Print Spool / Pipes not released

[Guest]

Hello there,
Since we upgraded our system to XP from 2000 in the summer we have noticed
that the print spool on some of the workstations (no particular pattern) runs
at about 50 - 60%. This activity remains even after the user has logged off.
This also affects the Print Server as the \pipe\spoolss does not get
released and therefore over the course of a day the CPU on the server runs at
100%. Generally one thing happens before this arises on the workstations.
Print drivers get downloaded from the server. It doesn't seem to matter
which drivers are downloaded, but this problem is always preceded by a
printer driver coming from the Print server. Also on occasion if an
application crashes such as word then the pipes are not released between the
workstation and server.
Rebooting of the workstation or the restarting of the print spool on the
workstation resolves this but that doesn't help the user on the very slow
workstation.
Any ideas? I've tried changing the profiles, changing the print server,
trying to prevent null connections. None of this has identified the cause.

Thanks

 

[Alan Morris [MSFT]]

There was a fix in XP SP2 that limits the number of client spooler
asynchronous OpenPrinter calls to the server.

We found in cases for mobile users and slow networks that the client spooler
would retry the connection before the transport layer could fail or succeed
and thus wind up looping and piling up a series of these calls to the
server.

You will see an increased # of connections on the server for a specific
client.

On the client, the spooler is looping causing excessive CPU utilization.
Check the client using task manager to verify the number of spooler threads
running on the client spoolsv.exe process. Normal for none printing system
with a couple of connected printers will be less than 20 threads.

Are there any local printers defined on the clients? There was also an
issue with some Vendor drivers that caused the spooler to start looping in
this function.

If you are running SP2 and have some clients with local printers, what are
the drivers used?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Guest]

We have about 10 machines on the network with local printers. Some of these
PC's are seeing the problem, but as far as I can tell no more than any other
PC. We are running SP2 on our XP machines (SP1 on the 2003 Printserver). On
all our machines we have the following local printer drivers installed:
Microsoft Office Document Image Writer
PDF995
Xerox Phaser 5400 PCL 5e.

As well as this we have on the Printserver the following drivers:
HP Business Inkjet 2230/2280
HP LaserJet 2100
HP LaserJet III
OKI B6300(PCL6)
OKI C5400(PCL)
Tektronix Phaser 860N by Xerox
Xerox Phaser 5400 PCL 5e
Xerox Phaser 5500N PCL 5e
Xerox Phaser 7300N
Xerox Phaser 8200N

These drivers are used for 18 networked printers.

On top of this the drivers from the local printers have found their way onto
all the PC's on the network (about 500). If these drivers are not being used
by the printers, can they still have an adverse affect.

The following are the extra drivers found on the workstations:

Brother HL-1230
Brother HL-2460
HP Color LaserJet 2500 PCL 6
HP LaserJet 4000 Series PCL6
HP LaserJet 6L
HP LaserJet 6P
HP LaserJet Series II
Kyocera FS-1550 / FS-1550A
Kyocera Mita FS-1020D
Kyocera Mita FS-1020D KX
OKI C5200n
Samsung ML-1450 Series PCL 6
Xerox Phaser 5400 PS.

As you can see there are one or two. Whether these drivers came from when
users logged and they 'Automatically search for network folders and printers'
(which is now unticked) I don't know.

I have a machine next to me that the spool is running at about 90% with 20
threads open and 7 pipes open to the Printserver. All I did was logon.

So what do you suggest? Do I delete the unwanted printer drivers (if that
solves it how do I stop them coming back?).
Can I try a pre-SP2 spoolsv.exe to see how that performs.

Thanks for your help

Adrian Passey

There was a fix in XP SP2 that limits the number of client spooler
asynchronous OpenPrinter calls to the server.

We found in cases for mobile users and slow networks that the client spooler
would retry the connection before the transport layer could fail or succeed
and thus wind up looping and piling up a series of these calls to the
server.

You will see an increased # of connections on the server for a specific
client.

On the client, the spooler is looping causing excessive CPU utilization.
Check the client using task manager to verify the number of spooler threads
running on the client spoolsv.exe process. Normal for none printing system
with a couple of connected printers will be less than 20 threads.

Are there any local printers defined on the clients? There was also an
issue with some Vendor drivers that caused the spooler to start looping in
this function.

If you are running SP2 and have some clients with local printers, what are
the drivers used?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Hello there,
Since we upgraded our system to XP from 2000 in the summer we have noticed
that the print spool on some of the workstations (no particular pattern)
runs
at about 50 - 60%. This activity remains even after the user has logged
off.
This also affects the Print Server as the \pipe\spoolss does not get
released and therefore over the course of a day the CPU on the server runs
at
100%. Generally one thing happens before this arises on the workstations.
Print drivers get downloaded from the server. It doesn't seem to matter
which drivers are downloaded, but this problem is always preceded by a
printer driver coming from the Print server. Also on occasion if an
application crashes such as word then the pipes are not released between
the
workstation and server.
Rebooting of the workstation or the restarting of the print spool on the
workstation resolves this but that doesn't help the user on the very slow
workstation.
Any ideas? I've tried changing the profiles, changing the print server,
trying to prevent null connections. None of this has identified the
cause.

Thanks

 

[Alan Morris [MSFT]]

The clients will keep 1 session open for every application that has called
into the remote spooler. When you say logon is this from a logoff of just
locking the machine? If users lock and leave the application running (which
is very normal) I would expect 3 or 4 open sessions to the print server.
The biggest problems I have had are mobile computers as they move from one
network segment to another and the server attempts to find them at the old
address when sending notification information to the client. But with
service pack 2 rollout the looping client calls has not been an issue.

The next step would be to get a network capture of the packet exchange
between the client and server. Filter for MSRPC packets . Opnum 13 is
RPCwriteprinter so you would see this when the client is printing.


Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

We have about 10 machines on the network with local printers. Some of
these
PC's are seeing the problem, but as far as I can tell no more than any
other
PC. We are running SP2 on our XP machines (SP1 on the 2003 Printserver).
On
all our machines we have the following local printer drivers installed:
Microsoft Office Document Image Writer
PDF995
Xerox Phaser 5400 PCL 5e.

As well as this we have on the Printserver the following drivers:
HP Business Inkjet 2230/2280
HP LaserJet 2100
HP LaserJet III
OKI B6300(PCL6)
OKI C5400(PCL)
Tektronix Phaser 860N by Xerox
Xerox Phaser 5400 PCL 5e
Xerox Phaser 5500N PCL 5e
Xerox Phaser 7300N
Xerox Phaser 8200N

These drivers are used for 18 networked printers.

On top of this the drivers from the local printers have found their way
onto
all the PC's on the network (about 500). If these drivers are not being
used
by the printers, can they still have an adverse affect.

The following are the extra drivers found on the workstations:

Brother HL-1230
Brother HL-2460
HP Color LaserJet 2500 PCL 6
HP LaserJet 4000 Series PCL6
HP LaserJet 6L
HP LaserJet 6P
HP LaserJet Series II
Kyocera FS-1550 / FS-1550A
Kyocera Mita FS-1020D
Kyocera Mita FS-1020D KX
OKI C5200n
Samsung ML-1450 Series PCL 6
Xerox Phaser 5400 PS.

As you can see there are one or two. Whether these drivers came from when
users logged and they 'Automatically search for network folders and
printers'
(which is now unticked) I don't know.

I have a machine next to me that the spool is running at about 90% with 20
threads open and 7 pipes open to the Printserver. All I did was logon.

So what do you suggest? Do I delete the unwanted printer drivers (if that
solves it how do I stop them coming back?).
Can I try a pre-SP2 spoolsv.exe to see how that performs.

Thanks for your help

Adrian Passey

There was a fix in XP SP2 that limits the number of client spooler
asynchronous OpenPrinter calls to the server.

We found in cases for mobile users and slow networks that the client
spooler
would retry the connection before the transport layer could fail or
succeed
and thus wind up looping and piling up a series of these calls to the
server.

You will see an increased # of connections on the server for a specific
client.

On the client, the spooler is looping causing excessive CPU utilization.
Check the client using task manager to verify the number of spooler
threads
running on the client spoolsv.exe process. Normal for none printing
system
with a couple of connected printers will be less than 20 threads.

Are there any local printers defined on the clients? There was also an
issue with some Vendor drivers that caused the spooler to start looping
in
this function.

If you are running SP2 and have some clients with local printers, what
are
the drivers used?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello there,
Since we upgraded our system to XP from 2000 in the summer we have
noticed
that the print spool on some of the workstations (no particular
pattern)
runs
at about 50 - 60%. This activity remains even after the user has
logged
off.
This also affects the Print Server as the \pipe\spoolss does not get
released and therefore over the course of a day the CPU on the server
runs
at
100%. Generally one thing happens before this arises on the
workstations.
Print drivers get downloaded from the server. It doesn't seem to
matter
which drivers are downloaded, but this problem is always preceded by a
printer driver coming from the Print server. Also on occasion if an
application crashes such as word then the pipes are not released
between
the
workstation and server.
Rebooting of the workstation or the restarting of the print spool on
the
workstation resolves this but that doesn't help the user on the very
slow
workstation.
Any ideas? I've tried changing the profiles, changing the print
server,
trying to prevent null connections. None of this has identified the
cause.

Thanks

 

[Guest]

Thanks for the reply.

The last post was very useful and pointed me in the right direction.
Following your suggestion regarding the network capture I found that the
workstations that had this issue were constantly sending information to the
Printserver that contained references to 4 printers. They were all the same
model Kyocera FS-1020D. We have a 5th printer of this model, but that has
different firmware. In the capture the interesting part to me was the
following:

MSRPC: c/o RPC Request: call 0x3BE46C opnum 0x45 context 0x0 hint 0xCC

MSRPC: Stub Data

000000A0 C0 EA CC 00 23 00 00 00 00 00 ....#.....
000000B0 00 00 23 00 00 00 5C 00 5C 00 53 00 59 00 53 00 ..#...\.\.S.Y.S.
000000C0 2D 00 4D 00 4F 00 4E 00 2D 00 50 00 52 00 4E 00 -.M.O.N.-.P.R.N.
000000D0 54 00 53 00 56 00 52 00 5C 00 4C 00 65 00 61 00 T.S.V.R.\.L.e.a.
000000E0 72 00 6E 00 69 00 6E 00 67 00 20 00 53 00 75 00 r.n.i.n.g...S.u.
000000F0 70 00 70 00 6F 00 72 00 74 00 00 00 65 00 00 00 p.p.o.r.t...e...
00000100 00 00 00 00 00 00 00 00 00 00 08 00 00 00 01 00 ................
00000110 00 00 01 00 00 00 D8 FC 95 00 1C 00 00 00 A8 49 ...............I
00000120 CA 00 34 FD 95 00 28 0A 00 00 03 00 00 00 00 00 ..4...(.........
00000130 00 00 00 00 00 00 09 00 00 00 00 00 00 00 09 00 ................
00000140 00 00 5C 00 5C 00 4C 00 49 00 42 00 2D 00 31 00 ..\.\.L.I.B.-.1.
00000150 33 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 3...............
00000160 00 00 63 00 61 00 76 00 65 00 6C 00 6C 00 68 00 ..c.a.v.e.l.l.h.
00000170 00 00 ..

This information was captured from all the workstations that had the issue
(the stub data differed from workstation to workstation, but was always one
of four printers). You wrote that opnum #13 was printing, what is opnum #45?

Thanks for help. If you think I am on the right track, or not can you let
me know?

Cheers

Adrian

The clients will keep 1 session open for every application that has called
into the remote spooler. When you say logon is this from a logoff of just
locking the machine? If users lock and leave the application running (which
is very normal) I would expect 3 or 4 open sessions to the print server.
The biggest problems I have had are mobile computers as they move from one
network segment to another and the server attempts to find them at the old
address when sending notification information to the client. But with
service pack 2 rollout the looping client calls has not been an issue.

The next step would be to get a network capture of the packet exchange
between the client and server. Filter for MSRPC packets . Opnum 13 is
RPCwriteprinter so you would see this when the client is printing.


Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

We have about 10 machines on the network with local printers. Some of
these
PC's are seeing the problem, but as far as I can tell no more than any
other
PC. We are running SP2 on our XP machines (SP1 on the 2003 Printserver).
On
all our machines we have the following local printer drivers installed:
Microsoft Office Document Image Writer
PDF995
Xerox Phaser 5400 PCL 5e.

As well as this we have on the Printserver the following drivers:
HP Business Inkjet 2230/2280
HP LaserJet 2100
HP LaserJet III
OKI B6300(PCL6)
OKI C5400(PCL)
Tektronix Phaser 860N by Xerox
Xerox Phaser 5400 PCL 5e
Xerox Phaser 5500N PCL 5e
Xerox Phaser 7300N
Xerox Phaser 8200N

These drivers are used for 18 networked printers.

On top of this the drivers from the local printers have found their way
onto
all the PC's on the network (about 500). If these drivers are not being
used
by the printers, can they still have an adverse affect.

The following are the extra drivers found on the workstations:

Brother HL-1230
Brother HL-2460
HP Color LaserJet 2500 PCL 6
HP LaserJet 4000 Series PCL6
HP LaserJet 6L
HP LaserJet 6P
HP LaserJet Series II
Kyocera FS-1550 / FS-1550A
Kyocera Mita FS-1020D
Kyocera Mita FS-1020D KX
OKI C5200n
Samsung ML-1450 Series PCL 6
Xerox Phaser 5400 PS.

As you can see there are one or two. Whether these drivers came from when
users logged and they 'Automatically search for network folders and
printers'
(which is now unticked) I don't know.

I have a machine next to me that the spool is running at about 90% with 20
threads open and 7 pipes open to the Printserver. All I did was logon.

So what do you suggest? Do I delete the unwanted printer drivers (if that
solves it how do I stop them coming back?).
Can I try a pre-SP2 spoolsv.exe to see how that performs.

Thanks for your help

Adrian Passey

There was a fix in XP SP2 that limits the number of client spooler
asynchronous OpenPrinter calls to the server.

We found in cases for mobile users and slow networks that the client
spooler
would retry the connection before the transport layer could fail or
succeed
and thus wind up looping and piling up a series of these calls to the
server.

You will see an increased # of connections on the server for a specific
client.

On the client, the spooler is looping causing excessive CPU utilization.
Check the client using task manager to verify the number of spooler
threads
running on the client spoolsv.exe process. Normal for none printing
system
with a couple of connected printers will be less than 20 threads.

Are there any local printers defined on the clients? There was also an
issue with some Vendor drivers that caused the spooler to start looping
in
this function.

If you are running SP2 and have some clients with local printers, what
are
the drivers used?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello there,
Since we upgraded our system to XP from 2000 in the summer we have
noticed
that the print spool on some of the workstations (no particular
pattern)
runs
at about 50 - 60%. This activity remains even after the user has
logged
off.
This also affects the Print Server as the \pipe\spoolss does not get
released and therefore over the course of a day the CPU on the server
runs
at
100%. Generally one thing happens before this arises on the
workstations.
Print drivers get downloaded from the server. It doesn't seem to
matter
which drivers are downloaded, but this problem is always preceded by a
printer driver coming from the Print server. Also on occasion if an
application crashes such as word then the pipes are not released
between
the
workstation and server.
Rebooting of the workstation or the restarting of the print spool on
the
workstation resolves this but that doesn't help the user on the very
slow
workstation.
Any ideas? I've tried changing the profiles, changing the print
server,
trying to prevent null connections. None of this has identified the
cause.

Thanks

 

[Alan Morris [MSFT]]

Are there a language monitor associated with the Kyocera 1020-D? I'll
check the 45 opnum call?

If there is some auto configuration UI in the printer properties can you
disable this and see if that stops the issue?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Thanks for the reply.

The last post was very useful and pointed me in the right direction.
Following your suggestion regarding the network capture I found that the
workstations that had this issue were constantly sending information to
the
Printserver that contained references to 4 printers. They were all the
same
model Kyocera FS-1020D. We have a 5th printer of this model, but that has
different firmware. In the capture the interesting part to me was the
following:

MSRPC: c/o RPC Request: call 0x3BE46C opnum 0x45 context 0x0 hint
0xCC

MSRPC: Stub Data

000000A0 C0 EA CC 00 23 00 00 00 00 00 ....#.....
000000B0 00 00 23 00 00 00 5C 00 5C 00 53 00 59 00 53 00 ..#...\.\.S.Y.S.
000000C0 2D 00 4D 00 4F 00 4E 00 2D 00 50 00 52 00 4E 00 -.M.O.N.-.P.R.N.
000000D0 54 00 53 00 56 00 52 00 5C 00 4C 00 65 00 61 00 T.S.V.R.\.L.e.a.
000000E0 72 00 6E 00 69 00 6E 00 67 00 20 00 53 00 75 00 r.n.i.n.g...S.u.
000000F0 70 00 70 00 6F 00 72 00 74 00 00 00 65 00 00 00 p.p.o.r.t...e...
00000100 00 00 00 00 00 00 00 00 00 00 08 00 00 00 01 00 ................
00000110 00 00 01 00 00 00 D8 FC 95 00 1C 00 00 00 A8 49 ...............I
00000120 CA 00 34 FD 95 00 28 0A 00 00 03 00 00 00 00 00 ..4...(.........
00000130 00 00 00 00 00 00 09 00 00 00 00 00 00 00 09 00 ................
00000140 00 00 5C 00 5C 00 4C 00 49 00 42 00 2D 00 31 00 ..\.\.L.I.B.-.1.
00000150 33 00 00 00 00 00 08 00 00 00 00 00 00 00 08 00 3...............
00000160 00 00 63 00 61 00 76 00 65 00 6C 00 6C 00 68 00 ..c.a.v.e.l.l.h.
00000170 00 00 ..

This information was captured from all the workstations that had the issue
(the stub data differed from workstation to workstation, but was always
one
of four printers). You wrote that opnum #13 was printing, what is opnum
#45?

Thanks for help. If you think I am on the right track, or not can you let
me know?

Cheers

Adrian

The clients will keep 1 session open for every application that has
called
into the remote spooler. When you say logon is this from a logoff of
just
locking the machine? If users lock and leave the application running
(which
is very normal) I would expect 3 or 4 open sessions to the print server.
The biggest problems I have had are mobile computers as they move from
one
network segment to another and the server attempts to find them at the
old
address when sending notification information to the client. But with
service pack 2 rollout the looping client calls has not been an issue.

The next step would be to get a network capture of the packet exchange
between the client and server. Filter for MSRPC packets . Opnum 13 is
RPCwriteprinter so you would see this when the client is printing.


Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

We have about 10 machines on the network with local printers. Some of
these
PC's are seeing the problem, but as far as I can tell no more than any
other
PC. We are running SP2 on our XP machines (SP1 on the 2003
Printserver).
On
all our machines we have the following local printer drivers installed:
Microsoft Office Document Image Writer
PDF995
Xerox Phaser 5400 PCL 5e.

As well as this we have on the Printserver the following drivers:
HP Business Inkjet 2230/2280
HP LaserJet 2100
HP LaserJet III
OKI B6300(PCL6)
OKI C5400(PCL)
Tektronix Phaser 860N by Xerox
Xerox Phaser 5400 PCL 5e
Xerox Phaser 5500N PCL 5e
Xerox Phaser 7300N
Xerox Phaser 8200N

These drivers are used for 18 networked printers.

On top of this the drivers from the local printers have found their way
onto
all the PC's on the network (about 500). If these drivers are not
being
used
by the printers, can they still have an adverse affect.

The following are the extra drivers found on the workstations:

Brother HL-1230
Brother HL-2460
HP Color LaserJet 2500 PCL 6
HP LaserJet 4000 Series PCL6
HP LaserJet 6L
HP LaserJet 6P
HP LaserJet Series II
Kyocera FS-1550 / FS-1550A
Kyocera Mita FS-1020D
Kyocera Mita FS-1020D KX
OKI C5200n
Samsung ML-1450 Series PCL 6
Xerox Phaser 5400 PS.

As you can see there are one or two. Whether these drivers came from
when
users logged and they 'Automatically search for network folders and
printers'
(which is now unticked) I don't know.

I have a machine next to me that the spool is running at about 90% with
20
threads open and 7 pipes open to the Printserver. All I did was logon.

So what do you suggest? Do I delete the unwanted printer drivers (if
that
solves it how do I stop them coming back?).
Can I try a pre-SP2 spoolsv.exe to see how that performs.

Thanks for your help

Adrian Passey


:

There was a fix in XP SP2 that limits the number of client spooler
asynchronous OpenPrinter calls to the server.

We found in cases for mobile users and slow networks that the client
spooler
would retry the connection before the transport layer could fail or
succeed
and thus wind up looping and piling up a series of these calls to the
server.

You will see an increased # of connections on the server for a
specific
client.

On the client, the spooler is looping causing excessive CPU
utilization.
Check the client using task manager to verify the number of spooler
threads
running on the client spoolsv.exe process. Normal for none printing
system
with a couple of connected printers will be less than 20 threads.

Are there any local printers defined on the clients? There was also
an
issue with some Vendor drivers that caused the spooler to start
looping
in
this function.

If you are running SP2 and have some clients with local printers, what
are
the drivers used?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello there,
Since we upgraded our system to XP from 2000 in the summer we have
noticed
that the print spool on some of the workstations (no particular
pattern)
runs
at about 50 - 60%. This activity remains even after the user has
logged
off.
This also affects the Print Server as the \pipe\spoolss does not get
released and therefore over the course of a day the CPU on the
server
runs
at
100%. Generally one thing happens before this arises on the
workstations.
Print drivers get downloaded from the server. It doesn't seem to
matter
which drivers are downloaded, but this problem is always preceded by
a
printer driver coming from the Print server. Also on occasion if an
application crashes such as word then the pipes are not released
between
the
workstation and server.
Rebooting of the workstation or the restarting of the print spool on
the
workstation resolves this but that doesn't help the user on the very
slow
workstation.
Any ideas? I've tried changing the profiles, changing the print
server,
trying to prevent null connections. None of this has identified the
cause.

Thanks