[Dave_Lincs]

I am trying to report on print usage via our Win 2008 R2 64bit server using Get-WinEvent.

Part of the code is this

		#Get print job details
		$time = $LogEntry.TimeCreated
		$entry = [xml]$LogEntry.ToXml() 
		$docName = $entry.Event.UserData.DocumentPrinted.Param2
		$Username = $entry.Event.UserData.DocumentPrinted.Param3
		$Computer = $entry.Event.UserData.DocumentPrinted.Param4
		$PrinterName = $entry.Event.UserData.DocumentPrinted.Param5
		$PrintSize = $entry.Event.UserData.DocumentPrinted.Param7
		$PrintPages = $entry.Event.UserData.DocumentPrinted.Param8

Having run the code we were not getting page numbers returned looking into the 307 event log in PrintService event log looking at the XML view Param7 is specified twice. Now I assume this is a issue within Windows? Is there any way to edit the XML being used by the event log?

- <DocumentPrinted xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events">
  <Param1>125</Param1> 
  <Param2>document</Param2> 
  <Param3>test1</Param3> 
  <Param4>\\IP ADDRESS</Param4> 
  <Param5>property1</Param5> 
  <Param6>property1</Param6> 
  <Param7>296244</Param7> 
  <Param7>1</Param7> 
  </DocumentPrinted>

Thanks

Dave

[dhindel]

Did you ever figure out how to get the parameter's fixed? Was there a hotfix for it? I'm having the same exact problem.

[Dave_Lincs]

Originally Posted by dhindel

Did you ever figure out how to get the parameter's fixed? Was there a hotfix for it? I'm having the same exact problem.

Hi,

Off the top of my head I am not sure, I will go back through my scripts to see what I did, but I seem to remeber we did something clever in Excel to get the page count

Dave

[dhindel]

Ah ha! I performed all of the Windows Updates (including Service Pack 1) and that fixed the Param7 issue. The second Param7 is now Param8 in the XML data. Thanks!