Printer Spooler Keeps Crashing - Windows Server 2003 SP2 R2

Discussion in 'Windows Server' started by AndyTC, Feb 27, 2009.

  1. AndyTC

    AndyTC Guest

    Hi,

    My print server keeps crashing constantly, a few times a week. It
    crashes to the point of where I have to restart the spooler server to
    get it to work.

    We have 43 printers installed.
    This is what we have for models of printers:

    Brother HL-4040CN
    Brother HL-5070N
    Brother HL-5170DN
    Brother HL-5250DN BR-Script3
    Brother HL-5280DW BR-Script3
    Brother HL-7050 Series
    Canon iR C5180-H1 PCL5c
    Canon iR3235/iR3245 PCL6
    Canon iR3530 PCL6
    Canon iR 3570/iR4570 PS3
    Canon iR 5570/iR6570 PCL6
    HP Color Laserjet 2500 PS
    HP Color Laserjet 3000 PCL 6
    HP Color Laserjet 5550 PCL 6
    HP Designjet 500PS 42
    HP Laserjet 4200 PS
    HP Laserjet 2420
    Lexmark C520
    Lexmark C532
    Lexmark T642 PS3
    Ricoh Aficio AP400N
    Ricoh Aficio CL2000
    Xerox WCM20


    This is the latest entry in Application Events:

    Faulting application spoolsv.exe, version 5.2.3790.3959, faulting module
    unknown, version 0.0.0.0, fault address 0x00000000.

    This is another error shortly before the spooler crashed (I removed the
    username):

    Event Type: Error
    Event Source: Print
    Event Category: None
    Event ID: 6161
    Date: 2/27/2009
    Time: 9:06:28 AM
    User: HQ\xxx.xxxx
    Computer: MERIDIA
    Description:
    The document Microsoft Word - 13C1F528.doc owned by xxx.xxxx failed to
    print on printer Proposal Room. Data type: NT EMF 1.008. Size of the
    spool file in bytes: 131072. Number of bytes printed: 0. Total number of
    pages in the document: 1. Number of pages printed: 0. Client machine:
    \\TCI428586. Win32 error code returned by the print processor: 0. The
    operation completed successfully.


    I have changed all HP printers to use WinPrint print processor, but its
    still crashing.


    Any idea's?
     
    AndyTC, Feb 27, 2009
    #1
    1. Advertisements

  2. Hi,
    See if the suggestions in KB947477 help you some.

    Also, not sure if they'll install on R2 but have a look at and try
    installing these hotfixes. I've had really good success with them.
    http://support.microsoft.com/kb/955455
    http://support.microsoft.com/kb/953546
    http://support.microsoft.com/kb/952206
    http://support.microsoft.com/kb/953155

    Let me know how it goes.

    - Thee Chicago Wolf (MVP)
     
    Thee Chicago Wolf (MVP), Feb 27, 2009
    #2
    1. Advertisements

  3. AndyTC

    AndyTC Guest

    I will check those out. In the meantime, the spool has crashed again.

    This time, these two errors are in the event viewer
    Event Type: Warning
    Event Source: Server
    Event Category: None
    Event ID: 2510
    Date: 2/27/2009
    Time: 10:28:56 AM
    User: N/A
    Computer: MERIDIA
    Description:
    The server service was unable to map error code 1727.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    Event Type: Warning
    Event Source: Server
    Event Category: None
    Event ID: 2510
    Date: 2/27/2009
    Time: 10:28:56 AM
    User: N/A
    Computer: MERIDIA
    Description:
    The server service was unable to map error code 1722.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.


    The second one has about 10 entries
     
    AndyTC, Feb 27, 2009
    #3
  4. I will check those out. In the meantime, the spool has crashed again.
    Check this KB article for this Event ID:
    http://support.microsoft.com/kb/319335 (kind of useless but hey)

    Also, look at what's mentioned about Xerox printers in this KB article
    (pertains to Server 2000). Might work on 2003!
    http://support.microsoft.com/kb/888206

    also look at
    http://support.microsoft.com/kb/194333
    http://support.microsoft.com/kb/822219
    http://support.microsoft.com/kb/826897
    http://support.microsoft.com/kb/923360
    http://support.microsoft.com/kb/158751

    - Thee Chicago Wolf (MVP)
     
    Thee Chicago Wolf (MVP), Feb 27, 2009
    #4
  5. AndyTC

    AndyTC Guest

    Unfortunately none of those KB's seem to apply to my environment. The
    only thing I've done so far is removed a couple non-default Print
    Monitors from the registry. Is there a way to enable logging to see
    which printer/print driver is crashing the spooler?

    I thought maybe dr. watson could do this, but I can't find any dr watson
    log.
     
    AndyTC, Feb 27, 2009
    #5
  6. AndyTC

    AndyTC Guest

    I am going to try the hyper threading hotfix tonight.
    However, it has crashed again with the following error:

    Application exception occurred:
    App: C:\WINDOWS\system32\spoolsv.exe (pid=3936)
    When: 2/27/2009 @ 16:11:52.103
    Exception number: c0000005 (access violation)




    Event Type: Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000
    Date: 2/27/2009
    Time: 4:11:51 PM
    User: N/A
    Computer: MERIDIA
    Description:
    Faulting application spoolsv.exe, version 5.2.3790.3959, faulting module
    rpcrt4.dll, version 5.2.3790.4115, fault address 0x00019e6d.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 41 70 70 6c 69 63 61 74 Applicat
    0008: 69 6f 6e 20 46 61 69 6c ion Fail
    0010: 75 72 65 20 20 73 70 6f ure spo
    0018: 6f 6c 73 76 2e 65 78 65 olsv.exe
    0020: 20 35 2e 32 2e 33 37 39 5.2.379
    0028: 30 2e 33 39 35 39 20 69 0.3959 i
    0030: 6e 20 72 70 63 72 74 34 n rpcrt4
    0038: 2e 64 6c 6c 20 35 2e 32 .dll 5.2
    0040: 2e 33 37 39 30 2e 34 31 .3790.41
    0048: 31 35 20 61 74 20 6f 66 15 at of
    0050: 66 73 65 74 20 30 30 30 fset 000
    0058: 31 39 65 36 64 19e6d



    It has just occured to me that we have a separate Terminal Services
    Server that serves about 15 users. What is the correct way to have
    printers setup in terminal sessions? Will it use their local setup
    connections? Do I need drivers on the TS?
     
    AndyTC, Feb 27, 2009
    #6
  7. If you have a user dump of this failure you can find the faulting stack
    trace using ntsd.exe


    ntsd -z user.dmp

    this will launch a new window and you will see bunch of module load
    information

    type k at the prompt

    this will display the stack. Don't worry about symbols not found spew.

    Look for hp driver names there is one that is fairly nasty hpzui4wm.dll.
    HP has updated a bunch of drivers that use this module.

    if you don't see anything that indicates a print driver send the stack trace
    ..




    --
    Alan Morris
    Windows Printing Team
    Search the Microsoft Knowledge Base here:
    http://support.microsoft.com/search/?adv=1

    This posting is provided "AS IS" with no warranties, and confers no rights.
     
    Alan Morris [MSFT], Feb 28, 2009
    #7
  8. Hello,

    Thank you for posting here.

    According to your description, I understand that:

    The print server keeps crashing. There are several errors in log.

    If I have misunderstood the problem, please don't hesitate to let me know.

    Please try Alan’s suggestions and Wolf’s suggestions to check if you can
    find the cause of this issue.

    Also, the Event 6161 may be caused by insufficient memory. I suggest
    monitoring system resource to check if memory or Network is in peak hour
    when the error occurs.

    You can try the steps below to narrow down the cause of this issue.

    1. If possible, please check all printer drivers and make sure them are
    WHQL signed printer drivers.

    2. Test every printer on the server locally.

    3. Please refer to the following KB to remove third party print monitors
    and use the default print processors to test this issue again.

    260142 How to troubleshoot printing problems in Windows 2000 and in Windows
    Server 2003
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;260142


    4. To isolate the exact printer driver that causes the spooler failure, we
    will need to collect and analyze the dump file. Unfortunately, we cannot
    analyze dump file in newsgroup threads. To do so, you will need to contact
    Microsoft Customer Support Services (CSS) so that a dedicated Support
    Professional can assist with this request. Thank you for your understanding.

    To obtain the phone numbers for specific technology request please take a
    look at the web site listed below.
    http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

    If you are outside the US please see http://support.microsoft.com for
    regional support phone numbers.

    Sincerely,
    Mervyn Zhang
    Microsoft Online Community Support

    ==================================================
    This posting is provided "AS IS" with no warranties, and confers no rights.
     
    Mervyn Zhang [MSFT], Mar 2, 2009
    #8
  9. AndyTC

    AndyTC Guest

    here is the results of user.dmp


    0:023> k
    ChildEBP RetAddr
    WARNING: Stack unwind information not available. Following frames may be
    wrong.
    02c5fe90 77c68ad6 rpcrt4!I_RpcTransConnectionAllocatePacket+0x1e4
    02c5fea4 77c6e8db rpcrt4!I_RpcTransGetThreadEvent+0x1b4
    02c5ff04 77c6e7b4 rpcrt4!I_RpcLogEvent+0x59c
    02c5ff18 77c7b799 rpcrt4!I_RpcLogEvent+0x475
    02c5ff84 77c7b9b5 rpcrt4!NdrFullPointerInsertRefId+0xa43
    02c5ff8c 77c8872d rpcrt4!NdrFullPointerInsertRefId+0xc5f
    02c5ffac 77c7b110 rpcrt4!I_RpcFree+0xb6b
    *** ERROR: Symbol file could not be found. Defaulted to export symbols
    for kern
    el32.dll -
    02c5ffb8 77e64829 rpcrt4!NdrFullPointerInsertRefId+0x3ba
    02c5ffec 00000000 kernel32!GetModuleHandleA+0xdf
    0:023>
     
    AndyTC, Mar 2, 2009
    #9
  10. this is the Remote Procedure Call binary.


    Okay no we need to dig a bit deeper. If you already called customer
    support, they can handle this

    ==============


    If you have a good internet connection on the client, set the symbol path
    and reveal the stack trace with the corrected function calls.



    http://www.ddj.com/windows/201202917

    The initial debugger output reveals useful information. After displaying the
    command line used to start the application, it shows the search path for
    finding symbol files (PDBs). The symbol search path is important and, in
    this case, I had specified it beforehand by setting the _NT_SYMBOL_PATH
    system variable before running ntsd.exe. The symbol path shown here is
    SRV*c:\Files\websymbols*http://msdl.microsoft.com/download/symbols, which
    identifies a symbol server URL and the location where downloaded symbol
    files may be cached. That is, when ntsd needs to load symbols for a binary,
    it connects to the symbol server at the specified URL, and requests PDBs
    based on unique characteristics of the binary such as the name of the binary
    and its timestamp. The URL here is for the Microsoft public symbol server,
    which provides public Windows symbols for many versions of Windows. Of
    course, I also need to make sure that ntsd can find the symbols for my
    application. If I wish to add, say, the location "C:\Files" to the symbol
    path, then I can use the debugger command .sympath+ C:\Files. The command
    ..symfix+ adds the URL for the Microsoft public symbol server if is not on
    the path. After changing the symbol search path, I always use the .reload
    command to force the debugger to reload all symbols.




    --
    Alan Morris
    Windows Printing Team
    Search the Microsoft Knowledge Base here:
    http://support.microsoft.com/search/?adv=1

    This posting is provided "AS IS" with no warranties, and confers no rights.
     
    Alan Morris [MSFT], Mar 3, 2009
    #10
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.