Use the Windows Event Viewer to track printing events

From time to time we get questions about how to read Windows Event Logs to understand what’s going on with a print system. Occasionally we might also ask customers to gather these logs to help us get a fuller understanding of what might be going wrong.

Admittedly, these logs are very granular and not easy for people to read. If you’re simply looking for a simple way to see and understand what people are printing, then you might be interested in PaperCut NG.

If you’re here for a reason and you know what you’re doing, then read on…

The Print Service Admin Log

The Print Service Admin Log shows events related to the management of print queues like Sharing printers and installing print drivers, so it can be useful when trying to understand when a printer did not install correctly. This log is enabled by default.

To download the Admin log…

1. On the affected Windows system (this could be either the client or server), open Event Viewer by pressing Windows key + R, then type eventvwr.msc and hit the enter key.

2. Expand Applications and Services, then Microsoft, Windows, and PrintService.

3. Right-click on the Admin log and click Save All Events As.

   

4. Choose the Event Files (*.evtx) format, and save the file

   

The Print Service Operational Log

The Print Service Operational log shows events related to printing documents. It is off by default, but below we explain how to enable this log and how to read it.

To download the Operational log…

1. On the affected Windows system (this could be either the client or server), open Event Viewer by pressing Windows key + R, then type eventvwr.msc and hit the enter key.

2. Expand Applications and Services, then Microsoft, Windows, and PrintService.

3. Right click on the Operational log and select Enable log to start logging print jobs.

   

4. Reproduce the issue you are trying to troubleshoot.

5. Return to this area and save the Operational logs by right-clicking on the Operational log and click Save All Events As.

6. Choose the Event Files (*.evtx) format, and save the file.

Tracking a typical print job…

Now that we know how to find the logs, what should a typical job look like in the Operational logs?

There will generally be 7–8 events for each job… In versions of PaperCut prior to v19.1, you would see two event 308 happen twice. Around that time we changed the way the job is paused for analysis so now there is only one event 308.

800,Print job diagnostics,Spooling job 42.
308,Printing a document,"Document 42, Print Document owned by TestUser was paused on PaperCut Global PostScript. This document will not print until the document owner resumes the print job. No user action is required."
309,Printing a document,"Document 42, Print Document owned by TestUser was resumed on PaperCut Global PostScript. No user action is required."
801,Print job diagnostics,Printing job 42.
842,Isolating printer drivers and other plug-ins,"The print job 42 was sent through the print processor winprint on printer PaperCut Global PostScript, driver PaperCut Global PostScript, in the isolation mode 1 (0 - loaded in the spooler, 1 - loaded in shared sandbox, 2 - loaded in isolated sandbox). Win32 error code returned by the print processor: 0x0."
805,Print job diagnostics,Rendering job 42.
307,Printing a document,"Document 42, Print Document owned by TestUser on \\PrintSRV01 was printed on PaperCut Global PostScript through port nul.  Size in bytes: 4597660. Pages printed: 1. No user action is required."

What other types of events are there?

Event 812 “The print spooler failed to delete the file….”

This event, found in the Operational log, pops up in totally normal print environments and sometimes causes admins concern. This refers to a scheduling file (SHD) that the Print Spooler uses to track the job and can happen with or without PaperCut. It is completely safe to ignore. You can read more on Microsoft’s Technet about PrintService EventID 812.

Event 310 “Print Document owned by user was deleted”

This event, found in the Operational log, occurs when the print job was cancelled by the user or by another application (other than PaperCut). Look at the “User” field on the event to see what user or account cancelled the job. When PaperCut cancels or deletes jobs, it calls a different method used by the Windows Print Spooler API that will not trigger this event.

Event 372 “Job rendering error”

This event, found in the Admin log, is usually associated with print jobs that fail to print or “disappear”.

We’ve seen a few different causes for this, for example, it can happen…

• When macOS computers print to Shared Windows queue which is configured to use Type-4 drivers.
• In a Find-Me Printing scenario when the source and destination print queues are configured for different data types, as described in our article Troubleshooting Disappearing jobs with Find-Me Printing.
• When a PaperCut Mobility Print queue on a user’s workstation is manually configured to use a Type-4 driver instead of the default PaperCut Global PostScript driver (not common). This generates a RAW-format print jobs, but the Type-4 print driver on the server may cancel this job if it expects an XPS-formatted print job. We’ve tried but can’t explain this any easier, so just stick to Type-3 drivers.

Event 512 “Initializing a print provider error”

This event, found in the Admin log, is usually associated to client systems with machine names greater than 15 characters when the print system fails to load inetpp.dll. The result is a print failure for any printer configured to submits jobs to a Windows “Internet Port”. For PaperCut, this means Mobility printers and the “PaperCut Printer” used for PaperCut Pocket and Hive.

Changing the client machine name to 15 characters will allow Windows to reliably load this binary.

Still have questions?

Let us know! We love chatting about what’s going on under the hood. Feel free to leave a comment below or visit our Support Portal for further assistance.