Jump to content
EduGeek EdSec 2026 is Go! 27th Oct in Derby! Join us for a day of EdTech security focused talks, networking, and an evening social ×

Recommended Posts

Posted (edited)

Hello,

 

This is a script to generate a CSV file based on the EventLog readings(System->EventCode 10 (Successful print)), it will obviously mean you need to alter your EventLogging settings to allow for capturing as many events as you want to log (eg, up the filesize limit / manually delete).

 

I'm not suggesting I wrote much of this and it has a fatal flaw, it doesn't query the TimeGenerated date through WMI, it instead uses a crude comparison - so it's a bit wasteful and could be tweaked, it also relies on all printers are your printserver, it doesn't connect remotely although you could alter the code as necessary.

 

You can alter where you save to, the filename etc in the code - it's not the best code in the world... but it's free and it does do what it is supposed to :-P.

 

See below for code:

 

Private Function GetVBDate(DateTime)  
GetVBDate =  DateSerial(left(DateTime,4),mid(DateTime,5,2),mid(DateTime,7,2))    
End Function  
'get wmi date to vbdate


Dim objFso, objFolder, objWMI, objEvent ' Objects
Dim strFile, strComputer, strFolder, strFileName, strPath ' Strings
Dim intEvent, intNumberID, intRecordNum, colLoggedEvents
dim theDate, startDate, endDate, temp1, temp2
' --------------------------------------------
' Set your variables
intNumberID = 10 ' Event ID Number
intEvent = 1
intRecordNum = 1
strComputer = "."
'alter as necessary
strFileName = "\PrintReport.csv"
strFolder = "C:\PrintReports"
strPath = strFolder & strFileName
startDate = inputbox("Please Enter Start Date (first date of printing) in DD/MM/YYYY format")
endDate = inputbox("Please Enter End Date (last date of printing) in DD/MM/YYYY format")
' ----------------------------------------
' Section to create folder to hold file.
Set objFso = CreateObject("Scripting.FileSystemObject")
If objFSO.FolderExists(strFolder) Then
   Set objFolder = objFSO.GetFolder(strFolder)
Else
  Set objFolder = objFSO.CreateFolder(strFolder)
  Wscript.Echo "Folder created " & strFolder
End If
Set strFile = objFso.CreateTextFile(strPath, True)
'--------------------------------------------
' Next section creates the file to store Events
' Then creates WMI connector to the Logs
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'System'" )
intEvent = 1
strFile.WriteLine "Date, DocName, User, Printer, IP/USB, Pages"

For Each objEvent in colLoggedEvents
If (objEvent.EventCode = intNumberID) Then
theDate = getVBDate(objEvent.TimeGenerated)
theDate = formatDateTime(theDate, vbShortDate)
startDate = formatDateTime(startDate, vbShortDate)
endDate = formatDateTime(endDate, vbShortDate)
if ((theDate >= startDate) AND (theDate <= endDate)) Then
temp1 = theDate&"::"& objEvent.Message
temp1 = replace(temp1, " owned by ","::")
temp1 = replace(temp1, " was printed on ","::")
temp1 = replace(temp1, " via port ", "::")
temp1 = replace(temp1, ".  Size in bytes: ", "::")
temp1 = replace(temp1, "; pages printed: ","::")
temp1 = replace(temp1, ",", "")
temp1 = replace(temp1, "::",",")

temp2 = split(temp1,",")
temp1 = temp2(0)&","&temp2(1)&","&temp2(2)&","&temp2(3)&","&temp2(4)&","&temp2(6)
strFile.WriteLine temp1
intRecordNum = intRecordNum +1
End If
End if
IntEvent = intEvent +1
theDate = ""
Next
Wscript.Echo "Complete, check folder."
WScript.Quit

Edited by dwhyte85

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now



×
×
  • Create New...