none
The print spooler failed to delete the file

    Question

  • Windows 2008 R2 SP1 + hotfixes print server.  Mostly XP SP3 clients.


    We have two print servers, prod and test. The prod server often logs the following two types of events for most print jobs:

    Log Name:      Microsoft-Windows-PrintService/Operational
    Source:        Microsoft-Windows-PrintService
    Date:          1/29/2013 11:33:39 AM
    Event ID:      310
    Task Category: Deleting a document
    Level:         Information
    Keywords:      Classic Spooler Event,Document Print Job
    User:          SYSTEM
    Computer:      PRINTSERVER.DOMAIN
    Description:
    Document 140, Remote Downlevel Document owned by cestebes was deleted on PRINTER-LSR1. No user action is required.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-PrintService" Guid="{747EF6FD-E535-4D16-B510-42C90F6873A1}" />
        <EventID>310</EventID>
        <Version>0</Version>
        <Level>4</Level>
        <Task>27</Task>
        <Opcode>11</Opcode>
        <Keywords>0x4000000000000840</Keywords>
        <TimeCreated SystemTime="2013-01-29T19:33:39.711456900Z" />
        <EventRecordID>51545889</EventRecordID>
        <Correlation />
        <Execution ProcessID="2640" ThreadID="4408" />
        <Channel>Microsoft-Windows-PrintService/Operational</Channel>
        <Computer>PRINTSERVER.DOMAIN</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <UserData>
        <DocumentDeleted xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events">
          <Param1>140</Param1>
          <Param2>Remote Downlevel Document</Param2>
          <Param3>cestebes</Param3>
          <Param4>PRINTER-LSR1</Param4>
        </DocumentDeleted>
      </UserData>
    </Event>
    
    
    Log Name:      Microsoft-Windows-PrintService/Operational
    Source:        Microsoft-Windows-PrintService
    Date:          1/29/2013 11:33:39 AM
    Event ID:      812
    Task Category: Executing a file operation
    Level:         Error
    Keywords:      Print Spooler
    User:          SYSTEM
    Computer:      PRINTSERVER.DOMAIN
    Description:
    The print spooler failed to delete the file C:\Windows\system32\spool\PRINTERS\00140.SHD, error code 0x2. See the event user data for context information.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-PrintService" Guid="{747EF6FD-E535-4D16-B510-42C90F6873A1}" />
        <EventID>812</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>46</Task>
        <Opcode>12</Opcode>
        <Keywords>0x4000000000020000</Keywords>
        <TimeCreated SystemTime="2013-01-29T19:33:39.711456900Z" />
        <EventRecordID>51545890</EventRecordID>
        <Correlation />
        <Execution ProcessID="2640" ThreadID="4408" />
        <Channel>Microsoft-Windows-PrintService/Operational</Channel>
        <Computer>PRINTSERVER.DOMAIN</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <UserData>
        <FileOpFailed xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events">
          <Source>C:\Windows\system32\spool\PRINTERS\00140.SHD</Source>
          <Destination>-</Destination>
          <Flags>0x0</Flags>
          <ErrorCode>0x2</ErrorCode>
          <Context>104</Context>
        </FileOpFailed>
      </UserData>
    </Event>


    Per eventId 310, it sounds like Windows does successfully delete it.  however, the next event, with the exact same timestamp, logs the inability to delete the very same job.  ErrorCode 0x2 = ERROR_FILE_NOT_FOUND.  Manually checking in C:\Windows\system32\spool\PRINTERS\, that file is NOT found.  There are however plenty of other SPL and SHD files from 30 + minutes ago which should not be present. 

    I've compared NTFS permissions on C:\Windows\system32\spool\PRINTERS\ between the two print servers and they're identical.

    This some sort of threading bug with the spooler? as in two separate threads are trying to delete the same job?


    Tuesday, January 29, 2013 7:39 PM

All replies

  • check out this thread it has similarity to your problem, it could be a bug but if your system is working fine you can just ignore that error. 

    Unless MS rectifies it in some service pack releases.

    http://social.technet.microsoft.com/Forums/en-US/winserverprint/thread/960c0a6b-a6de-44b7-93b6-5fd3d5410c98/


    Every second counts..make use of it.

    Wednesday, January 30, 2013 6:28 AM