Tracking Windows print spooler event history

This article describes how to use Windows Event Viewer to track history related to print spooler events.

Basic review of a print job history

When print jobs have trouble reaching YSoft SafeQ (e.g. ORS, FSP) it is good to look at a print job state in the Windows print spooler. Among others the print spooler is responsible for the print job upload to the destination, in our case to YSoft SafeQ. The print spooler should be reviewed either on a workstation where the printer is installed, on a print server from where the printer is shared to workstations or on both.

To open Windows print spooler:

• use Windows+R to start Run dialogue

• type in: printmanagement.msc

• press OK

• find your printer > right-click it > Open Printer Queue

This can explain situations such as:

• A large job is being spooled for several minutes, other print jobs are waiting in a queue behind it waiting for the first job to be processed (typically when only one delivery Port exists, solution is often to increase amount of ports or create a separate printer for a user with high demands).

  

• A print job transfer fails (typically due to network connectivity issues or due to incorrect Port configuration, telnet or Test-NetConnection can be used for verification of connectivity to the destination address and port)

  

Detailed review of a print job history

Events related to print driver installation, connections to a shard printer and the history of print job delivery can be traced in Windows Event Viewer.

1. Open Event Viewer

   • use Windows+R to start Run dialogue

   • type in: eventvwr.msc

   • press OK

2. Enable logging of events related to print queue

   • Applications and Services Logs > Microsoft > Windows > PrintServices

   • Right-click Admin > Enable log

     

   • Right-click Operational > Enable log

     

Logging can be also enabled by Group Policy (GPO) or PowerShell. PowerShell example for Operational log:
$oplog = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration "Microsoft-Windows-PrintService/Operational" 
$oplog.IsEnabled = $true
$oplog.SaveChanges()

3. Review history of events related to the issue that was observed

   • Admin log
     It is useful to track high level events, such as driver installation and printer sharing.

   • Operational log
     It can be used to track the actual print attempt. This is an example where user "Administrator" printed a document from workstation CSS05932 through a printer shared from server css05943.

     

4. Export event history

   • If you wish to share the Event Viewer history with someone, right-click the required log (e.g. Operational) > Save All Events As > keep format evtx and save the file

5. Disable the logging when no longer needed

   • Right-click Admin log > Disable log

   • Right-click Operational log > Disable log