Use the Windows Event Viewer to track printing events
From time to time we get questions about how to read Windows Event Logs to understand what’s going on with a print system. Occasionally we might also ask customers to gather these logs to help us get a fuller understanding of what might be going wrong.
Admittedly, these logs are very granular and not easy for people to read. If you’re simply looking for a simple way to see and understand what people are printing, then you might be interested in Print Logger or PaperCut NG.
If you’re here for a reason and you know what you’re doing, then read on…
The Print Service Admin Log
The Print Service Admin Log shows events related to management of print queues like Sharing printers and installing print drivers, so it can be useful when trying to understand when a printer did not install correctly. This log is enabled by default.
To download the Admin log…
- On the affected Windows system (this could be either the client or server), open Event Viewer by pressing Windows key + R, then type eventvwr.msc and hit the enter key.
- Expand Applications and Services, then Microsoft, Windows, and PrintService.
- Right-click on the Admin log and click Save All Events As.
- Choose the Event Files (*.evtx) format, and save the file
The Print Service Operational Log
The Print Service Operational log shows events related to printing documents. It is off by default, but below we explain how to enable this log and how to read it.
To download the Operational log…
- On the affected Windows system (this could be either the client or server), open Event Viewer by pressing Windows key + R, then type eventvwr.msc and hit the enter key.
- Expand Applications and Services, then Microsoft, Windows, and PrintService.
- Right click on the Operational log and select Enable log to start logging print jobs.
- Reproduce the issue you are trying to troubleshoot.
- Return to this area and save the Operational logs by right-clicking on the Operational log and click Save All Events As.
- Choose the Event Files (*.evtx) format, and save the file.
Note 💡 The default log size is a paltry 1024 KB, which means this log can fill up quickly on a busy print server and roll over. So if you need to gather logs from a production environment you may want to increase the log size by right-clicking on the Operational log, select Properties, and increase the Maximum log size (KB) setting to something larger that may suit your needs.
Tracking a typical print job…
Now that we know how to find the logs, what should a typical job look like in the Operational logs?
There will generally be 7–8 events for each job… In versions of PaperCut prior to 19.1, you would see two event 308 happen twice. Around that time we changed the way the job is paused for analysis so now there is only one event 308.
800,Print job diagnostics,Spooling job 42.
308,Printing a document,"Document 42, Print Document owned by TestUser was paused on PaperCut Global PostScript. This document will not print until the document owner resumes the print job. No user action is required."
309,Printing a document,"Document 42, Print Document owned by TestUser was resumed on PaperCut Global PostScript. No user action is required."
801,Print job diagnostics,Printing job 42.
842,Isolating printer drivers and other plug-ins,"The print job 42 was sent through the print processor winprint on printer PaperCut Global PostScript, driver PaperCut Global PostScript, in the isolation mode 1 (0 - loaded in the spooler, 1 - loaded in shared sandbox, 2 - loaded in isolated sandbox). Win32 error code returned by the print processor: 0x0."
805,Print job diagnostics,Rendering job 42.
307,Printing a document,"Document 42, Print Document owned by TestUser on \\PrintSRV01 was printed on PaperCut Global PostScript through port nul. Size in bytes: 4597660. Pages printed: 1. No user action is required."
What other types of events are there?
Event 812 “The print spooler failed to delete the file….”
This event, found in the Operational log, pops up in totally normal print environments and sometimes causes admins concern. This refers to a scheduling file (SHD) that the Print Spooler uses to track the job and can happen with or without PaperCut. It is completely safe to ignore. You can read more on Microsoft’s Technet about PrintService EventID 812.
Event 310 “Print Document owned by user was deleted”
This event, found in the Operational log, occurs when the print job was canceled by the user or by another application (other than PaperCut). Look at the “User” field on the event to see what user or account canceled the job. When PaperCut cancels or deletes jobs, it calls a different method used by the Windows Print Spooler API that will not trigger this event.
Event 372 “Job rendering error”
This event, found in the Admin log, is usually associated with print jobs that fail to print or “disappear”.
We’ve seen a few different causes for this, for example it can happen…
- When macOS computers print to Shared Windows queue which is configured to use Type-4 drivers.
- In a Find-Me Printing scenario when the source and destination print queues are configured for different datatypes, as described in our article Troubleshooting Disappearing jobs with Find-Me Printing.