Solved

Document attributes in windows print log

Posted on 2016-08-15
9
41 Views
Last Modified: 2016-08-26
The event log provides some information about print jobs, e.b. user, document etc. This can be read, e.g. with log parser. The question is how to get more details about a printed document, i.e. the documents attributes as e.g. color, b&w, duplex etc.
0
Comment
Question by:GeologyETH
  • 5
  • 4
9 Comments
 
LVL 4

Expert Comment

by:Niabingi
Comment Utility
look in the folder on the server or PC if not using a print server, C:\Windows\System32\spool\PRINTERS
copy the .spl file and open it with notepad, there you can see what tray is been called and whether duplex is on or not for that job.
0
 

Author Comment

by:GeologyETH
Comment Utility
Thanks for info. I've found a .spl on a PC, but not on the server. The printer are connected via TCP/IP port to the server and then shared. Any clue?
0
 
LVL 4

Expert Comment

by:Niabingi
Comment Utility
to capture that .spl file you will need pause the printer on the server and send the job then go to the folder and copy the file so you can examine it. when working correctly the file get delete once the job is printed so that is why you have to pause printing, then resume to make the job print.
0
 

Author Comment

by:GeologyETH
Comment Utility
that worked, thanks. But this information source is only very shortly available. The question is how to save such information about the print jobs permanently. Is there e.g. a possibility to enhance the information written into the log or another way to write it out into a file?
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 4

Accepted Solution

by:
Niabingi earned 500 total points
Comment Utility
you can create a batch file and add it to a task to run and copy the files you may have to set it to run every 1 min to copy all files.

robocopy "C:\Windows\System32\spool\PRINTERS"  "C:\new_location"

pause
exit
0
 

Author Comment

by:GeologyETH
Comment Utility
Thanks, I'll try it. But I think an at job running every minute might not catch all print related files, i.e. some prints can happen in between? Maybe, the script can be triggered by the print job?
But then I've the copied files. In the end I need only the details about the printed documents. The log parser is a convenient tool for analyzing the log. But, details about the printed documents are not stored there. Is there a possibility to customize the logs by such information?
0
 

Author Comment

by:GeologyETH
Comment Utility
I hooked the copy process on the event 805, but a copied .spl file no content. Ideas?
0
 

Author Comment

by:GeologyETH
Comment Utility
Works with hooking on id 801.
0
 
LVL 4

Expert Comment

by:Niabingi
Comment Utility
great!
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

We recently had an issue where out of nowhere, end users started indicating that their logins to our terminal server were just showing a "blank screen." After checking the usual suspects -- profiles, shell=explorer.exe in the registry, userinit.exe,…
To effectively work with Diskpart on a Server Core, it is necessary to write some small batch script's, because you can't execute diskpart in a remote powershell session. To get startet, place the Diskpart batch script's into a share on your loca…
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now