Printer Spooler spews forth Error-Vomit without even being used

Question

I have an ISS server running Windows Server 2008 Standard 32-bit. All of a sudden it started spewing forth GBs worth of data into the spooler.xml in C:\Windows\System32\spool folder. We track it down to the print spooler that's just unloading a ton of error messages. We stop the print spooler and have a 15 GB spool.xml file that has the following error:

<?xml version="1.0"?>
<SpoolerErrorLog>
    <RegistryData>
        <PrintProvidor name="LanMan Print Services">
            <Name><![CDATA[win32spl.dll]]></Name>
            <DisplayName><![CDATA[LanMan Print Services]]></DisplayName>
            <Node name="PortNames">
            </Node>
            <Node name="Servers">
                <AddPrinterDrivers>0x1</AddPrinterDrivers>
            </Node>
        </PrintProvidor>
        <Driver name="Dell 3130cn Color Laser PCL6">
            <Configuration_File><![CDATA[dlxbmziu.dll]]></Configuration_File>
            <Data_File><![CDATA[dlxbmzp.ddd]]></Data_File>
            <Driver><![CDATA[dlxbmzim.dll]]></Driver>
            <Help_File><![CDATA[dlxbmz.chm]]></Help_File>
            <Monitor><![CDATA[]]></Monitor>
            <Datatype><![CDATA[RAW]]></Datatype>
            <Version>0x3</Version>
            <TempDir>0x0</TempDir>
            <Attributes>0x2</Attributes>
            <Manufacturer><![CDATA[Dell Inc.]]></Manufacturer>
            <OEM_URL><![CDATA[http://www.dell.com/printers/]]></OEM_URL>
            <HardwareID><![CDATA[wsdprint\dell3130cn_color_las86d0]]></HardwareID>
            <Provider><![CDATA[Dell Inc.]]></Provider>
            <Print_Processor><![CDATA[]]></Print_Processor>
            <VendorSetup><![CDATA[]]></VendorSetup>
            <InfPath><![CDATA[]]></InfPath>
            <PrinterDriverAttributes>0x0</PrinterDriverAttributes>
            <DriverDate><![CDATA[07/19/2009]]></DriverDate>
            <DriverVersion><![CDATA[2.1.5.0]]></DriverVersion>
            <MinInboxDriverVerDate><![CDATA[01/01/1601]]></MinInboxDriverVerDate>
            <MinInboxDriverVerVersion><![CDATA[0.0.0.0]]></MinInboxDriverVerVersion>
        </Driver>
        <Driver name="Dell 3130cn Color Laser PS">
            <Configuration_File><![CDATA[PS5UI.DLL]]></Configuration_File>
            <Data_File><![CDATA[DL3130CN.PPD]]></Data_File>
            <Driver><![CDATA[PSCRIPT5.DLL]]></Driver>
            <Help_File><![CDATA[PSCRIPT.HLP]]></Help_File>
            <Monitor><![CDATA[]]></Monitor>
            <Datatype><![CDATA[]]></Datatype>
            <Version>0x3</Version>
            <TempDir>0x0</TempDir>
            <Attributes>0x2</Attributes>
            <Manufacturer><![CDATA[Dell Inc.]]></Manufacturer>
            <OEM_URL><![CDATA[http://www.dell.com/printers/]]></OEM_URL>
            <HardwareID><![CDATA[lptenum\dell3130cn_color_las86d0]]></HardwareID>
            <Provider><![CDATA[Dell Inc.]]></Provider>
            <Print_Processor><![CDATA[]]></Print_Processor>
            <VendorSetup><![CDATA[]]></VendorSetup>
            <InfPath><![CDATA[]]></InfPath>
            <PrinterDriverAttributes>0x0</PrinterDriverAttributes>
            <DriverDate><![CDATA[05/28/2009]]></DriverDate>
            <DriverVersion><![CDATA[4.2.9.6]]></DriverVersion>
            <MinInboxDriverVerDate><![CDATA[01/01/1601]]></MinInboxDriverVerDate>

more and more and more (I am limited to character so I can't post the error vomit)..... then

Type="VT_UI4">1</Attribute>
                    <Attribute="RefCount" Type="VT_UI4">0</Attribute>
                    <Attribute="StartDocPortFlag" Type="VT_UI4">0</Attribute>
                    <Attribute="ServerEntry" Type="VT_BSTR">{D9D8354D-4B23-4B13-B11E-2536DB7635BF}</Attribute>
                    <Attribute="PrinterName" Type="VT_BSTR">{4D8B85BF-F164-4A57-B0BA-A370E1237F9D}</Attribute>
                    <Attribute="RemoteChangeId" Type="VT_UI4">0</Attribute>
                    <Attribute="PrinterMergedAttributes" Type="VT_UI4">20000</Attribute>
                    <Attribute="CSRAttributes" Type="VT_UI4">0</Attribute>
                    <Attribute="RemotePrinterCache" Type="VT_RECORD">0445FA68</Attribute>
                    <Attribute="SyncCacheIsValid" Type="VT_UI4">1</Attribute>
                    <Attribute="LocalPrinter" Type="VT_UNKNOWN">01E49C68</Attribute>
                    <Attribute="LastTouched" Type="VT_UI8">1ccb44e1a022bff</Attribute>
                    <Attribute="LastTouchedFlushed" Type="VT_UI8">1ccb44e1a022bff</Attribute>
                    <Attribute="NumberOfFailedSyncAttempts" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                </CacheEntry>
                <CacheEntry="\\Aksia01\HPLaserJet 4700 PCL 5" cRef="4" State="kNormal">
                    <Attribute="EntryType" Type="VT_UI4">2</Attribute>
                    <Attribute="DriverState" Type="VT_UI4">1</Attribute>
                    <Attribute="RefCount" Type="VT_UI4">0</Attribute>
                    <Attribute="StartDocPortFlag" Type="VT_UI4">0</Attribute>
                    <Attribute="ServerEntry" Type="VT_BSTR">{D9D8354D-4B23-4B13-B11E-2536DB7635BF}</Attribute>
                    <Attribute="PrinterName" Type="VT_BSTR">{221C2E34-56A1-4A5A-AFFC-E553CE77D860}</Attribute>
                    <Attribute="RemoteChangeId" Type="VT_UI4">0</Attribute>
                    <Attribute="PrinterMergedAttributes" Type="VT_UI4">20000</Attribute>
                    <Attribute="CSRAttributes" Type="VT_UI4">3</Attribute>
                    <Attribute="RemotePrinterCache" Type="VT_RECORD">0445F958</Attribute>
                    <Attribute="SyncCacheIsValid" Type="VT_UI4">1</Attribute>
                    <Attribute="NumberOfFailedSyncAttempts" Type="VT_UI4">0</Attribute>
                    <Attribute="LocalPrinter" Type="VT_UNKNOWN">01E05888</Attribute>
                    <Attribute="LastTouched" Type="VT_UI8">1ccb44e1a5f27dc</Attribute>
                    <Attribute="LastTouchedFlushed" Type="VT_UI8">1ccb44e1a5f27dc</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
                    <Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>

This last part is what is repeating for 15 GB.

Yeah. We've figured out the solution, what we can't figure out is how this was caused. There is no one in the server, no one printing or using the print spooler from this server. We have an in-house application being run on the ISS, but it doesn't print from the server.

Thoughts?

`"I have an ISS server"` - You have an International Space Station Server? Can I play with it? — MDMarra, Dec 07 '11 at 21:17
@MArkM: You may certainly not play with it... its old and fragile. :P. I meant IIS. — Mike, Dec 08 '11 at 19:59
@Zoredache: I don't think so. Its no setup as a print server at all. And its only print driver install is no longer on the network. — Mike, Dec 08 '11 at 20:01

Printer Spooler spews forth Error-Vomit without even being used

0 Answers0