I have an ISS server running Windows Server 2008 Standard 32-bit. All of a sudden it started spewing forth GBs worth of data into the spooler.xml in C:\Windows\System32\spool folder. We track it down to the print spooler that's just unloading a ton of error messages. We stop the print spooler and have a 15 GB spool.xml file that has the following error:
<?xml version="1.0"?>
<SpoolerErrorLog>
<RegistryData>
<PrintProvidor name="LanMan Print Services">
<Name><![CDATA[win32spl.dll]]></Name>
<DisplayName><![CDATA[LanMan Print Services]]></DisplayName>
<Node name="PortNames">
</Node>
<Node name="Servers">
<AddPrinterDrivers>0x1</AddPrinterDrivers>
</Node>
</PrintProvidor>
<Driver name="Dell 3130cn Color Laser PCL6">
<Configuration_File><![CDATA[dlxbmziu.dll]]></Configuration_File>
<Data_File><![CDATA[dlxbmzp.ddd]]></Data_File>
<Driver><![CDATA[dlxbmzim.dll]]></Driver>
<Help_File><![CDATA[dlxbmz.chm]]></Help_File>
<Monitor><![CDATA[]]></Monitor>
<Datatype><![CDATA[RAW]]></Datatype>
<Version>0x3</Version>
<TempDir>0x0</TempDir>
<Attributes>0x2</Attributes>
<Manufacturer><![CDATA[Dell Inc.]]></Manufacturer>
<OEM_URL><![CDATA[http://www.dell.com/printers/]]></OEM_URL>
<HardwareID><![CDATA[wsdprint\dell3130cn_color_las86d0]]></HardwareID>
<Provider><![CDATA[Dell Inc.]]></Provider>
<Print_Processor><![CDATA[]]></Print_Processor>
<VendorSetup><![CDATA[]]></VendorSetup>
<InfPath><![CDATA[]]></InfPath>
<PrinterDriverAttributes>0x0</PrinterDriverAttributes>
<DriverDate><![CDATA[07/19/2009]]></DriverDate>
<DriverVersion><![CDATA[2.1.5.0]]></DriverVersion>
<MinInboxDriverVerDate><![CDATA[01/01/1601]]></MinInboxDriverVerDate>
<MinInboxDriverVerVersion><![CDATA[0.0.0.0]]></MinInboxDriverVerVersion>
</Driver>
<Driver name="Dell 3130cn Color Laser PS">
<Configuration_File><![CDATA[PS5UI.DLL]]></Configuration_File>
<Data_File><![CDATA[DL3130CN.PPD]]></Data_File>
<Driver><![CDATA[PSCRIPT5.DLL]]></Driver>
<Help_File><![CDATA[PSCRIPT.HLP]]></Help_File>
<Monitor><![CDATA[]]></Monitor>
<Datatype><![CDATA[]]></Datatype>
<Version>0x3</Version>
<TempDir>0x0</TempDir>
<Attributes>0x2</Attributes>
<Manufacturer><![CDATA[Dell Inc.]]></Manufacturer>
<OEM_URL><![CDATA[http://www.dell.com/printers/]]></OEM_URL>
<HardwareID><![CDATA[lptenum\dell3130cn_color_las86d0]]></HardwareID>
<Provider><![CDATA[Dell Inc.]]></Provider>
<Print_Processor><![CDATA[]]></Print_Processor>
<VendorSetup><![CDATA[]]></VendorSetup>
<InfPath><![CDATA[]]></InfPath>
<PrinterDriverAttributes>0x0</PrinterDriverAttributes>
<DriverDate><![CDATA[05/28/2009]]></DriverDate>
<DriverVersion><![CDATA[4.2.9.6]]></DriverVersion>
<MinInboxDriverVerDate><![CDATA[01/01/1601]]></MinInboxDriverVerDate>
more and more and more (I am limited to character so I can't post the error vomit)..... then
Type="VT_UI4">1</Attribute>
<Attribute="RefCount" Type="VT_UI4">0</Attribute>
<Attribute="StartDocPortFlag" Type="VT_UI4">0</Attribute>
<Attribute="ServerEntry" Type="VT_BSTR">{D9D8354D-4B23-4B13-B11E-2536DB7635BF}</Attribute>
<Attribute="PrinterName" Type="VT_BSTR">{4D8B85BF-F164-4A57-B0BA-A370E1237F9D}</Attribute>
<Attribute="RemoteChangeId" Type="VT_UI4">0</Attribute>
<Attribute="PrinterMergedAttributes" Type="VT_UI4">20000</Attribute>
<Attribute="CSRAttributes" Type="VT_UI4">0</Attribute>
<Attribute="RemotePrinterCache" Type="VT_RECORD">0445FA68</Attribute>
<Attribute="SyncCacheIsValid" Type="VT_UI4">1</Attribute>
<Attribute="LocalPrinter" Type="VT_UNKNOWN">01E49C68</Attribute>
<Attribute="LastTouched" Type="VT_UI8">1ccb44e1a022bff</Attribute>
<Attribute="LastTouchedFlushed" Type="VT_UI8">1ccb44e1a022bff</Attribute>
<Attribute="NumberOfFailedSyncAttempts" Type="VT_UI4">0</Attribute>
<Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
</CacheEntry>
<CacheEntry="\\Aksia01\HPLaserJet 4700 PCL 5" cRef="4" State="kNormal">
<Attribute="EntryType" Type="VT_UI4">2</Attribute>
<Attribute="DriverState" Type="VT_UI4">1</Attribute>
<Attribute="RefCount" Type="VT_UI4">0</Attribute>
<Attribute="StartDocPortFlag" Type="VT_UI4">0</Attribute>
<Attribute="ServerEntry" Type="VT_BSTR">{D9D8354D-4B23-4B13-B11E-2536DB7635BF}</Attribute>
<Attribute="PrinterName" Type="VT_BSTR">{221C2E34-56A1-4A5A-AFFC-E553CE77D860}</Attribute>
<Attribute="RemoteChangeId" Type="VT_UI4">0</Attribute>
<Attribute="PrinterMergedAttributes" Type="VT_UI4">20000</Attribute>
<Attribute="CSRAttributes" Type="VT_UI4">3</Attribute>
<Attribute="RemotePrinterCache" Type="VT_RECORD">0445F958</Attribute>
<Attribute="SyncCacheIsValid" Type="VT_UI4">1</Attribute>
<Attribute="NumberOfFailedSyncAttempts" Type="VT_UI4">0</Attribute>
<Attribute="LocalPrinter" Type="VT_UNKNOWN">01E05888</Attribute>
<Attribute="LastTouched" Type="VT_UI8">1ccb44e1a5f27dc</Attribute>
<Attribute="LastTouchedFlushed" Type="VT_UI8">1ccb44e1a5f27dc</Attribute>
<Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
<Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
<Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
<Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
<Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
<Attribute="SyncPrinterPending" Type="VT_UI4">0</Attribute>
This last part is what is repeating for 15 GB.
Yeah. We've figured out the solution, what we can't figure out is how this was caused. There is no one in the server, no one printing or using the print spooler from this server. We have an in-house application being run on the ISS, but it doesn't print from the server.
Thoughts?