Flagship Application Analysis

Slow Printing & Print Job Failure TroubleshootingPrepared by: Jean Tunis & Jerry White

Date: 02/11/2014

Riverbed Confidential

Overview

● The purpose of this report is to provide results of troubleshooting the printing issues with the Flagship application, including:– Intermittent slow printing– Print job failure on 01/23/2014

● Results derive from data captured on 12/16/2013 and 01/23/2014

● High-level findings include:– Cause of intermittent issues is due to Remote Procedure Call (RPC)

requests to Print Server being blocked by firewall– Cause of job failure on 01/23 likely due to selected printer not being

reachable or accessible at that time

● Next-step recommendations:– Verify whether Juniper firewall is blocking RPC ports and make

appropriate changes– Review event logs from Print Server for errors to selected printer– Investigate cause of print spooler restarts on Flagship Server

Copyright Riverbed Technology 2

Riverbed ConfidentialCopyright Riverbed Technology 3

Baseline Normal Printing

● 3.5 seconds between scan and print

● Clean network

Riverbed ConfidentialCopyright Riverbed Technology 4

Issue 1: Intermittent Slow Printing

● 45 seconds between scan and print

● Flagship Server tries three times before connecting to Print Server

Riverbed ConfidentialCopyright Riverbed Technology 5

Confirmation Over Time

● Long series of good transactions followed by one slow

● Print spooler restarting triggers slowness during failure

● Restart causes RPC connection for remote print spooling

Successful print jobs

Initial print job failure

Successful print job (42 seconds later)

Riverbed ConfidentialCopyright Riverbed Technology 6

RPC and Endpoint Mapper

● Endpoint Mapper (EPM) request from Flagship Server to get TCP port from Print Server for remote spooling returns port 49160

● This port seems blocked by firewall since Print Server does not receive it

RPC/EPM request and response

Riverbed ConfidentialCopyright Riverbed Technology 7

SYN Packets not arriving in Herc

Rancho

Hercules

Riverbed ConfidentialCopyright Riverbed Technology 8

TCP and EPM Retries

● EPM requests attempted 2 times

● TCP connection to port 49160 attempted 3 times

● TCP connection setup and EPM request retry attempts take over 42 seconds

Riverbed ConfidentialCopyright Riverbed Technology 9

Issue 2: Print Job Failure

● Failed print job at 11:17AM on 01/23

● Flagship Server starts process with OpenPrinterEx

● GetPrinter expected next to continue print job process

● Instead, print spooler is restarting

1. “Create Request File: spoolss” starts print spooling

2. OpenPrinterEx starts print job process

3. Next request should be GetPrinter

4. Print spooler restarts instead

Riverbed ConfidentialCopyright Riverbed Technology 10

Print Job Success

● Successful print job occurs at 12:52PM

● Notice normal communication– No print spooler restart– GetPrinter request sent after OpenPrinterEx

● We do not get this in previous slide

Riverbed Confidential

Print Job Data Sent

● StartDocPrinter to EndDocPrinter requests/responses found when data is sent to printer

● Print job request goes to USHER0800LB23 printer

● USHER0800LB23 may not have been reachable at 11:17AM since nothing printed

Copyright Riverbed Technology 11

Riverbed Confidential

Printing to Other Printer

● At 12:52PM, print job request goes to USHER0800LB22 printer

● What this a manual change?

● No successful jobs found went to USHER0800LB23 at this time

Copyright Riverbed Technology 12

Riverbed Confidential

Conclusions/Recommendations

● Based on the analysis results, we draw the following conclusions:– Cause of printing delay issues is primarily due to firewall blocking of

RPC port– Cause of print job failure may have been due to USHER0800LB23

printer being unreachable at 11:17AM

● Recommend the following to help resolve issues:– Verify Juniper firewall is blocking port 49160 to Print Server

• Telnet to this port from Flagship Server, or• Check firewall configuration data

– If blocking, open firewall for this and other ports• RPC server process port range includes 49152 to 65535• Check out http://support.microsoft.com/kb/154596 for information on

restricting port range, if needed– Investigate causes of print spooler restarts– Check Print Server event logs to look for any communication errors to

USHER0800LB23 printer at 11:17AM on 01/23Copyright Riverbed Technology 13