\system32\spool\printers directory. I left it running for a while and then went back. Whilst I was watching, I saw a print job submitted that caused the error. The actual print job was created by a Foxpro print job from a machine on our reception. Here are the results from filemon [sorry for wrapping..] As you will see the only process touching it is SPOOLSS.EXE:

10:46:52      SPOOLSS.EXE:88      OPEN      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS      Options: Open Sequential  Access: All      
10:46:52      SPOOLSS.EXE:88      READ       C:\WINNT\System32\spool\PRINTERS\00249.SPL      END OF FILE      Offset: 0 Length: 4096      
10:46:52      SPOOLSS.EXE:88      CLOSE      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS            
10:46:52      SPOOLSS.EXE:88      OPEN      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS      Options: Open  Access: Delete      
10:46:52      SPOOLSS.EXE:88      DELETE       C:\WINNT\System32\spool\PRINTERS\00249.SPL      CANNOT DELETE            
10:46:52      SPOOLSS.EXE:88      CLOSE      C:\WINNT\System32\spool\PRINTERS\00249.SPL      SUCCESS            

Now from my point of view [watching the directory in explorer] it appeared as if the .SPL file was actually created as read-only in the first instance. The .SHD file was created/deleted fine and the print job actually came out fine. I looked in the SHD file before it was removed and I did see it was one of these "Remote downlevel documents" - I've never quite got to the bottom of why sometimes it is one of those and sometimes it isn't.. Since the .SPL file contains the actual data to be spooled and it was read-only right from the moment of creation; I wonder how the printer received the data and printed it OK?

I'm now back to favouring a [mis]configuration problem somewhere.. Any ideas where I go from here? TIA..
0
 
LVL 37

Expert Comment

by:bbao
ID: 9911342
it seems we got on a right and efficient approach... :) lets go on.
0
 

Author Comment

by:rowanous
ID: 9911369
Quick followup, I've just seen 5 more documents "go wrong" - they were all remote downlevel documents. I've also seen 5 documents clear up properly - none of them were remote downlevel documents.

I've seen remote downlevel documents and non-remote downlevel documents coming from the same user on the same PC [in the space of a few minutes.]
I've also seen in the print queue [on my own PC in fact] a print job get added with the name of the application. Then in the print queue I've watched the job be replaced with a Remote Downlevel Document.

Maybe I'm jumping to a conclusion a little too easily but it does look to me as if it's to do with these Remote Downlevel Documents.. What are they and how do they differ from "normal" print jobs?
0
 
LVL 37

Expert Comment

by:bbao
ID: 9911638
FYI:
Print Jobs to Windows NT Servers Named "Remote Downlevel Doc."
http://support.microsoft.com/?id=kb;en-us;Q134779
0
 

Author Comment

by:rowanous
ID: 9911812
Thanks, I read that, it says "upgrade your print server to v3.51" - if I'm not mistaken this is version 4? How can I tell?

It doesn't seem to be happening from 2k clients, although once there are a lot of these files it certainly affects the 2k clients. We have a mixture of Win95, Win98SE, NT4 Workstation, Win2000Pro and WinXP Pro clients.

It is definately happening with at least some Win95 and Win98SE clients. It doesn't seem to happen on every print job.


I just printed this page from my [win95] machine. Watching the queue I first see a document name of "http://www.experts-exchange.com [etc.]" Then a couple of seconds later a Remote Downlevel Document apppears underneath, the printer whirs into life, then both jobs disappear together from the queue. A quick look at the server shows me another read-only .SPL file left behind.
I have tried spool format EMF and RAW as well as "print directly" on my machine - all produce the remote downlevel document and create the read-only file. I think "print directly" might not work as expected from a 9x machine over a network - it still creates a spool job but definately on a 2k machine a spool job isn't created on the server [probably the 2k machine itself is the server in this case.]

I'm struggling to find info on remote downlevel documents, I keep finding a load of webpages where people seem generally unhappy with it [eg "the dreaded..." etc.] or a load of samba documentation..
0
 
LVL 37

Accepted Solution

by:
bbao earned 251 total points
ID: 9911865
hehe, dont worry about that, they are just for your reference, to understand what about "remote downlevel document". :) yest, it is really a strange word. i just had a study on it, since too many relevant links, i list some official ones and the search results from newsgroup to you, again for your reference:

http://support.microsoft.com/?id=kb;en-us;Q104923
http://support.microsoft.com/?id=kb;en-us;Q162447
http://support.microsoft.com/?id=kb;en-us;Q312015

http://www.jsiinc.com/SUBC/tip1200/rh1242.htm

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=utf-8&q=%22remote+downlevel+document%22&sa=N&tab=wg

as you and MSKB articles said, it is a windows 9x relevant issue.

hope it helps,
bbao
0
 

Author Comment

by:rowanous
ID: 9912001
bbao,
I've sourced the problem.. It's a combination of the eTrust antivirus and win9x.. You mentioned antivirus in your first post and just before lunch I also read this
http://www.crk.umn.edu/people/services/CAREER/regalsreport/99-00/10-25-99/regal102599.html
right near the end of that page you will see something that says "PRINTING PROBLEMS"...

I have a suspicion it is the "protect network drives" option as per that link but I can't reconfigure anything, it is all locked off from the "network distribution/proflie manager" application and I don't have access to it [as per my original post, I'm not the administrator..]

So I uninstalled it from my machine and guess what, no more remote downlevel documents and no more 0byte spool files from my computer.

I'll leave a note for the administrator, I won't see him until after Christmas but probably it just needs this "protect network drives" unchecked or similar.

Thanks! Once again this site proves its worth.
0
 
LVL 37

Expert Comment

by:bbao
ID: 9912114
you are welcome and thanks for your points! just noticed, this is the first time you ask EE for help, so i am glad to become your first helper. :-)

as i mentioned in the posts, there is such a unknown process running to access those printer files. commonly, it may be an antivirus program. those programs often act like its enemies, be hidden and do things pretty quietly. hehe.

ok, enjoy EE, hope we may help each other later.

0
 
LVL 1

Expert Comment

by:Zebis_nz
ID: 10074742
Hi everyone,

rowanous well done! I have the EXACT same problem, and im hoping your suggestion will fix this.

We have "Protect network drives" locked 'on' with all computers in our domain (Servers and Clients).... Ive just now unticked it only on the clients - deleted the spool directory, and will wait and see how the 9X clients go. (There is a central administration program which I use - and probably your administrator - to adjust the settings on all machines.

In case you are curious we are running Etrust Antivirus 7.0 - We are also using the Exchange Option on our exchange server.
0
 
LVL 37

Expert Comment

by:bbao
ID: 10077726
hope you may find a workable solution from these threads, and post your opinions at here. if you still have problems, just ask a new question at this TA, a lot of experts will help you in munites. enjoy EE :)
0
 

Author Comment

by:rowanous
ID: 10078671
I should really follow up and tell you that we seem to have solved about 99% of the problem; it is still happening very infrequently. I've yet to find out if this is limited to a couple of workstations or whatever but I think the next thing we will try is excluding the extensions ".SHD" and ".SPL" in the eTrust settings..

As I say; it is many, many times better but not quite 100% at the moment.. Glad if you found this useful..
0
 
LVL 37

Expert Comment

by:bbao
ID: 10078706
rowanous, nice to hear it. so i think filemon is really a very good tool to catch something, right? :)
0
 

Expert Comment

by:mhouk
ID: 10625546
I have the same issue, 98, 2000, and XP clients with 2000 network lpr shared printers (vary) mostly hp. etrust also - Did anyone find a fix?
0
 
LVL 37

Expert Comment

by:bbao
ID: 10629013
mhouk, have you tried the ways mentioned above?
0
 

Author Comment

by:rowanous
ID: 10631337
Just another followup..

We did put "SHD" and "SPL" in the exclusion list and this seemed to fix the problem completely.
0

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article is in response to a question (http://www.experts-exchange.com/Networking/Network_Management/Network_Analysis/Q_28230497.html) here at Experts Exchange. The Original Poster (OP) requires a utility that will accept a list of IP addresses …
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question