Udostępnij za pośrednictwem

Using Event viewer custom views for troubleshooting

  • Artykuł

Recently a customer came to us with a request. He was managing a print cluster and wanted a way to track information about print jobs, when are they spooled, rendered and completed. I did some testing and found that Windows already logs all that information, all he needed to do was to enable PrintService Admin logging and then create a custom view for it. Here are the steps we shared with him :

Information about job spooling time, rendering time, job print complete time is logged into event IDs  800, 805, 307 in the PrintService Operational logs. You will need to enable the logging for this to work :

  • To enable this logging, go to: Event Viewer > Applications and Service Logs > Microsoft > Windows > Print Service > Operational
  • Right click and choose "Enable log". If the logging is already enabled, then you may see "Disable Log" in place of "Enable Log".

To create a custom view in event viewer :

  • Save the following lines as a .xml file.

 

<ViewerConfig><QueryConfig>
<QueryParams>
<Simple>
 <BySource>True</BySource>
 <Channel>Microsoft-Windows-PrintService/Admin,Microsoft-Windows-PrintService/Debug,Microsoft-Windows-PrintService/Operational</Channel>
 <Source>Microsoft-Windows-PrintService</Source>
 <RelativeTimeInfo>0</RelativeTimeInfo>
 <EventId>307,805,800</EventId>
</Simple>
</QueryParams>

<QueryNode>
<Name>print</Name>
<QueryList>
 <Query Id="0" Path="Microsoft-Windows-PrintService/Admin">
  <Select Path="Microsoft-Windows-PrintService/Admin">*[System[Provider[@Name='Microsoft-Windows-PrintService'] and (EventID=307 or EventID=805 or EventID=800)]]</Select>
  <Select Path="Microsoft-Windows-PrintService/Debug">*[System[Provider[@Name='Microsoft-Windows-PrintService'] and (EventID=307 or EventID=805 or EventID=800)]]</Select>
  <Select Path="Microsoft-Windows-PrintService/Operational">*[System[Provider[@Name='Microsoft-Windows-PrintService'] and (EventID=307 or EventID=805 or EventID=800)]]</Select>
 </Query>
</QueryList>
</QueryNode>
</QueryConfig></ViewerConfig>

 

  • Open Event Viewer. Right click "Custom Views" and choose "Import Custom View".
  • Now point at the xml file you created and click ok.

 

You are all set. The events will be filtered the next time a print job is given. Hope this helps someone else!

 

Regards,

 

Vimal