Re: Windows XP Printer log?

(Windows XP)
You can enable auditing for Print events and then look for the details in the Security log using
Event Viewer.
I don't think there is any way you can do this retrospectively if you didn't enable auditing before
the jobs were printed.
StuartR

and press Enter. The Event Viewer should open. On the left side, select the System
log and you should see Print events there. You may have to search the log to find
them. There will likely be more events than just those.

Enable or disable logging of printing events

13 out of 19 rated this helpful - Rate this topic

Updated: January 21, 2005

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1,
Windows Server 2003 with SP2

To enable or disable logging of printing events

1. Open Printers and Faxes.
2. On the File menu, click Server Properties, and then click the Advanced
tab.
3. To enable or disable writing spooler error events to the system log file, select
or clear the Log spooler error events check box.
4. To enable or disable writing spooler warning events to the system log file,
select or clear the Log spooler warning events check box.
5. To enable or disable writing spooler information events to the system log file,
select or clear the Log spooler information events check box.
6. Stop and restart the spooler service, or reboot the server.

Notes

To open Printers and Faxes, click Start, and then click Printers and Faxes.

By default, all printing events are written to the system log file. If you want to
reduce the amount of data that is logged, disable the logging of information
events. If you want to further reduce the amount, disable the warning events.
Disabling the logging of spooler error events is not recommended.

Print log in Windows XP

October 9th, 2011 in Windows
Skip to comments (0)

Monitoring print job is sometime very important. Organization (or may be individuals) may need
to monitor print job probably to reduce waste or misusage of print. There could be other reason
as well. In any case, it is helpful to know how to monitor your printer. One of the way which I
know works well in Windows XP (or probably older version as well).
To monitor print job, one could either use print notification event (which I am not sure how to
attach) or use the event viewer utility logs in Windows XP. Log from event viewer utility can be
supplied to your program which can parse it show it in whatever format you need.
However, Windows XP, by default, does not automatically enable the log of print job (like type
of document, timestamp, number of pages etc). To enable it,
1) please click on Start > Printers and Faxes.
2) In Printers and Faxes explorer, click on File > Server Properties.
3) In "Print Server Properties" configuration dialog, click on Advanced tab and make sure that
Log spooler information events checkbox is checked.

When enabled, print log can either be viewed using Event viewer utility (Control Panel >
Administrative Tools > Event Viewer > System) or execute command using eventquery. For
example,
cscript c:\WINDOWS\system32\eventquery.vbs /V /FO CSV /L System /FI "source eq print"
would give result as,

If you look carefully, you would notice that in Description field data, required details are
available. For example- Document serial number, document name, User name which executed
print, printer name, number of pages printed etc.
Further, You can also provide other option with eventquery to filter/format in output. (Obviously,
you can find other possible option using cscript c:\WINDOWS\system32\eventquery.vbs /? ).