When a shared printer connects to the server defined as a Windows printing server in Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012, or Windows Server 2016 for printing, the name resolution of Windows 7, Windows 8.1 64-bit edition, Windows 10 64-bit edition, Windows Server 2008, Windows Server 2012 or Windows Server 2016 must be set to use complete DNS name for domain name resolution. If it fails to use the complete DNS name for name resolution, the printing operation logs cannot be obtained.
When a shared printer connects to the server defined as Windows printing server in Windows 7, Windows 8.1 64-bit edition, Windows 10 64-bit edition, Windows Server 2008, Windows Server 2012, or Windows Server 2016 for printing, two identical logs will be recorded at one printing operation when the Render printing jobs on client computers is active in network printer properties defined in Windows 7, Windows 8.1 64-bit edition, Windows 10 64-bit edition, Windows Server 2008, Windows Server 2012, or Windows Server 2016. One of the two logs records the name of the PC that performs printing operation changes to the name of the printing server.
When Set printing monitoring mode is set to Monitoring the printing of local printer only, the printing operation log cannot be collected in the following conditions:
Pattern 1
When printing via the printer server without the client (CT) installed.
Pattern 2
When all the following conditions are satisfied:
When printing is performed via the printer server with the client (CT) installed
The printer server and the client (CT) are not in the same subnet
Pattern 3
When all the following conditions are satisfied:
When printing is performed via the printer server with the client (CT) installed
When multiple NICs are used by the client (CT)
The machine information sent from the printer to the client (CT) is not in the same network segment as the management server of the client (CT).
Pattern 4
When all the following conditions are satisfied:
When printing is performed via the printer server with the client (CT) installed
When both the machine information sent from the printer to the client (CT) and the client (CT) are IPv6 IP address.
If you select Monitor printing of local printer only for Set printing monitoring mode, select Yes for the printing operation log in the CT policy settings window to obtain the printing operation log. Even if a user policy exists, the printing operation log will not be browsed.
In order to collect printing operation log, Port 139 must be opened. When a personal firewall is used, confirm that the Port 139 is open during the installation of the client (CT). In addition, when installing or change the configuration of a personal firewall during the operation, confirm that port 139 is open at all times. When the client (CT) is being installed, port 139 will be opened automatically for Windows firewall:
To collect the printing operation log that records the printing through a network printer, the File and Printer Sharing for Microsoft Network check box must be selected in the network connection properties of the Control Panel. When the computer has multiple LAN cards, check all the LAN cards that perform printing via network.
Pay attention to the following when Monitor the printing of local printers only is selected during the installation of the client (CT).
It is necessary to log on to the OS first in the client (CT) that acts as the printer server. Without logon to the operating system, the printing requests from other clients (CTs) cannot be detected and thus the printing operation logs cannot be collected.
If the Log Viewer is used to view the printing operation logs, the name of the computer that performs printing will be displayed in the Domain Name column.
If a printer is heavy-loaded and the shutdown or logoff operation is executed on the client (CT) after the printing has finished, the following log may be collected sometimes.
The printed file name is Local Down Level Documents.
The total number of printed pages is Unknown or is inconsistent with the total number of actual printed pages.
If the client (CT) is powered-off or a blue screen occurs immediately after the printing has finished, logs cannot be collected.
When network printer is used for printing, sometimes the total number of printed pages is Unknown or is inconsistent with the actual number of printed pages in printing operation log.
If a printed file has many pages, the log may be collected as multiple printing operation logs sometimes. At this time, the file names will be the same, but the pages will be divided.
For example, when "File A 100 pages" log is collected, it may be divided into three logs for collection sometimes, which include "file A 4 pages", "file A 90 pages", and "file A 6 pages".
If a large number of files are printed in a short period (for example, multiple copies or files are printed), printing operation logs may not be collected by files, or the number of pages of the collected log may be incorrect sometimes.
The number of pages displayed in the Log Viewer may be less than the actual number of pages. This occurs because the printing operation log collects the information reported by the Printer Spool, when printing a file with many pages, the number of pages reported by Printer Spool may be less than the actual number of pages.
For some applications, the name of a printed file displayed in the Log Viewer may be blank.
This occurs because the printing operation log collects the information reported by the Printer Spool. But due to different applications, the printed file names are not reported to the Printer Spool sometimes.
For some applications, in the case of printing with multiple copies, only one printing operation log will be displayed in the Log Viewer.
This occurs because the printing operation log collects the information reported by the Printer Spool. But due to different applications, the Printer Spool may report the printing of multiple copies as the printing of a single copy sometimes.
If Monitor printing of all printers in this terminal (recommended) is selected during the installation of the client (CT), when printing is performed from the client (CT) via network printer, if the printer server does not use a server edition OS, the maximum connection limit may be reached. If the limit has been reached, printing cannot be performed from machines other than the client (CT). The limit varies with OS editions and is determined according to the number of sessions.
If the same printer is defined repeatedly during the registration of printer, two printing operation logs will be collected at one printing operation.
The two normal logs with same contents.
One normal log, and one log in which the printed file name is Remote Down Level Document and the number of pages is Unknown.
If Monitor the printing of local printers only is selected during the installation of the client (CT) on the printer server, the user name used by the client (CT) that performs printing via this printer server must be registered on the printer server in advance. Otherwise, the user name of the print log may be recorded as follows:
If the user name used by the client (CT) has general user authority only, the "User name" of log will sometimes be recorded as Guest.
When the print server requires logon as Administrator before printing, the "User name" of log will sometimes be recorded as "Administrator".
The operation of document writer (Microsoft Office Document Image Write and Adobe PDF) that does not print on paper will be recorded as print log.
A client (CT) can monitor up to 512 printers. If you have registered more than 512 printers, logs will not be obtained for printing operations at the excess printers.
Sometimes printing operations are performed while multiple users (domain user and local user) are logged on under the same user name to a client (CT). In this case, the domain portion of the printing operation log may show the domain name (computer name) of the user who has not performed printing.
