DokuWiki

Every once in a while someone prints something excessive, or blatantly non-CS related. You want to know who printed the doc, but the CUPS page at http://cups.cs.wpi.edu:631/printers only says the name is “withheld.”

You can find the origin of a print job by looking in the logfiles of the CUPS server, cups.cs.wpi.edu. Login there and become root so you can read the logfiles, which are stored in the directory /var/log/cups/.

The most recent logs will be named page_log, access_log, and error_log. Older files are compressed and have a number appended, indicating how old they are, i.e., page_log.1.gz, error_log.8.gz. These can be viewed with the command “zless” which will uncompress them and allow you to view them on your terminal, search for text etc.

Look first in the file “page_log” which contains all the print jobs coming from CUPS or IPP printer users. The IPP protocol gives lots of good information on usage, right down to each page printed. Here's a sample:

% cd /var/log/cups
% tail page_log
ps2 hcai 115553 [24/Mar/2016:09:58:55 -0400] 1 1 - csra13-1.cs.wpi.edu Falcons-CCS15.pdf - -
ps2 kfisler 115554 [24/Mar/2016:09:59:17 -0400] 1 1 - 130.215.28.181 (stdin) - -
ps2 kfisler 115555 [24/Mar/2016:09:59:25 -0400] 1 1 - 130.215.28.181 (stdin) - -
ps2 hcai 115556 [24/Mar/2016:09:59:26 -0400] 1 1 - csra13-1.cs.wpi.edu AuthRange-CCS14.pdf - -
ps1 xxiong 115560 [24/Mar/2016:10:28:51 -0400] 1 1 - aslab11.cs.wpi.edu proposal outline - Google Docs - -
ps1 egvaninwegen 115562 [24/Mar/2016:10:31:58 -0400] 1 1 - aslab1.cs.wpi.edu Piagetian.pdf - -
psc-fl1 ghamel 115563 [24/Mar/2016:10:32:22 -0400] 1 1 - ghamel1.cs.wpi.edu hw1-part2-grading.xlsx - -
psc-fl1 ghamel 115568 [24/Mar/2016:10:49:36 -0400] 1 1 - ghamel1.cs.wpi.edu bsts-no-isets.java - -
psc-fl1 ghamel 115568 [24/Mar/2016:10:49:36 -0400] 2 1 - ghamel1.cs.wpi.edu bsts-no-isets.java - -
psc-fl1 ghamel 115568 [24/Mar/2016:10:49:36 -0400] 3 1 - ghamel1.cs.wpi.edu bsts-no-isets.java - -

which shows printouts to ps2 from the users hcai and kfisler; two printouts to ps1 from xxiong and egvaninwegen, and then two printouts to psc-fl1 from ghamel. The ghamel printouts are interesting – despite there being four lines of output, there were only two print jobs. The second one was three pages long, so each page generates a log-line.

If the printer-user was using LPD to access the printer, their jobs will be logged instead in /var/log/cups/access.log. For LPD, we receive much less information – only the IP address from which the print job came. Here's a sample of output from the access.log file:

% cd /var/log/cups
% tail access_log
localhost - - [24/Mar/2016:10:32:22 -0400] "POST /printers/psc-fl1 HTTP/1.1" 200 278 Create-Job successful-ok
localhost - - [24/Mar/2016:10:32:22 -0400] "POST /jobs/115563 HTTP/1.1" 200 275692 Send-Document successful-ok
130.215.28.212 - - [24/Mar/2016:10:37:40 -0400] "POST /printers/ps1 HTTP/1.1" 200 27369675 Print-Job successful-ok
130.215.28.212 - - [24/Mar/2016:10:38:38 -0400] "POST /printers/ps1 HTTP/1.1" 200 136676609 Print-Job successful-ok
130.215.28.212 - - [24/Mar/2016:10:38:40 -0400] "POST /printers/ps1 HTTP/1.1" 200 327470 Print-Job successful-ok
localhost - - [24/Mar/2016:10:48:45 -0400] "POST /printers/ps1 HTTP/1.1" 200 360 Create-Job successful-ok
localhost - - [24/Mar/2016:10:48:45 -0400] "POST /jobs/115567 HTTP/1.1" 200 6659286 Send-Document successful-ok
localhost - - [24/Mar/2016:10:49:36 -0400] "POST /printers/psc-fl1 HTTP/1.1" 200 270 Create-Job successful-ok
localhost - - [24/Mar/2016:10:49:36 -0400] "POST /jobs/115568 HTTP/1.1" 200 122518 Send-Document successful-ok
130.215.28.212 - - [24/Mar/2016:10:52:40 -0400] "POST /printers/ps1 HTTP/1.1" 200 501560 Print-Job successful-ok

The access log is just like the access log for a webserver, which isn't surprising since CUPS is built on top of a webserver and communicates like one. Requests coming in from “localhost” are IPP printouts and should be described in the page.log, the logfile described above. But log-lines that come with an IP address (130.215.28.212 in this example) are LPD based print requests. There's one print-job per line. The large number just before “Print-Job sucessful-ok” is the size of the print job.

You don't get a username with LPD jobs the way you do with IPP/CUPS jobs, but knowing the IP address of the machine that the job came from is a lot better than nothing. If you know the IP address you could go to /var/log/samba on cs.wpi.edu and check to see if there's a samba-log for that IP address–you might be able to determine the machine's user that way.

If you've looked in both the page log and the access log files and you've found nothing, look in the error log, which should contain only information about failures to print, filter failures, and the like. You may find some clue there.