Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 6162 Source: Print

The spooler has detected that a component has an unusually large number of open GDI objects. As a result some EMF print jobs might not print until the spooler is restarted.
Generally, restarting the Print Spooler will fix the issue.

Note from MS: We added the 6162 error in Windows Server 2003 SP1 to detect when applications improperly generate EMF files and leak GDI handles as a result.

Log in to the console session and launch task manager. Open Processes Tab -> View -> Select Columns -> Enable GDI Objects. Find the spoolsv.exe process and note the number of GDI objects. Monitor this value over several days. The system defaults to 10000 in any one process. When this limit is reached GDI can no longer allocate resources to render the print job and generates a bogus success error 0. When GDI does this, the spooler will now check if the objects that GDI owns have reached the defined limit and generates event 6162.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.