How to track and report on print usage statistics

Event Log Management
Copy Article URL Copied

Is it possible to track user print usage statistics for a network printer?

In order to track print usage statistics follow the below steps:

1) The first thing that needs to be accomplished is to turn on Printer event auditing on the print server.  The methods used to do this on each OS are a bit different but the idea is the same.

You can reference the following for information on how to do this using Windows Server 2003.  Also Windows Server 2008/R2 instructions can be found in the community additions at the bottom of the page:

2) Create an inclusive filter in Netwrix Auditor Event Log Manager.

In the Netwrix Auditor Event Log Manager open your monitoring plan and click Configure on the right of Audit Archiving Filters -> Click Add to add a new filter.

The filter can have any name you choose however the event log should read Microsoft-Windows-PrintService/OperationalVerify this location in the Windows Event Logs of your print server in case yours is different.

User-added image

On the Event Fields tab you will want to check Event ID: and specify event ID 307.  At this point you can hit okay and have all 307 events get collected.  If you want to further customize the filter to reduce the number of events collected you can use the rest of the Event Fields tab and the Insertion Strings tab.  Find below the indexes and the type of data contained in their value for reference.

Note that %1 is a reference to index number 1.  The insertion string for index one for example would be the job number.

Event 307
%1: Job #
%2: Name of Document
%3: User
%4: Source Computer
%5: Printer Name
%6: Printer Port on the server
%7: Size in Bytes
%8: Page Printed ?

3) Download the attached Printed Documents and extract the .rdl file. Open Reports Server URL in the browser and navigate to the folder where you want to save the report (i.e. Home\Netwrix Auditor\Netwrix Auditor for Event Log\Change Reports). Click “Upload” to place the report to this folder.

4) Once uploaded, configure the report to use Netwrix_Auditor_EventLog database:

click the 3 dots on the name of the report to call the context menu

Click Data sources, choose ‘Custom data source’, specify the connection type ‘Microsoft SQL Server’, enter the connection string:

Data Source=SQL\INSTANCE;Initial Catalog=Netwrix_Auditor_EventLog;Application Name=”Netwrix Auditor”

NOTE: SQL\INSTANCE should be replaced with the name of your SQL Server instance.

Specify the credentials to connect to the data source.

5) The report is now available for usage only via the web interface of your Report Server. It will not appear under Reports in the Netwrix Auditor console.

Printed Documents RDL

Go Up