Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an ISS server running Windows Server 2008 Standard 32-bit. All of a sudden it started spewing forth GBs worth of data into the spooler.xml in C:\Windows\System32\spool folder. We track it down to the print spooler that's just unloading a ton of error messages. We stop the print spooler and have a 15 GB spool.xml file that has the following error:

<?xml version="1.0"?>
<SpoolerErrorLog>
    <RegistryData>
        <PrintProvidor name="LanMan Print Services">
            <Name><![CDATA[win32spl.dll]]></Name>
            <DisplayName><![CDATA[LanMan Print Services]]></DisplayName>
            <Node name="PortNames">
            </Node>
            <Node name="Servers">
                <AddPrinterDrivers>0x1</AddPrinterDrivers>
            </Node>
        </PrintProvidor>
        <Driver name="Dell 3130cn Color Laser PCL6">
            <Configuration_File><![CDATA[dlxbmziu.dll]]></Configuration_File>
            <Data_File><![CDATA[dlxbmzp.ddd]]></Data_File>
            <Driver><![CDATA[dlxbmzim.dll]]></Driver>
            <Help_File><![CDATA[dlxbmz.chm]]></Help_File>
            <Monitor><![CDATA[]]></Monitor>
            <Datatype><![CDATA[RAW]]></Datatype>
            <Version>0x3</Version>
            <TempDir>0x0</TempDir>
            <Attributes>0x2</Attributes>
            <Manufacturer><![CDATA[Dell Inc.]]></Manufacturer>
            <OEM_URL><![CDATA[http://www.dell.com/printers/]]></OEM_URL>
            <HardwareID><![CDATA[wsdprint\dell3130cn_color_las86d0]]></HardwareID>
            <Provider><![CDATA[Dell Inc.]]></Provider>
            <Print_Processor><![CDATA[]]></Print_Processor>
            <VendorSetup><![CDATA[]]></VendorSetup>
            <InfPath><![CDATA[]]></InfPath>
            <PrinterDriverAttributes>0x0</PrinterDriverAttributes>
            <DriverDate><![CDATA[07/19/2009]]></DriverDate>
            <DriverVersion><![CDATA[2.1.5.0]]></DriverVersion>
            <MinInboxDriverVerDate><![CDATA[01/01/1601]]></MinInboxDriverVerDate>
            <MinInboxDriverVerVersion><![CDATA[0.0.0.0]]></MinInboxDriverVerVersion>
        </Driver>
        <Driver name="Dell 3130cn Color Laser PS">
            <Configuration_File><![CDATA[PS5UI.DLL]]></Configuration_File>
            <Data_File><![CDATA[DL3130CN.PPD]]></Data_File>
            <Driver><![CDATA[PSCRIPT5.DLL]]></Driver>
            <Help_File><![CDATA[PSCRIPT.HLP]]></Help_File>
            <Monitor><![CDATA[]]></Monitor>
            <Datatype><![CDATA[]]></Datatype>
            <Version>0x3</Version>
            <TempDir>0x0</TempDir>
            <Attributes>0x2</Attributes>
            <Manufacturer><![CDATA[Dell Inc.]]></Manufacturer>
            <OEM_URL><![CDATA[http://www.dell.com/printers/]]></OEM_URL>
            <HardwareID><![CDATA[lptenum\dell3130cn_color_las86d0]]></HardwareID>
            <Provider><![CDATA[Dell Inc.]]></Provider>
            <Print_Processor><![CDATA[]]></Print_Processor>
            <VendorSetup><![CDATA[]]></VendorSetup>
            <InfPath><![CDATA[]]></InfPath>
            <PrinterDriverAttributes>0x0</PrinterDriverAttributes>
            <DriverDate><![CDATA[05/28/2009]]></DriverDate>
            <DriverVersion><![CDATA[4.2.9.6]]></DriverVersion>
            <MinInboxDriverVerDate><![CDATA[01/01/1601]]></MinInboxDriverVerDate>

more and more and more (I am limited to character so I can't post the error vomit)..... then

Type="VT_UI4">1</Attribute>
                    <Attribute="RefCount" Type="VT_UI4">0</Attribute>
                    <Attribute="StartDocPortFlag" Type="VT_UI4">0</Attribute>
                    <Attribute="ServerEntry" Type="VT_BSTR">{D9D8354D-4B23-4B13-B11E-2536DB7635BF}</Attribute>
                    <Attribute="PrinterName" Type="VT_BSTR">{4D8B85BF-F164-4A57-B0BA-A370E1237F9D}</Attribute>
                    <Attribute="RemoteChangeId" Type="VT_UI4">0</Attribute>
                    <Attribute="PrinterMergedAttributes" Type="VT_UI4">20000</Attribute>
                    <Attribute="CSRAttributes" Type="VT_UI4">0</Attribute>
                    <Attribute="RemotePrinterCache" Type="VT_RECORD">0445FA68</Attribute>
                    <Attribute="SyncCacheIsValid" Type="VT_UI4">1</Attribute>
                    <Attribute="LocalPrinter" Type="VT_UNKNOWN">01E49C68</Attribute>
                    <Attribute="LastTouched" Type="VT_UI8">1ccb44e1a022bff</Attribute>
                    <Attribute="LastTouchedFlushed" Type="VT_UI8">1ccb44e1a022bff</Attribute>
                    <Attribute="NumberOfFailedSyncAttempts" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                </CacheEntry>
                <CacheEntry="\\Aksia01\HPLaserJet 4700 PCL 5" cRef="4" State="kNormal">
                    <Attribute="EntryType" Type="VT_UI4">2</Attribute>
                    <Attribute="DriverState" Type="VT_UI4">1</Attribute>
                    <Attribute="RefCount" Type="VT_UI4">0</Attribute>
                    <Attribute="StartDocPortFlag" Type="VT_UI4">0</Attribute>
                    <Attribute="ServerEntry" Type="VT_BSTR">{D9D8354D-4B23-4B13-B11E-2536DB7635BF}</Attribute>
                    <Attribute="PrinterName" Type="VT_BSTR">{221C2E34-56A1-4A5A-AFFC-E553CE77D860}</Attribute>
                    <Attribute="RemoteChangeId" Type="VT_UI4">0</Attribute>
                    <Attribute="PrinterMergedAttributes" Type="VT_UI4">20000</Attribute>
                    <Attribute="CSRAttributes" Type="VT_UI4">3</Attribute>
                    <Attribute="RemotePrinterCache" Type="VT_RECORD">0445F958</Attribute>
                    <Attribute="SyncCacheIsValid" Type="VT_UI4">1</Attribute>
                    <Attribute="NumberOfFailedSyncAttempts" Type="VT_UI4">0</Attribute>
                    <Attribute="LocalPrinter" Type="VT_UNKNOWN">01E05888</Attribute>
                    <Attribute="LastTouched" Type="VT_UI8">1ccb44e1a5f27dc</Attribute>
                    <Attribute="LastTouchedFlushed" Type="VT_UI8">1ccb44e1a5f27dc</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>

This last part is what is repeating for 15 GB.

Yeah. We've figured out the solution, what we can't figure out is how this was caused. There is no one in the server, no one printing or using the print spooler from this server. We have an in-house application being run on the ISS, but it doesn't print from the server.

Thoughts?

share|improve this question
5  
"I have an ISS server" - You have an International Space Station Server? Can I play with it? –  MDMarra Dec 7 '11 at 21:17
    
Did someone setup the Internet Printing protocol perhaps? –  Zoredache Dec 7 '11 at 21:27
    
@MArkM: You may certainly not play with it... its old and fragile. :P. I meant IIS. –  Mike Dec 8 '11 at 19:59
    
@Zoredache: I don't think so. Its no setup as a print server at all. And its only print driver install is no longer on the network. –  Mike Dec 8 '11 at 20:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.