Restart Printer Spooler after a specific error in event viewer

Hi and thank you in advance for looking.

We have an issue with a system we are unable to replicate, which happens maybe once every 6 months or year but if it happened on a weekend when no staff are in the impact is very big.

As we can’t replicate the issue I want to setup a script to restart the printer spooler service on a specific message in event viewer.

It needs to trigger from specific text in the ‘General’ tab as the event ID is 1 but that id is not specific to this issue and would end up the printer spooler restarting a lot unnecessarily.

Please can someone advise what command I can use to restart a service based on specific text please in the ‘general’ tab.

I know how to create a task based on an every and how to restart services etc but can’t find on the internet this specific command i’d need

I trust you have tried configuring the service Recovery for ALL categories including “Subsequent Failures” to “Restart the Service” ?

1 Like

Very sorry Tony I missed your reply, yes I have tried recovery options but as the issue if supplier software and not the service as such it does not show an error or state other than running. However, since this post we have put the onus on the supplier to fix the fault rather than us botching a fix. Also fortunately this has not happened since.

When you say “specific text in the ‘General’ tab” are you referring to the message?

If so, does the message change or is it always the same text?

I’m guessing you’re looking to do this as a Scheduled Task, that searches for the Event on a regular basis and if it finds it, restarts the Spooler service? While that’s one way of doing it, if the event is specific enough (and it might not be, based on your description), you can also right-click an existing event and attached a task to it.

Hi Matt

The message I was trying to use with specifically 1 line within the general tab which is unique but the process/service and ID for this message is the same as others so the right-click an existing event option doesn’t seem feasible but I will go back and have another look thank you

Does the message change though, or is the same for every event logged when this specific error occurs?

The reason I ask is that it will affect how you search for the message.