Universal Print Logs and Alerting data reference (Preview)

When the Logs and Alerting feature is enabled, Universal Print streams telemetry into three custom tables in your Azure Monitor Log Analytics workspace. This article describes what each table contains, every field it carries, and how you can use that data in queries, workbooks, and alerts.

For setup, see Set up Universal Print Logs and Alerting.

Table Portal log category What it captures
UniversalPrintPrinterHealth_CL Printer activity A snapshot of a printer's state, health, and identifying metadata, emitted whenever the printer's status changes.
UniversalPrintJob_CL Job Activity A record for each stage in a print job's lifecycle, with job metadata and per-stage timing and configuration details.
UniversalPrintBillingSummary_CL Billing Event A periodic summary of your tenant's print job consumption against your included entitlement.

How to read this reference

  • Type is the Log Analytics column type. dynamic columns hold a structured object; expand or access nested fields with dot notation (for example, PrinterStatusDetails.PrinterState) or parse_json() / tostring() in KQL.
  • Timestamps are in UTC. Use Log Analytics' built-in TimeGenerated column for time-range filters and retention.
  • Optional fields are present only when the underlying value is available. A field may be absent for a given record (for example, job configuration details are only populated once a job completes). Always guard for nulls in queries.
  • Enumerated values use camelCase keywords. New keywords may be added over time, so treat the listed values as representative rather than exhaustive.
  • Standard columns — In addition to the fields documented here, every record carries the standard Log Analytics columns that Azure Monitor adds to all tables, such as TimeGenerated, Type, _ResourceId, and TenantId. These aren't listed in the tables below. See Standard columns in Azure Monitor Logs.

Printer health table — UniversalPrintPrinterHealth_CL

Each row is a point-in-time snapshot of a single printer, emitted when its health or state changes. Use it to monitor printer availability, detect error conditions (such as a paper jam or open cover), and track which printers are accepting jobs.

Columns

Column Type Description
TimeGenerated datetime When the snapshot was generated (UTC). Use for time filtering and to find the latest state per printer.
PrinterId string Stable identifier of the printer in Universal Print. Use as the join/group key when correlating across tables.
PrinterName string Display name of the printer at the time of the event.
LocationInfo dynamic Structured physical location of the printer. See LocationInfo. Useful for grouping health by site, building, or floor.
PrinterDetails dynamic Identity and registration metadata for the printer. See PrinterDetails.
PrinterStatusDetails dynamic The reported printer status — state, state reasons, and whether it's accepting jobs. See PrinterStatusDetails.

LocationInfo object

Describes where the printer is physically located. Individual fields are populated only when the administrator has configured them, so most are optional.

Field Type Description
Organization string Organization the printer belongs to.
Site string Site name.
Building string Building name.
FloorNumber string Floor number.
FloorDesc string Floor description.
FloorGrid string Floor grid reference.
RoomNumber string Room number.
RoomDesc string Room description.
SubUnit string Sub-unit within the location.
LocationDesc string Free-form description of the location.
StreetAddress string Street address.
FullAddress string Full formatted address.
Locality string City or locality.
StateOrProvince string State or province.
Subdivision string Administrative subdivision.
CountryOrRegion string Country or region.
PostalCode string Postal code.
Latitude double Latitude coordinate.
Longitude double Longitude coordinate.
Altitude int Altitude in meters.

PrinterDetails object

Identity and registration metadata for the printer.

Field Type Description
ShareIds string[] Identifiers of the shares that publish this printer.
ShareNames string[] Display names of the shares that publish this printer.
ConnectorIds string[] Identifiers of the connectors that relay jobs to this printer (empty for printers that register directly).
Manufacturer string Manufacturer reported by the device.
Model string Model reported by the device.
RegisteredDateTime datetime When the printer was registered with Universal Print (UTC).

PrinterStatusDetails object

The printer's reported operational status. Use the state and state-reason fields to drive availability dashboards and fault alerts.

Field Type Description
PrinterState string Overall printer state, such as idle, processing, or stopped.
IsAcceptingJobs bool Whether the printer is currently accepting new jobs. A value of false is a strong signal for an availability alert.
PrinterStateMessage string Free-form status message reported by the device.
PrinterStateReasonErrors string[] Conditions classified as errors, such as mediaJam or coverOpen. Typically the basis for actionable alerts.
PrinterStateReasonWarnings string[] Conditions classified as warnings, such as mediaLow or tonerLow. Useful for proactive maintenance.
PrinterStateReasonReports string[] Informational conditions, such as printerReadyToPrint.
LastUpdatedDateTime datetime When the device status was last updated (UTC).

Print job table — UniversalPrintJob_CL

Each row represents one stage in a print job's lifecycle. A single job typically produces several rows as it moves from submission to completion. Use this table to track job volume, measure end-to-end latency, analyze print settings, and detect failed or canceled jobs.

Columns

Column Type Description
TimeGenerated datetime When the lifecycle event was recorded (UTC).
JobLifecycleEvent string The lifecycle stage this row represents. See Lifecycle events. Use to filter to a specific stage or to reconstruct a job's timeline.
JobId string Identifier of the print job. Group rows by JobId to follow a single job across its stages.
PrinterShareId string Identifier of the printer share the job was submitted to.
PrinterShareName string Display name of the printer share the job was submitted to.
PrinterId string Identifier of the physical printer that printed the job. Join to the printer health table on this field.
PrinterName string Display name of the physical printer that printed the job.
CreatedBy string User principal name (UPN) of the user who submitted the job.
CreatedDateTime datetime When the job was created (UTC).
JobState string The job's status at the time of the event. See Job states.
DocumentSizeInBytes long Size of the submitted document in bytes.
ReadyForPrinterDateTime datetime When the job became fetchable by the printer (UTC). Null until the job is ready.
CompletedDateTime datetime When the job reached a terminal state (UTC). Null while the job is still processing.
Details dynamic Per-stage timing and print configuration. See Details. Fields are added as the job progresses, so later events carry the richest detail.

Lifecycle events (JobLifecycleEvent)

Value Meaning
submitted The job was submitted by the user and accepted by the service.
readyForPrinter The job is ready to be picked up by the printer.
acquiredByPrinter The printer has acquired the job and started processing it.
finished The job reached a terminal state. Inspect JobState to distinguish completed, canceled, and aborted jobs.

Job states (JobState)

JobState reflects the job's status when the event was emitted.

Value Meaning Terminal?
pending The job is queued and waiting to be processed. No
paused The job is held (for example, pending release on a pull-print or secure-release queue). No
processing The job is actively being processed or printed. No
stopped Processing has stopped, typically because of a printer condition (such as a jam or being offline). No
completed The job finished successfully. Yes
canceled The job was canceled (for example, by the user or an administrator) before it finished. Yes
aborted The job was ended by the service or device because of an error and did not complete. Yes

The three terminal states — completed, canceled, and aborted — are the final outcome of a job and always appear on a finished lifecycle event. To get a job's outcome, filter to JobLifecycleEvent == "finished" and read JobState. For more detail on why a job reached its state (for example, why it was aborted), inspect the JobStateReasons array in the Details object.

Query the outcome of jobs

Get every job that finished in the last 24 hours, with its outcome:

UniversalPrintJob_CL
| where TimeGenerated > ago(24h)
| where JobLifecycleEvent == "finished"
| project TimeGenerated, JobId, PrinterName, CreatedBy, JobState
| order by TimeGenerated desc

Count completed vs. canceled vs. aborted jobs:

UniversalPrintJob_CL
| where TimeGenerated > ago(7d)
| where JobLifecycleEvent == "finished"
| summarize JobCount = dcount(JobId) by JobState
| order by JobCount desc

List only the jobs that did not complete successfully, with the reason where available:

UniversalPrintJob_CL
| where TimeGenerated > ago(7d)
| where JobLifecycleEvent == "finished" and JobState in ("canceled", "aborted")
| extend Reasons = tostring(Details.JobStateReasons)
| project TimeGenerated, JobId, PrinterName, CreatedBy, JobState, Reasons
| order by TimeGenerated desc

Tip

A single job emits several rows as it moves through its lifecycle. Filtering on JobLifecycleEvent == "finished" (or using arg_max(TimeGenerated, *) grouped by JobId) ensures you count each job's final outcome once rather than counting intermediate states.

Details object

Carries per-stage timing and the job's print configuration. Timing fields accumulate as the job advances; configuration fields are populated when a job completes. All fields are optional.

Timeline

Field Type Description
DocumentUploadedDateTime datetime When the document was uploaded to the service (UTC).
ReleasedDateTime datetime When a held or pull-print job was released to the printer (UTC). Absent for direct-print jobs.
AcquiredByPrinterDateTime datetime When the printer acquired the job (UTC).
DocumentDownloadedDateTime datetime When the printer finished downloading the document (UTC).
PauseReason string Why a job was held at submission — heldForRelease (pull-print or secure release) or taskTrigger. Absent for direct print.
RedirectedFromPrinterId string Identifier of the printer the job was originally submitted to, if it was redirected.
JobStateReasons string[] Detailed reason keywords for the job's state, such as completedSuccessfully. Useful for diagnosing failures.

Print configuration (populated for completed jobs)

Field Type Description
Copies int Number of copies requested.
PageCount int Number of pages in the source document.
MediaSheetCount int Number of physical sheets consumed after applying duplex and pages-per-sheet settings.
ColorMode string color or blackAndWhite. Useful for color-usage reporting.
DuplexMode string oneSided, flipOnLongEdge, or flipOnShortEdge.
Dpi int Print resolution in dots per inch.
Orientation string Page orientation, such as portrait or landscape.
FeedOrientation string Feed orientation, such as longEdgeFirst or shortEdgeFirst.
MediaSize string Paper size, such as A4 or Letter.
MediaType string Media type, such as stationery or envelope.
InputBin string Requested input tray.
OutputBin string Requested output bin.
Finishings string[] Finishing options applied, such as stapleTopLeft.
PagesPerSheet int Document pages printed per physical sheet.
MultipageLayout string Layout used when more than one page is printed per sheet.
Collate bool Whether multi-copy output is collated.
Scaling string Scaling applied, such as auto, shrinkToFit, fill, fit, or none.

Billing summary table — UniversalPrintBillingSummary_CL

Each row is a periodic summary of your tenant's print job consumption for the current billing period. Use it to track usage against your included entitlement and to alert when you approach or exceed it.

Columns

Column Type Description
TimeGenerated datetime When the summary was generated (UTC).
UsedPrintJobCount int Number of billable print jobs consumed in the billing period.
IncludedPrintJobCount int Number of print jobs included in your entitlement for the billing period. Compare with UsedPrintJobCount to gauge remaining capacity.
BillingPeriodStartDateTime datetime Start of the current billing period (UTC).
BillingPeriodEndDateTime datetime End of the current billing period (UTC).

See also

  • Last updated on