Centralized collection and processing of Windows print logs

• www.papercut.com/products/free_software/print_logger
• www.printaudit.com/print-audit-6.asp

• The organization has an Active Directory domain.
• The organization uses computers with an operating system of at least Windows 7, a server with an operating system of at least Windows Server 2008R2
• There are both network and local printers and MFPs.
• There is a need to centrally handle print logs from printers and to have statistics on the use and load on printers.

Infrastructure preparation

1. User presence in the Event Log Readers group, on whose behalf the log will be read
2. Remote control access (Windows Remote Management from the collector server
3. Configured permission to forward events to the log collector server.
4. Print event log enabled (disabled by default)

1. In the section " Computer Configuration - Settings - Control Panel Settings - Services " create a service entry " Startup: Automatic (Delayed Start) ", " Service Name - Windows Remote Management Service (MS-Management) (WinRM)", " Service Action : Start services "
2. In the section " Computer Configuration - Policies - Administrative Templates - Windows Components - Windows Remote Management - Windows Remote Management Service " set the " Allow automatic configuration of listeners : Enable" option and set the "IPv4 Filter" section to the value "*".
3. In the section “ Computer Configuration - Policies - Windows Configuration - Security Settings - Windows Firewall with Advanced Security - Windows Firewall with Advanced Security - Inbound Rules ” create a new rule. Select the item “ Predefined rules ” and in the list select “ Windows Remote Control (HTTP - incoming traffic) ”
4. In the “ Computer Configuration - Policies - Administrative Templates - Windows Components - Event Forwarding ” section, set the “ Configure Subscription Manager ” option and in the “ SubscriptionManagers ” section enter the full FQDN path to the server – collector.
5. In the section " Computer Configuration - Policies - Windows Configuration - Security Settings - Restricted Access Groups " we add a new group " Event Log Readers ". We add the EventCollectorUser user created by us to the group members.

1. Prepare a text file with a list of computer names. For example, d: \ temp \ computers.txt
2. Run the following command as a user with domain administrator rights:
   For / F% i in (d: \ temp \ computers.txt) do wevtutil sl Microsoft-Windows-PrintService / Operational / e: true / r:% i

Creating an event subscription

1. Go to the " Event Viewer - Subscriptions " snap-in.
2. Choose on the right in the menu " Create a subscription ... "
3. Enter the subscription name, for example, “Test Subscription”. Add a clear description.
4. Next, select the log, which will receive received events. I recommend leaving everything by default - “Forwarded Events”. It is worth noting that I did not manage to find a way to place events in a manually created log. So the default option is almost the only one.
5. Next, click on the button " Select computers ... ". In the window that opens, click the "Add" button to add the necessary source computers. Using the “Check” button you can check the availability of the target machines using the remote control protocol, the result will be shown in the information window.
6. We select events which we will collect from sources. We are interested in the level of events “Information” from the “ Microsoft-Windows-PrintService / Works ” log with event code 307. All other settings are left as default.
7. We click on the "Advanced" button, in the window that opens, select the "specific user" item and specify the user we created and his password. The settings for optimizing the delivery of events are left in the “Normal” position.
8. Click "OK" and the subscription is created. When events appear in the log of source computers, they will be uploaded to the collector server in the “Forwarded Events” log for 15 minutes.

Script for processing collected events

1. Get a list of events from the log
2. Parsing the Message property of each event and writing fields to the PrintJob object.
3. Save the resulting list of objects in CSV format

Function GetPrintEntriesFromLog() { $PrintEntries = get-winevent -FilterHashTable @{LogName='ForwardedEvents'; ID=307;} return $PrintEntries } 

 Function CreatePrintJob() { $PrintJob = New-Object PsObject Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name PageCount -Value $null Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name UserName -Value $null Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name DocumentName -Value $null Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name Size -Value $null Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name Printer -Value $null Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name Time -Value $null return $PrintJob } 

 #   Function ParsePrintEntry($PrintEntry) { $NewPrintJob = CreatePrintJob $NewPrintJob.PageCount = GetPageCount $PrintEntry.Message $NewPrintJob.UserName = GetUserName $PrintEntry.Message $NewPrintJob.DocumentName = GetDocumentName $PrintEntry.Message $NewPrintJob.Size = GetPrintSize $PrintEntry.Message $NewPrintJob.Printer = GetPrinterName $PrintEntry.Message $NewPrintJob.Time = $PrintEntry.TimeCreated.ToString() return $NewPrintJob } #   Function GetUserName($PrintEntry) { If ($PrintEntry -eq "" -or $PrintEntry -eq $null) { return $null } $rxUserName = [regex]"  ([0-9a-zA-Z.]{1,})" $rxMatches = $rxUserName.Match($PrintEntry) return $rxMatches.Groups[1].Value } #   Function GetPrinterName($PrintEntry) { If ($PrintEntry -eq "" -or $PrintEntry -eq $null) { return $null } $rxPrinterName = [regex]"  (.{1,}) " $rxMatches = $rxPrinterName.Match($PrintEntry) return $rxMatches.Groups[1].Value } #     Function GetPrintSize($PrintEntry) { If ($PrintEntry -eq "" -or $PrintEntry -eq $null) { return $null } $rxPrintSize = [regex]"  : ([0-9]+)." $rxMatches = $rxPrintSize.Match($PrintEntry) return $rxMatches.Groups[1].Value } #   (  ) Function GetPageCount($PrintEntry) { If ($PrintEntry -eq "" -or $PrintEntry -eq $null) { return $null } $rxPageCount = [regex]" : ([0-9]+)" $rxMatches = $rxPageCount.Match($PrintEntry) return $rxMatches.Groups[1].Value } #   Function GetDocumentName($PrintEntry) { If ($PrintEntry -eq "" -or $PrintEntry -eq $null) { return $null } $rxDocumentName = [regex]", (.{1,})  " $rxMatches = $rxDocumentName.Match($PrintEntry) return $rxMatches.Groups[1].Value } 

 Function Main() { $PrintEntries = GetPrintEntriesFromLog $Global:ParsedEntries = @{}; $i = 0 ForEach ($PrintEntry in $PrintEntries) { $ParsedEntries.Add($i, $(ParsePrintEntry $PrintEntry)) $i++ if ($i % 100 -eq 0) { Write-Host "Processed $i records" } } $ParsedEntries.Values | Export-Csv "D:\PrintReports\PrintUsageReport.csv" -NoTypeInformation -Encoding UTF8 -Delimiter ';' } #  . Main 

1. Open Task Scheduler ( Start - Administration - Task Scheduler )
2. Select " Create a simple task ... "
3. Enter task name, description, select execution interval
4. Select the action " run the program ." As a program, select “C: \ Windows \ System32 \ WindowsPowerShell \ v1.0 \ powershell.exe”, and the path to the script as an argument.
5. Open the task properties and set the “Execute regardless of user registration” switch, select the user on whose behalf the task should be executed and enter the password for it.

Problem solving

1. If an error of the following type occurs when starting the script:
   

   The file D: \ PrintReports \ PrintInfo.ps1 could not be loaded because script execution is disabled on this system. For more
   For information, see about_Execution_Policies at go.microsoft.com/fwlink/?LinkID=135170 .
   + CategoryInfo: Security Error: (:) [], ParentContainsErrorRecordException
   + FullyQualifiedErrorId: UnauthorizedAccess
   

   This means that the security policy for executable Powershell scripts does not allow starting the program. To run the created script, you need to lower the security level to “ Remote Signed ”, that is, you will be allowed to run any scripts created locally, and scripts created on remote systems are executed only if signed by a trusted publisher. To do this, in the Powershell console running as an administrator, you must run the Set-ExecutionPolicy RemoteSigned command.
2. You can use the eventcreate.exe command line tool to test the forwarding and collection of events. This utility allows you to create events manually in a specific log. For example, you can create an event with ID 100 in the Application log using the following command: eventcreate / t error / id 100 / l application / d "Custom event" . If everything is configured correctly and there is a collection of events from the specified log, the event will be on the server collector within a minute.
   If the event does not hit the collector server, you need to check the following:
   
   • If the parameters were set by group policy, then check that the policy is applied. If necessary, you can enforce group policy with the gpupdate / force command
   • The status of the Windows Remote Management (WinRM) service (Windows Remote Management Service). The service must be started and configured to start automatically. If necessary, this service can be configured on the client computer using the winrm quickconfig command . This command configures the WinRM service, creates a winrm listener, and creates a firewall exception rule.
     To verify that the collector server can connect to the source computer using WinRM, you can use the following command: winrm id -remote: <Target computer name> -u: <Username> -p: <Password> . Specify the account and password of the user who has the ability to connect via winrm.
   • The EventCollectorUser user is a member of the Event Log Readers group. Only members of this group can read events on a specific computer.
   
   

What can be improved

• Selection of events by time (day, week, month) and writing them into the corresponding individual sheets of the spreadsheet or output CSV files. It is possible to envisage setting the date range using the input parameters of the script.
• Add a graphical representation of data using summary tables for users and printing devices and graphs. Such a report can be immediately put on the table to the head.
• Set up archiving and rotation of the “Forwarded Events” log, add the function of analyzing the corresponding archive files. It will be reasonable when working with a sufficiently large number of computers (over 50).

1. mcp.su/windows-server-2008/event-collector-in-windows-server-2008
2. windowsnotes.ru/powershell-2/nastrojka-udalennogo-vzaimodejstviya-v-powershell-chast-1
3. social.technet.microsoft.com/Forums/en-US/8e7399f6-ffdc-48d6-927b-f0beebd4c7f0/enabling-print-history-through-group-policy?forum=winserverprint
4. mywinsysadm.wordpress.com/2012/07/16/powershell-audit-printer-event-logs
5. www.winblog.ru/admin/1147767392-29031101.html
6. windowsitpro.com/security/q-what-are-some-simple-tips-testing-and-troubleshooting-windows-event-forwarding-and-collec

 #     $Events = Get-Winevent -FilterHashTable @{LogName='ForwardedEvents'; ID=307;} #    $Jobs = @() ForEach ($Event in $Events) { #   XML $eventXML = [xml]$Event.ToXml() #          XML-  $PrintJob = New-Object PsObject Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name PageCount -Value $eventXML.Event.UserData.DocumentPrinted.Param8 Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name UserName -Value $eventXML.Event.UserData.DocumentPrinted.Param3 Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name DocumentName -Value $eventXML.Event.UserData.DocumentPrinted.Param2 Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name Size -Value $eventXML.Event.UserData.DocumentPrinted.Param7 Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name Printer -Value $eventXML.Event.UserData.DocumentPrinted.Param5 #     SystemTime   . $date = Get-Date $eventXML.Event.System.TimeCreated.SystemTime Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name Time -Value $date #      $Jobs += $PrintJob } #       CSV $Jobs | Export-Csv D:\PrintReports\events.csv -NoTypeInformation -Encoding UTF8 -Delimiter ';'