{"id":394,"date":"2019-07-09T12:26:31","date_gmt":"2019-07-09T12:26:31","guid":{"rendered":"http:\/\/eventlogxp.com\/blog\/?p=394"},"modified":"2019-07-09T12:26:32","modified_gmt":"2019-07-09T12:26:32","slug":"how-to-track-printer-usage-with-event-logs","status":"publish","type":"post","link":"https:\/\/eventlogxp.com\/blog\/how-to-track-printer-usage-with-event-logs\/","title":{"rendered":"How to track printer usage with event logs"},"content":{"rendered":"\n

At the time, the US companies spend a total of $120 billion on printed forms annually, and each employee uses about 10,000 sheets of paper according to CompTIA<\/a>. That’s why printer usage monitoring is very important to cut costs for printer supplies and their utilization. Another reason to know who and how uses corporate printers is to manage your resources and plan upgrades or downgrades of certain printers or print servers.<\/p>\n\n\n\n

If you google for “printer usage” or similar phrases, you will find dozens of special software to monitor printers. As a rule, these programs are installed on print servers and most of them are not cheap.<\/p>\n\n\n\n

However,\nyou can track printer usage without any third-party software by analyzing\nWindows events of Print Spooler. And use of Event Log Explorer makes this\nprocess much better.<\/p>\n\n\n\n

To start monitoring you should enable logging to log \\Microsoft-Windows-PrintService\/Operational<\/strong>:<\/p>\n\n\n\n

Start Event Log Explorer (or Event Viewer), connect to your print server from Event Log Explorer or Windows Event Viewer, browse to event log Microsoft-Windows\\\\Microsoft-Windows-PrintService\/Operational, click right mouse button on it and select Properties.<\/p>\n\n\n\n

In Log Properties dialog tick Enable Logging<\/strong>.<\/p>\n\n\n\n

\"enable-printer-log\"<\/a><\/figure>\n\n\n\n

Or just run wevutil<\/strong> utility in the elevated prompt as follows:<\/p>\n\n\n\n

wevtutil.exe\nsl Microsoft-Windows-PrintService\/Operational \/e:true  \/r:<Server_name><\/pre>\n\n\n\n
I assume that you have a print server (Server_name) in your network (running Windows 2008 or higher) and your users print documents via this server. If you have printers connected directly to the user computers, you should consider these computes as print servers and enable logging to PrintService\/Operational on them.<\/p>\n\n\n\n
If you want to monitor what exactly your user print, I recommend enabling “Allow job name in event logs” policy to log documents name. If you run Windows 2012 or Windows 8, you may need to apply a Windows update as described here<\/a>. <\/p>\n\n\n\n
Now when a user prints a document, several events will be logged into PrintService\/Operatinal event log. <\/p>\n\n\n\n
The most interesting event for printer usage tracking is event 307<\/strong> (document was printed). If you open event details of this event and switch to XML representation, you will get detailed information about printing.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Param1 is a print job identifier and can be used to link with other events in this log. 
Param2 is a document name (if you didn’t enable “Allow job name in event logs” policy, the document name will be “Print Document”. 
Param3 and Param4 define document owner and computer from which the document was sent to print.
Param5 is a printer name.
Param6 is a name of the print server port.
Param7 is a document size in bytes sent to print server.
Param8 is a total number of pages printed by this print job.<\/p>\n\n\n\n
So, let’s display some of these details in Event Log Explorer. I will add a printer user (a document owner), printer name, and number of pages as event list columns.<\/p>\n\n\n\n
First, we need\nto filter unnecessary events out and display only events with event id = 307.\nPress Filter<\/strong> button and type 307<\/em><\/strong> in Event ID(s) filed of\nthe Filter window.<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Now we should\nadd custom columns. Select View<\/strong>->Custom columns<\/strong> from the main\nmenu and add the first column (Printer user) as follows:<\/p>\n\n\n\n
Column\ntitle: Printer user<\/em><\/strong>
\nValue: {PARAM[3]}<\/em><\/strong><\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Switch to\nColumn 2 tab and add the second column:<\/p>\n\n\n\n
Column\ntitle: Printer<\/em><\/strong> 
\nValue: {PARAM[5]}<\/em><\/strong><\/p>\n\n\n\n
Switch to\nColumn 3 tab and add the second column:<\/p>\n\n\n\n
Column\ntitle: Pages<\/em><\/strong>
\nValue: {PARAM[8]}<\/em><\/strong><\/p>\n\n\n\n
Press OK to\nfinish and you will see 3 columns in the event list with your data.<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Now you can\nrun Analytical Report<\/strong> and select Custom Column1 stats.<\/strong>  This will summarize user print sessions and let\nyou detect users who print a lot. However, this summary doesn’t take into\naccount the number of pages, so I recommend using Excel for more accurate assessment.\n<\/p>\n\n\n\n
To export\nto Excel, select File -> Export Log<\/strong> from the main menu. Select Excel\n2007 document<\/strong> as a target format, make sure that All events<\/strong> is\nselected as export scope and tick fields Printer User, Printer and Pages. You\ncan untick other fields.<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Press Export\nbutton and save your data in XLSX document.<\/p>\n\n\n\n
That’s it.\nNow you can open your XLSX file in Excel and build summary reports from it.<\/p>\n\n\n\n
P.S. Some companies may still use old Windows 2003 server to run their print servers. And Event Log Explorer will help in this case too. Print events for Windows 2003 are recorded into System log. Event source is Print, event id = 10. To display Printer user, Printer and page count as custom columns use {PARAM[4]} \u00a0{PARAM[5]} and {PARAM[8]} respectively.<\/em><\/p>\n\n\n\n
Download Event Log Explorer and start exploring your events right now!<\/a><\/p>\n\"Facebook\"<\/a>\"twitter\"<\/a>\"reddit\"<\/a>\"pinterest\"<\/a>\"linkedin\"<\/a>\"mail\"<\/a>","protected":false},"excerpt":{"rendered":"
At the time, the US companies spend a total of $120 billion on printed forms annually, and each employee uses about 10,000 sheets of paper according to CompTIA. That’s why printer usage monitoring is very important to cut costs for printer supplies and their utilization. Another reason to know who and how uses corporate printers is to manage your resources and plan upgrades or downgrades\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":2,"featured_media":402,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[41,10],"tags":[5,19,21,69,70],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/394"}],"collection":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/comments?post=394"}],"version-history":[{"count":2,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/394\/revisions"}],"predecessor-version":[{"id":403,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/394\/revisions\/403"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media\/402"}],"wp:attachment":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media?parent=394"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/categories?post=394"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/tags?post=394"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}