SUMMARY: Phantom print job that will not go away.

From: Brett Lymn (
Date: Wed Jun 23 1999 - 19:39:59 CDT

Yesterday I sent out this message:

> I have been trying to track down a problem but the solution is
>just eluding me. I have a server that is emitting these messages
>quite frequently:
>Jun 23 13:39:23 mauxfp1 bsd-gw[16640]: request to MASA (unknown printer) from mauxfp1
>Jun 23 13:40:24 mauxfp1 bsd-gw[16641]: request to MASA (unknown printer) from mauxfp1
>Jun 23 13:41:24 mauxfp1 bsd-gw[16666]: request to MASA (unknown printer) from mauxfp1
>From what I can see I have something that is trying to queue a lpd
>style printjob to the server. It appears that something on the
>machine is trying to do this. I have snooped the network and there do
>not seem to be any requests coming into the machine so the request
>must be local. I have scanned through all the likely /var/spool and
>/usr/spool places but cannot see any job sitting there. The only
>other thing is some software called Cradle was installed on this
>machine. The administrator of Cradle admits to creating a printer
>called MASA but swears he deleted it. Being a trusting soul I had a
>sniff around the Cradle directories but cannot see anything likely
>Has anyone got any suggestions on how I can track this down and kill it?

A few people came up with some helpful suggestions but I had already
checked. Todd Herr was the winner with this:

        Check in /var/spool/print, not /var/spool/lp

        I've run across this a couple of times. It's tied in to
        the printd daemon that gets started up out of /etc/init.d/spc.
        Both printd and spc appear to be undocumented in the man pages,
        and I don't remember how I stumbled across them in the first

        Essentially, what's happened is that somehow an old print job
        or two ended up in /var/spool/print, and the printd daemon is
        trying to complete the request. Kill the printd daemon, clean
        out the /var/spool/print directory, and your troubles should
        go away.

I did as Todd suggested and, sure enough, there was a job spooled by
the cradle admin in /var/spool/print. I have killed that off and the
message has gone away.

Hearty thanks to:

 Todd Herr
 Birger Wathne
 Jeff Newton

Brett Lymn, Computer Systems Administrator, British Aerospace Australia

This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:13:22 CDT