iPrint fills up Apache Access_log Files
Novell Cool Solutions: Feature
By Andrew Barker
Digg This -
Posted: 24 Aug 2007
SYS volume is being filled up by large Apache access_logs files. The Apache access_log files contain large amounts of iPrint entries.
Example from an Apache access_log file.
10.135.5.222 - - [22/Aug/2007:15:00:22 +1000] "POST /ipp/IPrint-Printer-Name HTTP/1.1" 200 75 10.135.5.219 - - [22/Aug/2007:15:00:22 +1000] "POST /ipp/IPrint-Printer-Name HTTP/1.1" 200 75 10.135.5.156 - - [22/Aug/2007:15:00:22 +1000] "POST /ipp/IPrint-Printer-Name HTTP/1.1" 200 75 10.135.4.124 - - [22/Aug/2007:15:00:22 +1000] "POST /ipp/IPrint-Printer-Name HTTP/1.1" 200 75
Whenever a windows client checks the status of an IPP printer a request is sent to the Apache web server.
Packet captures of the IPP requests to the Apache web server shown the following.
On an XP workstation the following was found:
- Opening Printers and Faxes under the Settings menu will send an IPP request to the Apache server to retrieve the printer status approximately every 45 seconds.
- Opening a printer to monitor the queue status, requests IPP updates from the Apache server every 15 seconds.
Any application that checks the status of an IPrint printers will cause this information to be logged in the Apache access_log file. Applications will check the printer status when the File Print option is opened.
This can be observed by doing a packet capture with Wireshark using a capture filter of port 631 for non SSL printing, and a display filter of ipp. Wiresharp can be downloaded from http://wireshark.org/.
Capture of IPP requests when Print Dialogue box is open in Word XP on Windows XP, no document was actually printed.
Opening a printer window to monitor the job queue will cause IPP requests to be sent to the Apache web server every 15 seconds, even if there are no jobs in the queue. See the times of the IPP requests in the capture below.
Capture of IPP packets when leaving a printer queue window open. Requests are made every 15 seconds. The same results were obtained on both Windows XP and Windows 2K.
The information recorded in the Apache log can be seen in the protocol decode under the HyperText Transfer Protocol. This corresponds to the POST /ipp/IPrint-Printer-Name HTTP/1.1 in the apache access_log file.
The HTTP response from the Apache web server is shown in the decode below, this is the 200 75 in the access_log entry.
Example Access_log entry:
10.135.5.222 - - [22/Aug/2007:15:00:22 +1000] "POST /ipp/IPrint-Printer-Name HTTP/1.1" 200 75 Technical details on the contents of the Apache access_log files can be found on this web page http://httpd.apache.org/docs/2.0/logs.html under the Access Log heading.
As checking the status of printers is normal windows behaviour, it is necessary to either disable logging of HTTP requests or activate log archiving in Apache.
On a NetWare 6.5 server the logging feature of Apache can be managed via the Apache Manager. This is accessible by logging in on the server welcome page http://servername/welcome, then selecting Apache 2.0 under Open Source, the links to Administrator Apache are available under Apache 2.0 Link at the top right of the screen.
Alternatively the Apache Manager can be access directly using the link below. https://server -name or IP:2200/apacheadmin.
Once logged in to the Apache Manager, access the Apache log preferences by clicking on the Server Logs icon, then Log Preferences in the menu.
Client Access request can be turned off (Log Client Access shown in screen capture above) if not required or the Archive setting can be configured to manage archiving/deleting of the log files, see screen capture below.
For full details on Apache for NetWare refer to http://www.novell.com/documentation/oes/web_apache/index.html ?page=/documentation/oes/web_apache/data/bookinfo.html
Novell Cool Solutions (corporate web communities) are produced by WebWise Solutions. www.webwiseone.com