Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 4 Source: SpoolerWin32SPL

Level
Description
The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key S-1-5-18\Printers\Connections. The print spooler could not open the registry key. This can occur if the registry key is corrupt or missing or if the registry recently became unavailable.
Comments
 
From "Ars Technica": For Windows Server 2003, post-SP2 installation:

Symptoms: Some network printers published by a Windows 2003 SP2 server will be marked as "offline" and cease to be available. Restarting the spooler will make the printers briefly available (for 30 seconds or so) before they reset to offline status.

Problem: MS has changed the way SNMP-enabled printer are handled in SP2. I don''t have the full detail, but apparently any printer that is marked as SNMP enabled (by the driver, I assume) will REQUIRE (by default) SNMP to be setup correctly and working on both the printer and local server (community names). Never mind if these printer all have SNMP actually disabled.

Solution: On the properties of each printer (on the server), select the "port" tab, local the correct port, click on "configure" and uncheck "SNMP enabled". Once you click "ok" the printer''s status will be instantly turned back to normal.
I had this problem on a vista machine. Somehow two keys where missing, Connections and DevModes2. Creating these two keys cleared the warning.
From a newsgroup post: "I was getting this event on multiple Vista machines. I was printing to "Primo PDF" and the program came up with the default "output.pdf" file name. I clicked on OK and nothing happened (except hearing an error sound in the background). I turned User Account Control off and PrimoPDF created the file for me. (It still could not open my PDF reader after creating the file, but at least the PDF was created). See the link to "How to disable UAC". Turn off at your own risk".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...