The print spooler generates a set of 3 log entries (example below) about
every 0.25 seconds. These go to SpoolerETW.ETL in the Windows\System32\Spool
directory. This behaviour exists on one of three "identically" configured
systems, and is triggered by a user login (but not by the Admin login). The
printers set up on this system are a minimal subset of those available (in
order to try and work around this problem). As the log entries don't really
say what is causing the problem, can anyone point me in the right direction?

TIA, Dave

Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"
System
Provider Name="Microsoft-Windows-PrintSpooler"
Guid="{e4c60dfa-ecc5-4889-b406-e9ddd38463c8}" /
EventID121/EventID
Version0/Version
Level2/Level
Task2/Task
Opcode12/Opcode
Keywords0x4000000000000010/Keywords
TimeCreated SystemTime="2007-11-25T02:31:31.167513600Z" /
Correlation ActivityID="{00000000-0000-0000-0000-000000000000}" /
Execution ProcessID="1584" ThreadID="2268" ProcessorID="1" KernelTime="0"
UserTime="0" /
ChannelMicrosoft-Windows-PrintSpooler/Core-Debug/Channel
Computer /
/System
UserData
SpoolerGenericEvent
xmlns:auto-ns3='http://schemas.microsoft.com/win/2004/08/events'
xmlns='http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events'RoutineSplOpenPrinter/RoutineFiled:\vista_gdr\printscan\print\spooler \localspl\openprn.c/FileLine2018/LineErrorCode0x7B/ErrorCodeObjectNameUninitialized/ObjectName/SpoolerGenericEvent
/UserData
RenderingInfo Culture="en-US"
LevelError /Level
OpcodeOperation failed /Opcode
Keywords
KeywordLocal spooler events /Keyword
/Keywords
TaskOpening a printer handle /Task
MessageOpen Printer Checkpoint Failed /Message
ChannelMicrosoft-Windows-PrintSpooler/Core-Debug/Channel
ProviderMicrosoft-Windows-PrintSpooler /Provider
/RenderingInfo
/Event
Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"
System
Provider Name="Microsoft-Windows-PrintSpooler"
Guid="{e4c60dfa-ecc5-4889-b406-e9ddd38463c8}" /
EventID119/EventID
Version0/Version
Level2/Level
Task2/Task
Opcode12/Opcode
Keywords0x8000000000000010/Keywords
TimeCreated SystemTime="2007-11-25T02:31:31.167516200Z" /
Correlation ActivityID="{00000000-0000-0000-0000-000000000000}" /
Execution ProcessID="1584" ThreadID="2268" ProcessorID="1" KernelTime="0"
UserTime="0" /
ChannelMicrosoft-Windows-PrintSpooler/Core-Analytic/Channel
Computer /
/System
UserData
SpoolerGenericEvent
xmlns:auto-ns3='http://schemas.microsoft.com/win/2004/08/events'
xmlns='http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events'RoutineSplOpenPrinter/RoutineFiled:\vista_gdr\printscan\print\spooler \localspl\openprn.c/FileLine752/LineErrorCode0x7B/ErrorCodeObjectNameUninitialized/ObjectName/SpoolerGenericEvent
/UserData
RenderingInfo Culture="en-US"
LevelError /Level
OpcodeOperation failed /Opcode
Keywords
KeywordLocal spooler events /Keyword
/Keywords
TaskOpening a printer handle /Task
MessageOpen Printer Failed /Message
ChannelMicrosoft-Windows-PrintSpooler/Core-Analytic/Channel
ProviderMicrosoft-Windows-PrintSpooler /Provider
/RenderingInfo
/Event
Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"
System
Provider Name="Microsoft-Windows-PrintSpooler"
Guid="{e4c60dfa-ecc5-4889-b406-e9ddd38463c8}" /
EventID207/EventID
Version0/Version
Level2/Level
Task2/Task
Opcode12/Opcode
Keywords0x8000000000000020/Keywords
TimeCreated SystemTime="2007-11-25T02:31:31.167571100Z" /
Correlation ActivityID="{00000000-0000-0000-0000-000000000000}" /
Execution ProcessID="1584" ThreadID="2268" ProcessorID="1" KernelTime="0"
UserTime="0" /
ChannelMicrosoft-Windows-PrintSpooler/Core-Analytic/Channel
Computer /
/System
UserData
SpoolerGenericEvent
xmlns:auto-ns3='http://schemas.microsoft.com/win/2004/08/events'
xmlns='http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events'RoutineppOpenPrinterEx/RoutineFiled:\vistartm\printscan\print\spooler\ spoolss\csr\core\csropen.cxx/FileLine343/LineErrorCode0x8004BEBE/ErrorCodeObjectName-/ObjectName/SpoolerGenericEvent
/UserData
RenderingInfo Culture="en-US"
LevelError /Level
OpcodeOperation failed /Opcode
Keywords
KeywordRemote spooler events /Keyword
/Keywords
TaskOpening a printer handle /Task
MessageCSR Open Printer Failed /Message
ChannelMicrosoft-Windows-PrintSpooler/Core-Analytic/Channel
ProviderMicrosoft-Windows-PrintSpooler /Provider
/RenderingInfo
/Event

I have removed all the printer references from the system (deleted all
printers, printer drivers, and cleaned up the registry), so that the system
should be back to a clean state as far as printing is concerned.

The net effect of this is that the logging has now increased in frequency -
I guess that this is all the spooler has to do! I also noticed that the print
spooler logging is disabled in the registry, so it must be using some
"private" logging scheme that cannot be turned off.

The summary of the contents of SpoolerETW.ETL (below) produced by tracerpt
shows 1677 events being generated in 78 seconds.

Doesn't anyone know how to stop this? Please??

Files Processed:
SpoolerETW.etl
Total Buffers Processed 114
Total Events Processed 1678
Total Events Lost 0
Start Time Monday, 26 November, 2007
End Time Monday, 26 November, 2007
Elapsed Time 78 sec
+-------------------------------------------------------------------------------------------------------------------------+
|Event Count Event Name Task Opcode Version
Guid |
+-------------------------------------------------------------------------------------------------------------------------+
| 1 EventTrace 0 Header 2
{68fdd900-4a3e-11d1-84f4-0000f80464e3}|
| 1677 Microsoft-Windows-PrintSpooler 2 Operation
failed 0 {e4c60dfa-ecc5-4889-b406-e9ddd38463c8}|
+-------------------------------------------------------------------------------------------------------------------------+
+---------------------------------------------------------------------------------------------------------+
|Event Count Event Name Event ID Version Guid
|
+---------------------------------------------------------------------------------------------------------+
| 1 EventTrace 0 2
{68fdd900-4a3e-11d1-84f4-0000f80464e3}|
| 559 Microsoft-Windows-PrintSpooler 119 0
{e4c60dfa-ecc5-4889-b406-e9ddd38463c8}|
| 559 Microsoft-Windows-PrintSpooler 121 0
{e4c60dfa-ecc5-4889-b406-e9ddd38463c8}|
| 559 Microsoft-Windows-PrintSpooler 207 0
{e4c60dfa-ecc5-4889-b406-e9ddd38463c8}|
+---------------------------------------------------------------------------------------------------------+

the ETW logging is disabled by default. How did you enable it?

If you enabled in the event viewer you can disable it there as well.


Launch mmc, add Event Viewer

Applications and Services Logs
Microsoft
Print Spooler

right click on the log type and disable logging



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base he
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

"Dave Nuttall" wrote in message
...
I have removed all the printer references from the system (deleted all
printers, printer drivers, and cleaned up the registry), so that the
system
should be back to a clean state as far as printing is concerned.

The net effect of this is that the logging has now increased in
frequency -
I guess that this is all the spooler has to do! I also noticed that the
print
spooler logging is disabled in the registry, so it must be using some
"private" logging scheme that cannot be turned off.

The summary of the contents of SpoolerETW.ETL (below) produced by tracerpt
shows 1677 events being generated in 78 seconds.

Doesn't anyone know how to stop this? Please??

Files Processed:
SpoolerETW.etl
Total Buffers Processed 114
Total Events Processed 1678
Total Events Lost 0
Start Time Monday, 26 November, 2007
End Time Monday, 26 November, 2007
Elapsed Time 78 sec
+-------------------------------------------------------------------------------------------------------------------------+
|Event Count Event Name Task Opcode
Version
Guid |
+-------------------------------------------------------------------------------------------------------------------------+
| 1 EventTrace 0 Header 2
{68fdd900-4a3e-11d1-84f4-0000f80464e3}|
| 1677 Microsoft-Windows-PrintSpooler 2 Operation
failed 0 {e4c60dfa-ecc5-4889-b406-e9ddd38463c8}|
+-------------------------------------------------------------------------------------------------------------------------+
+---------------------------------------------------------------------------------------------------------+
|Event Count Event Name Event ID Version Guid
|
+---------------------------------------------------------------------------------------------------------+
| 1 EventTrace 0 2
{68fdd900-4a3e-11d1-84f4-0000f80464e3}|
| 559 Microsoft-Windows-PrintSpooler 119 0
{e4c60dfa-ecc5-4889-b406-e9ddd38463c8}|
| 559 Microsoft-Windows-PrintSpooler 121 0
{e4c60dfa-ecc5-4889-b406-e9ddd38463c8}|
| 559 Microsoft-Windows-PrintSpooler 207 0
{e4c60dfa-ecc5-4889-b406-e9ddd38463c8}|
+---------------------------------------------------------------------------------------------------------+

"Alan Morris [MSFT]" wrote:

the ETW logging is disabled by default. How did you enable it?

If you enabled in the event viewer you can disable it there as well.


Launch mmc, add Event Viewer

Applications and Services Logs
Microsoft
Print Spooler

right click on the log type and disable logging

There is not a "Print Spooler" entry, either under Microsoft or under
Microsoft-Windows. Perhaps in the absence of this entry logging gets turned
on?

There also seem to be other entries missing from the list - I'm not sure how
this happened. Is there an easy way to re-populate this?

There also seem to be other entries missing from the list - I'm not sure how
this happened. Is there an easy way to re-populate this?

Let me correct that statement. Comparing the system with the problem with
other systems, the list of logs under Microsoft-Windows is the same on all.

There are many extra logs listed in a script I downloaded to clear out all
logs -
http://mickrussom.blogspot.com/2007/...l-logs-at.html
- including four for Microsoft-Windows-PrintSpooler whcih are not present on
any system.

You will need to show Analytic and Debug logs. I had to hunt this down as
well.


Select Windows or Microsoft
right click
View


--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base he
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

"Dave Nuttall" wrote in message
...
There also seem to be other entries missing from the list - I'm not sure
how
this happened. Is there an easy way to re-populate this?

Let me correct that statement. Comparing the system with the problem with
other systems, the list of logs under Microsoft-Windows is the same on
all.

There are many extra logs listed in a script I downloaded to clear out all
logs -
http://mickrussom.blogspot.com/2007/...l-logs-at.html
- including four for Microsoft-Windows-PrintSpooler whcih are not present
on
any system.

"Alan Morris [MSFT]" wrote:

the ETW logging is disabled by default. How did you enable it?

Regardless of whether the logging is enabled or disabled, the print spooler
is encountering an error:

TaskOpening a printer handle /Task
MessageOpen Printer Checkpoint Failed /Message

As there are no printers defined on the system, which printer is it trying
to open? It would help if information about the "printer" were included in
the log, as this may give some clue as to where to go to fix the problem.

"Alan Morris [MSFT]" wrote:

You will need to show Analytic and Debug logs. I had to hunt this down as
well.

Found them, thanks!.

All four of the print spooler logs were, and still are, show as disabled in
the Event Viewer. They are also empty (not surprisingly!).

This does seem to be some kind of "extracurricular" logging that got turned
on somewhere else.

Are there other users on this machine that may have made a printer
connection to another machine?

Check for a registry key in this format with an old machine name.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Providers\Client Side Rendering Print
Provider\Servers\Servername\Printers

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base he
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

"Dave Nuttall" wrote in message
...
"Alan Morris [MSFT]" wrote:

the ETW logging is disabled by default. How did you enable it?

Regardless of whether the logging is enabled or disabled, the print
spooler
is encountering an error:

TaskOpening a printer handle /Task
MessageOpen Printer Checkpoint Failed /Message

As there are no printers defined on the system, which printer is it trying
to open? It would help if information about the "printer" were included in
the log, as this may give some clue as to where to go to fix the problem.

"Alan Morris [MSFT]" wrote:

Are there other users on this machine that may have made a printer
connection to another machine?

Check for a registry key in this format with an old machine name.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Providers\Client Side Rendering Print
Provider\Servers\Servername\Printers

As part of the clean up of printers (several days ago) I deleted the key
above from "Providers" on down, as "Providers" did not exist on a system that
had no printers defined.

Prior to deleting the keys, I did notice a printer server named "CSR|Merry".
The actual printer server on the network is called "Merry". I'm not sure
where the CSR variant came from, or whether the name is still lurking
somewhere outside of the registry.

I also just noticed that when the spooler service was started it produced a
new System32\Spool\spooler.xml file (below) that implies that there is still
information in the registry that I have not cleaned up. Is it "safe" to track
down and remove this information?

- SpoolerErrorLog
- RegistryData
- PrintProvidor name="Internet Print Provider"
- DisplayName
- ![CDATA[ HTTP Print Services ]]
/DisplayName
- Name
- ![CDATA[ inetpp.dll ]]
/Name
/PrintProvidor
- PrintProvidor name="LanMan Print Services"
- DisplayName
- ![CDATA[ LanMan Print Services ]]
/DisplayName
- Name
- ![CDATA[ win32spl.dll ]]
/Name
Node name="PortNames" /
- Node name="Servers"
AddPrinterDrivers0x0/AddPrinterDrivers
/Node
/PrintProvidor
- PrintProcessor name="Epson Inkjet"
- Driver
- ![CDATA[ EP0NPP01.DLL ]]
/Driver
/PrintProcessor
- PrintProcessor name="hpzpplhn"
- Driver
- ![CDATA[ hpzpplhn.dll ]]
/Driver
/PrintProcessor
- PrintProcessor name="OneNotePrint2007"
- Driver
- ![CDATA[ msonpppr.dll ]]
/Driver
/PrintProcessor
- PrintProcessor name="winprint"
- Driver
- ![CDATA[ localspl.dll ]]
/Driver
/PrintProcessor
- PortMonitor name="Epson Inbox Language Monitor"
- Driver
- ![CDATA[ EP0SLM00.DLL ]]
/Driver
/PortMonitor
- PortMonitor name="Local Port"
- Driver
- ![CDATA[ localspl.dll ]]
/Driver
/PortMonitor
- PortMonitor name="Send To Microsoft OneNote Monitor"
- Driver
- ![CDATA[ msonpmon.dll ]]
/Driver
/PortMonitor
- PortMonitor name="Standard TCP/IP Port"
- Driver
- ![CDATA[ tcpmon.dll ]]
/Driver
- Node name="Ports"
StatusUpdateInterval0xa/StatusUpdateInterval
StatusUpdateEnabled0x1/StatusUpdateEnabled
LprAckTimeout0xb4/LprAckTimeout
/Node
/PortMonitor
- PortMonitor name="USB Monitor"
- Driver
- ![CDATA[ usbmon.dll ]]
/Driver
/PortMonitor
- PortMonitor name="WSD Port"
- Driver
- ![CDATA[ WSDMon.dll ]]
/Driver
/PortMonitor
/RegistryData
EventLogData /
SpoolerObjects /
CSRCacheData /
/SpoolerErrorLog