sc302, on 22 February 2013 - 21:53, said:
I just printed out a 2.9MB pdf. Watching the spooler it was a 800+MB raw file being printed. You can easily see that if I were to print that over the internet it would take a lot of bandwidth and it would take forever to print on a slow connection.
Does he print to the printer there, is that were you are seeing this or does he print to his printer next to him and that is where you are seeing it?
If he is printing next to him through a remote desktop connection or someone is send him a job over the internet, oh yes it will take every bit of that and is absolutely no surprise to me. Just think, how many times I would have to print that to reach your total...maybe 8 copies?
The only way around that is to compress it and get it to spool locally.
I'm telling you it's not that easy. If he prints it's going to be to the printer next to him, not over the VPN back to the main office. We can monitor how much and where the data is going from meraki. 2 days he sent 13.13 gb over the VPN. 11.26gb of that was to the print server, and he's not printing anything. Definetly not any books! The rest of the 1.87gb is email, VOIP phone, and file sharing...
sc302, on 22 February 2013 - 22:12, said:
Ok, if you aren't printing, how are you monitoring this on your network? Ignore the above if you are sure the end users aren't printing.
"The spoolsv.exe file is located in the folder C:\Windows\System32. In other cases, spoolsv.exe is a virus, spyware, trojan or worm!"
Could be something not nice.
Meraki gives you a lot of information on what is going on, on your network. I can look at how much file sharing is going on, what computers are sending a lot of data and to who. They've got graphs and everything.. I noticed a lot of data going across the VPN from one user, I look and see most of the data is going to our print server. On our print server (Windows 2008), I went to Performance Monitor and you can drill down to what process is using the network. I did that and found it was spoolsv.exe.
It's defenetly not a virus... (On the server anyway, it's a brand new build).
The only thing I found so far was that it's possibly a corrupt printer install. I'm going to attempt to reinstall the printers sometime this week. Here is where I found some more information.
It's not causing any CPU usage problem...