Forum Discussion
Print Job Auditing
I need to centralize print job monitoring across all workstations. For testing, I enabled the Print Service Operational log on a group of workstations. Then I configured data collection for Error, Warning, and Informational events from that Log Name under the "Agents configuration" blade in Sentinel. Those changes were all made ~24 hours ago. Since then, several test print jobs have been performed but I don't appear to be receiving any of those log entries. I also have the "Security Events via Legacy Agent" data connector configured and I am seeing security events for the last 24 hours for the same systems.
Any idea what I'm missing?
TIA
- CliveWatson
Microsoft
Are you getting entries in the local eventlog seen via Eventvwr since you enabled the collection, operations data is normally not on my default and high volume (see "note" in the link), if the file is full it wont be able to send anything?
https://social.technet.microsoft.com/wiki/contents/articles/13308.windows-server-2012-troubleshooting-printing.aspx#PrintService_Event_Log_ChannelCliveWatson - Yes, I am seeing a normal flow of events in the Operational Log, most critically event ID 307. Usually 4-6 events per print job. The logs are configured to flush old events as needed. Also, this is data coming mostly from workstations not print servers so the data flow should be relatively light.
