I am going to write a script of some sort to check event viewer in a windows server 2003 for all printjobs, and then write them to a comma delimited textfile like printername_floor_room.txt
I am wondering what the best way is to do this realtime, and keep checking the event viewer constantly. Any caveats I need to be aware of?
EDIT: Okay, so I will most likely go for PowerShell and use Get-EventLog and then edit the "table" data. Problems I'm having: if I were to save all this data to a text file, how do I get the data out of it? A comma-separated file I could work with, but this, I'm not really sure. And once that is sorted out, I'm still not sure how to keep the file updated more or less real-time. Can I make this service-like, without hogging up all resources? Run it every x seconds for example?
EDIT 2: So I tried adding the Event Filter and Consumer using WMI Tools (via the GUI, that is) on my local pc, trying to get it to properly log my printjobs. It looks like my event gets caught, though there's something wrong with my script that is linked to the event. I let it rest over the weekend and upon arriving back at the office, I notice a ton of events on the wbemess.log file, like these:
(Fri Apr 30 16:39:00 2010.112476500) : Polling query select * from Win32_PrintJob failed with error code 80041033. Will retry at next polling interval
(Mon May 03 09:25:23 2010.1380562) : NT Event Log Consumer: could not retrieve sid, 0x80041002
I'm also noticing spikes in cpu usage by wmiprvse.exe. Upon googling around a bit, I found one guy solving his problems by reinstalling WMI into the registry. I'm wondering if this is the only way to troubleshoot this. I really don't want this happening on our production print server when I implement this...