How to configure Windows Print Services events in SEM

This article is provided to give more detailed information on setting up Windows Print Event logs in SEM. These are more specific instructions directed at printer events. For more general Windows Event Log setup in SEM, please see SEM: Configuring Windows Event Logs connectors to function correctly  instead. 

SEM printer-event setup

1. Enable the Windows PrintService logs

On the Windows print server:

1. Open Event Viewer.
2. Browse to Applications and Services Logs → Microsoft → Windows → PrintService.
3. Enable Operational and/or Admin logging.
4. Confirm the log’s Full Name:
   • Microsoft-Windows-PrintService/Operational
   • Microsoft-Windows-PrintService/Admin
5. If the log does not exist under the Windows EventLog registry path, create the matching key under:
   HKLM\SYSTEM\CurrentControlSet\Services\EventLog
   Right click on Event Log > new > Key
   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Operational
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Admin
   SEM requires these log names to match exactly.

2. Add the SEM connectors

In the SEM console:

1. Go to Configure → Nodes.
2. Select the Windows agent on the print server.
3. Click Manage Node Connectors.
4. Add:
   • Print Services for Windows 7/2008 (Operational)
   • Print Services for Windows 7/2008 (Admin), if Admin events are required.
5. Verify the connector’s Log File matches the Event Viewer Full Name.
6. Start the connector.

Generate a test print job and confirm the events appear in Live Events. If no events arrive, verify the Windows log contains entries and restart the agent host if Windows returns an invalid-handle error.

Create printer filters

1. Open Live Events.
2. Use the group ⋮ → Add New Filter, or click the + at the top of the filter column.
3. Give the filter a descriptive name, such as Printer Errors - PrintServer01.
4. Expand Events or Event Groups.
5. Drag the relevant event fields into the filter builder.
6. Edit the operators and values.
7. Add additional conditions:
   • AND for conditions that must all match.
   • OR for alternatives.
   • Use Group when combining AND/OR logic.
8. Click Save.

Useful filter designs

• All printer events: filter on the PrintService event/connector.
• One print server: PrintService event AND source/device equals the server.
• Printer errors: PrintService event AND event ID or message corresponds to an error.
• Specific printer: PrintService event AND printer-name field contains the printer name.
• Failed print jobs: PrintService event AND the relevant failure/status value.

Use the field names and event IDs shown in the actual incoming SEM event rather than assuming Windows event IDs are identical across printer models and connector versions.

For a physical printer sending its own syslog, use the applicable vendor connector instead; SEM lists dedicated connectors such as HP Printer and Toshiba devices, while the PrintService connectors are for Windows print-server logs.