This post continues where my previous post titled Export events including Event Properties from Windows Event Viewer left off.
The data I’m going to work with was exported using eventquery.vbs and saved in a CSV-file, comma separated file and it is presented in the form shown below.
"Information","10","12.05.2009 13:24:48","Print","Servername","None","AD\username","Document 232, filename.pdf owned by username was printed on printername via port IP_192.168.0.254. Size in bytes: 279232; pages printed: 18"
I’m interested in the username, date/time printed and pages printed and will now show how I’ve accomplished that using some simple linux console commands.
awk -F, '{print $7 " " $3 " " $4 " " $NF}' Event_Viewer_System.csv | grep printername | awk '{print $1 "," $2 "," $3 "," $NF}' | sed 's/\"//g'|sort > PrintAccounting.csv
Result
username,14.05.2009,12:58:41,18 username,15.05.2009,09:24:13,2 username,15.05.2009,09:25:00,37 username,15.05.2009,09:30:03,2 username,15.05.2009,09:30:29,2 ...
Where the fields contain username, date, time and the amount of printed pages.
A short description on whats being done
And that’s how you make a primitive print accounting system from data gathered in a Windows Server.
This particular example has been testen on data from a Windows 2003 Server, but I think it can be performed on other versions of Windows as well.
Tags: csv, Event Properties, Event Viewer, eventquery.vbs
Posted by Hans-Henry Jakobsen
This post came to life after a request to produce an overview of how many prints every user produced on a special printer from our print server. Since we have no print accounting software installed on our Windows 2003 Server I had to come up with a new solution to this problem. The actual print accounting part will be posted in another post…
The solution I came up with was to enable auditing on printing and then gather information from the System log in the Event Viewer. But first I had to export the necessary data from the Event Viewer since a normal export using the “Export List…” function by right clicking a log would not give me a good enough detail level including Event Properties.
After some research I found a Windows tools called eventquery.vbs which is located in the windows/system32 folder on most Windows PCs. It’s a script that lists the events and event properties from one or more event logs.
Export log info
This is the switches I used to export Event Viewer events from System
cscript c:\windows\system32\eventquery.vbs /fi "Type eq Information" /fi "Source eq Print" /fi "ID eq 10" /v /l System /fo csv > Event_Viewer_System.csv
The syntax I used was to filter (/fi) out
More info about the eventquery.vbs tool can be found by following the link under Sources.
The result from this export can look something like this
"Information","10","12.05.2009 13:24:48","Print","Servername","None","AD\username","Document 232, filename.pdf owned by username was printed on printername via port IP_192.168.0.254. Size in bytes: 279232; pages printed: 1"
If you look at the image below you’ll understand where I got the filter type info from.
These data now gives me the opportunity to filter out the data I need to create a simple print accounting on my users, and that is posted in the post named Simple Windows Print Accounting using Event Viewer data.
Source: eventquery.vbs
This post can also be used to export from any Event Viewer data log like Application, Security, Internet Explorer or other logs you have on your system.
Tags: cscript, Event Properties, Event Viewer, eventquery.vbs
Posted by Hans-Henry Jakobsen