The print tracking feature works by intercepting Information events that are written to the application event log when Log Spooler Information Events is enabled in the Print Server Properties of the monitored host. As such the following requirements exist:
| 1. | "Log Spooler Information Events" must be enabled. You can have the EventSentry agent automatically enable print tracking when the service starts by selecting "Enable information events in print spooler" from the Print Server Properties. |
| 2. | To enable "Print Tracking / Auditing" without EventSentry: |
Windows 2003 and earlier
Navigate to Start -> Settings and click or double-click the Printers (and Faxes) icon. Select "Server Properties" from the "File" menu. There, click on the "Advanced" tab and check the box next to "Log information spooler events". You might have to restart the "Print Spooler" service.
Windows Vista and later (incl. Windows 2008)
Open the "Event Viewer" and navigate to "Application and Services Logs -> Microsoft -> Windows -> PrintService -> Operational". Right-click "Enable Log" to start logging of print events. To disable logging again, right-click "Operational" and select "Disable Log".
| 3. | The application event log "Log Size" needs to be configured to "Overwrite events as needed", it also recommended to specify a size of at least 2048kb. The EventSentry agent will write an error message upon startup to the application event log if the event log is not correctly configured. |
You can change the "Log size" settings by opening up "Event Viewer" (from Administrative Tools) and right-clicking "Application Log". Select "Properties" from the menu and verify that the "Log size" is correctly set to "Overwrite events as needed". Also verify that the "Maximum log size" is sufficiently big.
