Remote Downlevel Document and .spl files

pts.
Tags:
DataCenter
Management
Microsoft Windows
OS
Security
Servers
SQL Server
I have been beating my head for the last 5-6 hours, trying to find anyone similar to my problem, but I haven't had much luck. I am having a problem with .SPL files with 0 bytes filling up my spooler directory. These files don't appear all the time, just periodically. But, because I have 700+ users using these file/print servers, their spooler fills up pretty fast. Configuration: I have a few Win2kSP4 file/print server with eTrust 7.1 antivirus within my domain. I have the Real Time AV scanning set to exclude all .SPL and .SHD files and to skip scanning the print spooler directory on both clients and servers. I also have it set on all clients and servers to not to protect floppy, network drives, and CD-ROMS. Observation: I ran FileMon on one of the servers and had it look at the spoolss.exe and the spooler directory. When the print job worked, FileMon shows the print job having the file attributes set to "A" and "D" through out the print, and the file deletes successfully. When the print job leaves the *.SPL file, FileMon shows the attributes to be "RA". Sure enough, when looking at the properties of the file within the spool directory, the file is set to Read-Only. The spool directory is NOT set to read only. These files appear with clients that are XPSP1, XPSP2, and Win2K SP4 PRO. I have scanned one of the server for viruses, but nothing comes up. The signature file is the latest and greatest from Computer Assoc. as of 22 Nov 2005. Any ideas? Thanks for any help and ideas!

Answer Wiki

Thanks. We'll let you know when a new response is added.

Are any of the spool files that could be causing the problem named ‘remote downlevel document”? If so .. check here http://support.microsoft.com/default.aspx?scid=kb;en-us;312015 and here http://support.microsoft.com/default.aspx?scid=kb;en-us;134779 .

It could also possibly be a corrupted print driver which does not actually get removed from the system when you delete a printer from START > SETTINGS > PRINTERS. This technote explains how to manually get rid of the driver so that you can reinstall a new one. http://support.microsoft.com/default.aspx?scid=KB;EN-US;135406

3XLDog

Discuss This Question: 2  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • KeithD1967
    3XLDog, Thanks for the suggestions. And yes, the events corresponding to the spool files do refer to a `remote downlevel document.? I apologize. Before sending the previous message out, I probably should have listed out the KB articles that I viewed. I already looked at 312015, which why I said that I scanned for viruses on the server in the original message. I also looked at 134779. It says it applies to Windows 95 and the only resolution was to upgrade your NT server to 3.51, so I ignored it because I have Win2K SP4 servers. However, I do have one Win95 with this problem, but I also have some Win2K Pro, WinXP SP1 and SP2 that are having this same problem. Other KB articles that I looked at where: 104923, 162447, and 312015, which none of them helped. The last suggestion you gave, though, has food for thought: a corrupted print driver. I will look into this. I suspect that there are a select few PCs that have a corrupted local print driver, because I have other PCs printing to the same printer that do not give me this problem. Also, I do have one Win95 PC that is also causing this `remote downlevel document? problem where its anti-virus is not configured to by-pass scanning for SPL, SHD, local print spooler, and network drives ? hmmmm ? looks like I will have take a look at that one also. Thanks for the help, and I will let you all know what happens. Keith
    0 pointsBadges:
    report
  • KeithD1967
    Thank-you all for taking the time to look at this. This is what my issue was: I had one Win95 PC that was causing 99% of these orphaned .SPL files with 0 bytes. I wasn't able to remotely configure the CA eTrust Anti-Virus setup because the software was originally installed incorrectly. So I reinstalled the software, configured it to exclude RealTime scanning of the local print spool folder and all *.SPL and *.SHD files. After that, no more .SPL files, at least from this PC. It doesn't explain why some WinXP Pro or Win2K Pro PCs cause the .SPL orphaned files, but those are few and far between, which I can live with. Thanks again for taking the time and helping me out. Keith
    0 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following