Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2004 Source: LPRPrintMonitor

Level
Description
Printer <printer name> on host <ip address> is rejecting our request. Will retry until it accepts the request or the job is cancelled by the user.
Comments
 
As per ME223791, the Spooler Service LPR Monitor leaks private bytes each time an Event ID 2004 is logged and every four seconds thereafter until it reconnects to the remote printer.

If print jobs stops responding, (hang) in the print queue for an extended period, see ME249017.

If this event appears as you try to print to a Canon Laser Beam LBP 360 PS printer on a line printer remote (LPR) printer port, see ME182287.

The event appears also if the printer is busy or offline. See MSW2KDB for more details on this issue.
If the error occurs using HP LPR printers the solution could be to disable the bidirectional printing support in every printers. See ME208820 link below.
This event may be caused by problems with the HP JetDirect card. Some JetDirect cards may not be compatible with LPD printing (RFC 1179). The card may need to be updated to a newer version (Firmware Revision 3.03 or above) or improper configuration of the JetDirect card.
From a newsgroup post: "TCP/IP printing in Windows NT SP/3 and higher is RFC 1179 compliant. Basically RFC 1179 says that you can use ports 721-731 for IP printing.  RFC 1179 is governed by RFC1122 which says that once a port is used, that port must then time out for a period of 4 minutes. So, for the sake of this conversation, lets say we get 11 jobs into the print queue at the same time.  Job 1 goes out on port 721, Job 2 on 722, etc.  Once all the ports are use the next job in the queue must wait until the 4 minute time out.  Now one kicker here is that 4 minute timeout does not start until the print job is completely through and to the printer.  So, you could have as much as a 4 minute delay before the next print job can start. Now ME179156 allows you to modify what ports are used for IP printing.  Once you have made the modification suggested in either method 1 or method 2 of the KB article, NT will start using ports above 1024 for printing.  So the chances of you running into that 4 minute time out are fairly slim. How there are two potential drawbacks here.  Once you have made that registry modification, not only are you no longer RFC compliant, but you have pull a throttle out of the system.  You may start seeing more Event 2004's logged into the Application Event log because the printers Buffer becomes full. Please keep in mind that Event ID 2004's are only informational and, in and of themselves, are not a bad thing.  It is only when they are accompanied by print queue hangs that they can be considered a problem."

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...