MFD - Data Privacy Log Collection
Kofax Technical Support may need to request, on a case-by-case basis, originals and/or copies of customer data in order to troubleshoot, identify, and resolve customer reported support cases. This data may be requested in the form of original paper documents, compressed images, or server logs. Regardless of the format, we recognize that customer data may be of a personal, proprietary, confidential, or otherwise sensitive nature.
Should the customer choose to redact or sanitize data information requested by Kofax Technical Support, it may impair or prevent a satisfactory resolution.
For more information on Kofax’s customer data policies and practices you may click here:
https://knowledge.kofax.com/General_Support/Support_Details/002-Customer_Data_Policies_and_Practices
ControlSuite Common Components Logs
Install Assistant Logs
The log contains the following sensitive information
- Current logged in user
- Server Name
- Install Path
- Install Account Windows Profile Path
Syntax Example:
InstallAssistant.log
- Common","file":"Configure/ControlSuite.prerequisites.json","log":"C:\\Users\\svcmb_cs\\AppData\\Local\\Temp\\Prereq20210928065006.log","elapsed":35372,"status":"fail"}}
Install_component.log
- MSI (s) (94:AC) [19:33:55:424]: SHELL32::SHGetFolderPath returned: C:\Users\svcmb_cs\AppData\Roaming
- MSI (s) (94:AC) [19:33:55:431]: SHELL32::SHGetFolderPath returned: C:\Users\svcmb_cs\Favorites
- MSI (s) (94:AC) [19:33:55:437]: SHELL32::SHGetFolderPath returned: C:\Users\svcmb_cs\AppData\Roaming\Microsoft\Windows\Network Shortcuts
- MSI (s) (94:AC) [19:33:55:442]: SHELL32::SHGetFolderPath returned: C:\Users\svcmb_cs\Documents
- MSI (s) (94:AC) [19:33:55:448]: SHELL32::SHGetFolderPath returned: C:\Users\svcmb_cs\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
- MSI (s) (94:AC) [19:33:55:454]: SHELL32::SHGetFolderPath returned: C:\Users\svcmb_cs\AppData\Roaming\Microsoft\Windows\Recent
- MSI (s) (94:AC) [19:33:55:459]: SHELL32::SHGetFolderPath returned: C:\Users\svcmb_cs\AppData\Roaming\Microsoft\Windows\SendTo
- MSI (s) (94:AC) [19:33:55:464]: SHELL32::SHGetFolderPath returned: C:\Users\svcmb_cs\AppData\Roaming\Microsoft\Windows\Templates
- MSI (s) (94:AC) [19:33:55:470]: SHELL32::SHGetFolderPath returned: C:\ProgramData
- MSI (s) (94:AC) [19:33:55:476]: SHELL32::SHGetFolderPath returned: C:\Users\svcmb_cs\AppData\Local
- MSI (s) (94:AC) [19:33:55:481]: SHELL32::SHGetFolderPath returned: C:\Users\svcmb_cs\Pictures
- Property(N): LogonUser = svcmb_cs
- Property(N): ComputerName = CAN-MB-007
Config Assistant Logs
The log contains the following sensitive information
- Server Name
- Security Framework Username
Syntax Example:
ConfigurationAssistant-<dateandtime>.log
- [2021-08-12 17:21:10.004] [9] [Information] [NDI.Logging.Provider.Trace.TraceLogger.<>c.<.cctor>b__13_4] SF-Root-Correlation-Id: f4afc438-676a-441f-a001-5fb13c5c975f.SF-Root-Attempt: 1.SF-Root-Request-Type: ClientToService.SF-Source-User-Name: username.SF-Source-User-Domain: domain.SF-Source-Datacenter-Id: a43c3e6b-57a4-4313-87b3-5258c24b2d9f.Datacenter-Id: a43c3e6b-57a4-4313-87b3-5258c24b2d9f.SF-Destination-Service-Id: .SF-Destination-Service-Name: v1-service.SF-Destination-Service-Namespace: .SF-Destination-Service-Is-Local-DC: true.SF-Request-Id: dfa3901d-d52c-4136-99d1-7b1075e2ad8f:GET https://can-jd-003.kofax.local:8281/SecurityFrameworkService/services/services/secure/name/v1-auth
- [2021-08-12 17:19:09.303] [8] [Information] [ComponentsProviderCore.Security.SecurityFrameworkHelper.GetSecureFactory] Creating SecureFactory with adminuser=domain\username
Security Framework
The logs contains the following sensitive information
- Security Framework Username
- Security Framework URL
- IP Addresses
- Username
CassandraSetup.log
- vvv CassandraSetup, Version=1.4.3.0, Culture=neutral, PublicKeyToken=null vvv'[][][EventId.Id=0, EventId.Name=]
- [INFO][2021-11-29 14:14:25.7845][1][][][CassandraSetup.Program][InitLog][0] 'User name: "KOFAX\JDOE", System: False'[][][EventId.Id=0, EventId.Name=]
- [INFO][2021-11-29 14:14:42.5556][1][][][NDI.DDBServices.Implementations.CassandraNodeService][WaitForNodeStatus][0] 'Waiting for node (12.3.0.120) status...'[][][EventId.Id=0, EventId.Name=]
SecurityFrameworkService.log
- [INFO][2022-01-25 19:45:29.7666][39][][][Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker][ExecutedAction][0] 'Executed action SsdService.Controllers.ServiceController.CreateService (SsdService) in 87.7761ms'[RequestId:0HMF0AEMJ47KB RequestPath:/v1/services/services,SF-Afferent-Root-Correlation-Id: f283cf9a-213d-4617-b7dc-9f3eaddd76a6,SF-Afferent-Root-Attempt: 1,SF-Afferent-Root-Request-Type: ClientToService,SF-Afferent-Source-User-Name: username,SF-Afferent-Source-User-Domain: domain,SF-Afferent-Source-Datacenter-Id: a43c3e6b-57a4-4313-87b3-5258c24b2d9f,SF-Afferent-Destination-Service-Id: 623ff1b4-cf65-4709-af86-59d56141d195,SF-Afferent-Destination-Service-Name: v1-service,SF-Afferent-Destination-Service-Namespace: ControlSuite,SF-Afferent-Destination-Service-Is-Local-DC: true,SF-Afferent-Request-Id: e33d9356-ca81-45cb-914e-91ebbf35b93b,SsdService.Controllers.ServiceController.CreateService (SsdService)][][EventId.Id=2, EventId.Name=]
- [INFO][2022-01-25 19:45:29.8326][52][][][Microsoft.AspNetCore.Hosting.Internal.WebHost][RequestStarting][0] 'Request starting HTTP/1.1 GET http://can-jd-002.Kofax.local:8231/SecurityFrameworkService/services/services/nonsecure/name/aa '[RequestId:0HMF0AEMJ47KD
Datacenter: a43c3e6b-57a4-4313-87b3-5258c24b2d9f
=================================================
Status=Up/Down
|/ State=Normal/Leaving/Joining/Moving
-- Address Load Tokens Owns (effective) Host ID Rack
UN 10.3.2.17 569.19 KiB 256 100.0% e1b66791-be22-4a04-a0f0-87b5565158aa rack1
Debug.log
- DEBUG [StorageServiceShutdownHook] 2022-01-26 20:12:14,451 StorageService.java:2405 - Node /10.0.3.87 state shutdown, token [-1026074838176560313, -1034647643131892278, -1141530662557155054, -1187128527279738864, -1231366766622846618, -1255023259168656694, -1280984615630280284, -1478056911350847188, -1508768816805868860, -1545757949982713722, -1599074798423233932, -1606676405754110603,
- INFO [main] 2022-01-27 11:53:27,881 CassandraDaemon.java:490 - Hostname: CAN-JD-007
System.log
- INFO [main] 2021-08-05 13:26:47,816 Config.java:495 - Node configuration:[allocate_tokens_for_keyspace=null; authenticator=PasswordAuthenticator; authorizer=CassandraAuthorizer; auto_bootstrap=true; auto_snapshot=false; back_pressure_enabled=false; back_pressure_strategy=org.apache.cassandra.net.RateBasedBackPressure{high_ratio=0.9, factor=5, flow=FAST}; batch_size_fail_threshold_in_kb=50; batch_size_warn_threshold_in_kb=5; batchlog_replay_throttle_in_kb=1024; broadcast_address=null; broadcast_rpc_address=10.0.3.87;
Licensing Logs
The log contains the following sensitive information
- Server Name
- IP Address
flexnetls.log
- 12:34:04,340 INFO [DRE.CAN-JD-007.kofax.local] Successfully handled request for feature eq_tool_print_release 1.0 count=1 correlationID=4e015be1-f598-4c8b-acbb-9e4202f2f45c.
access_####_##_##.request.log
- fe80:0:0:0:ece1:5ce2:d163:2c5d%6 - - [26/Jan/2022:00:58:58 +0000] "GET /api/1.0/instances?page=0&size=20 HTTP/1.1" 200 668 236
Print Job Submission Logs
- The log contains the following sensitive information
- Server Name
- Username
- Domain Name
PrintJobSubmissionService.log
- [TRACE][2022-01-28 12:02:09.8644][4][][][Ndi.ClientSide][Log][0] 'GET https://can-mb 007.kofax.local:8221/SecurityFrameworkService/services/services/nonsecure/name/aa'[SF-Root-Correlation-Id: 729e02c2-29e6-47c0-8249-8da056e4bcd9,SF-Root-Attempt: 1,SF-Root-Request-Is-Infrastructure: true,SF-Root-Request-Type: GetAaSigningCertificates,SF-Source-Client-Id: 4164282b-f52f-0976-9115-58bce1a6de09,SF-Source-Client-Name: printjobsubmission,SF-Source-Datacenter-Id: a43c3e6b-57a4-4313-87b3-5258c24b2d9f,Datacenter-Id: a43c3e6b-57a4-4313-87b3-5258c24b2d9f,SF-Destination-Service-Id: ,SF-Destination-Service-Name: v1-service,SF-Destination-Service-Namespace: ,SF-Destination-Service-Is-Local-DC: true,SF-Request-Id: f3a40329-f01c-4565-82aa-a1fa313b7e0e][][EventId.Id=0, EventId.Name=]
- UserPrincipal: JDoe
- Domain: KOFAX
Print Job Management
The log contains the following sensitive information
- Server Name
- User Name
Pjm.log
- [WARN][2021-12-31 15:31:21.3835][18][][][EquitracPrintJobProvider.Authentication.CASFilterBuilder][GetListUserExSearchParams][0] 'Authentication parameters ignored: 'can-mb-002.kofax.local' 'equitrac' 'john.doe''[RequestId:0HMECJELLP9VH RequestPath:/v1/printjobmanagement/printJobs,SF-Afferent-Destination-Service-Id: 28274b54-08e3-4520-a9ae-7436ee5b7b13,SF-Afferent-Destination-Service-Is-Local-DC: true,SF-Afferent-Destination-Service-Name: v1-printjobmanagement,SF-Afferent-Destination-Service-Namespace: ControlSuite,SF-Afferent-Request-Id: b7d9ee2f-0fc7-441e-9056-7b9fb15b96cf,SF-Afferent-Root-Attempt: 1,SF-Afferent-Root-Correlation-Id: ClientToService,SF-Afferent-Source-Client-Id: 87aca4f5-f1ae-61c8-4f9f-90458140abc2,SF-Afferent-Source-Client-Name: DCE,SF-Afferent-Source-Datacenter-Id: a43c3e6b-57a4-4313-87b3-5258c24b2d9f,NDI.PrintJobManager.Controllers.PrintJobsController.GetPrintJobs (PrintJobManagementService)][][EventId.Id=0, EventId.Name=]
- [WARN][2022-02-01 11:56:01.0860][11][][][EquitracPrintJobProvider.Authentication.AuthenticationProvider][EquitracPrintJobProvider.Adapters.IAccountManagerAdapter.ListUsersEx][0] 'No users found: 'can-mb-002.kofax.local' 'AccountManager.ListUsersEx!<ArrayOfFilterBase><FilterBase p2:type="Filter_String_Equals" xmlns:p2="http://www.w3.org/2001/XMLSchema-instance"><type>3</type><columnname>Name</columnname><filtertotalitemcount>-1</filtertotalitemcount><quotedvalue>"john_doe"</quotedvalue><ignorecase>0</ignorecase></FilterBase></ArrayOfFilterBase>!<ArrayOfSortOrderEntry></ArrayOfSortOrderEntry>!0!1' '[][][EventId.Id=0, EventId.Name=]
Document Transform Service
The log contains the following sensitive information
- Server Name
- Document Information
OMDTS\log.log
- 1/13/2022 6:22:14 AM: [Information] AddAuthentication: serviceName='v1-service' serviceUrl='https://9wt58h2.kofax.com:4181/SecurityFrameworkService'
TS-NT AUTHORITYSYSTEM.log
- APP1011I Host Name: 9ET78H2
- XPS2017E Missing text item 'Test', since font 'ArialMT' is not found
Device Management Service
The log contains the following sensitive information
- URL Addresses
DMService.log
[INFO][2021-11-29 12:07:15.0643][3][][][Microsoft.AspNetCore.Hosting.Internal.WebHost][RequestStarting][0] 'Request starting HTTP/1.1 GET http://localhost/DeviceManagement/ '[RequestId:0HMDJBAOIL64P RequestPath:/][][EventId.Id=1, EventId.Name=]
AutoStore Logs:
AutoStore_Batch
The log contains the following sensitive information
- usernames
- IP addresses (Server, Device, Host, Client)
- Hostnames (Server, Device, Host, Client)
- Server name
*Batch logs derive from command line execution may contain the same information captured above
Syntax Example:
- AutoCapture: Processing request: <ACRequest><Name>CheckLicense</Name><UserName>KOFAX\john.doe</UserName><ComputerName>CAN-JD-TMP</ComputerName><CID>113</CID></ACRequest>...
- Unified Client: Preparing to receive job from MFP: 10.13.25.31
- Web Capture: WCF: HTTP endpoint has been opened: http://cs-01.cs.local:3291/NsiAsWccMobile
AutoStore_<TaskName> Please Note, there will be a separate log for each task in the configuration.
The log contains the following sensitive information
- usernames
- IP addresses (Server, Device, Host, Client)
- Hostnames (Server, Device, Host, Client)
- Server name
- Document Names
Syntax Example:
- Unified Client: Replacing RRT ~UFD::Sender~ with value: Admin
- Unified Client: Replacing RRT ~UFD::User,%displayName%~ with value: Admin
- Unified Client: Replacing RRT ~UFD::User,%uuid%~ with value: b9e63bd4-b2c6-419e-9716-2703336b46c8
- Unified Client: Replacing RRT ~UFD::IP~ with value: 10.27.54.287
- Unified Client: Replacing RRT ~UFD::HostName~ with value: 10.228.61.237
- Unified Client: Replacing RRT ~UFD::ServerIP~ with value: 10.273.132.28
- Unified Client: Replacing RRT ~UFD::Sender~ with value: jdoe
- Unified Client: Replacing RRT ~UFD::SenderEmail~ with value: jdoe@kofax.com
- Unified Client: Replacing RRT ~UFD::User,%displayName%~ with value: Doe, Joe
- Unified Client: Replacing RRT ~UFD::User,%uuid%~ with value: 9d6559f5-5a42-4ead-b94d-eac25fcc1dce
- Unified Client: Replacing RRT ~UFD::IP~ with value: 191.165.332.144
- Unified Client: Replacing RRT ~UFD::HostName~ with value: 191.138.65.4
- Unified Client: Replacing RRT ~UFD::DeviceType~ with value: Kofax
- Unified Client: Replacing RRT ~UFD::ServerIP~ with value: 194.147.263.484
- Unified Client: Replacing RRT ~UFD::ServerHostName~ with value: 193.146.252.124
ASGSB Service.log
The log contains the following sensitive information
- usernames
- Hostnames (Server, Device, Host, Client)
- Server name
Syntax Example:
- # Computer Name: CBI-BR87-WH-12.cbe-01.local
- ASMPProtocol.cpp(2075): iProtocol::_MsqHello: Client logon: Application 'AutoStore', Instance 'AutoStore', Machine 'CBI-BR87-WH-12', Account 'CBI-03\CBI-BR04-WH-12$
ASMPDisplay-Main.log
The log contains the following sensitive information
- Hostnames (Server, Device, Host, Client)
Syntax Example:
- Computer Name: wins2017d.kdi.local
AutoStore Licensing
The log contains the following sensitive information
- Server name
- Server ID
Syntax Example:
getLicenselog
- <GET>=https://wins2019d.kdi.local:44840
- ServerId=VMware4217d7423364de339aad00f356ac6d032151060897l
setLicenselog
- ServerId = VMware4217d7423364fe339aad00f366ac6d044168070897l
QuickCapture Pro – AutoCapture ACC – AutoCapture Explorer
The log contains the following sensitive information
- Hostnames
Syntax Example:
- Computer Name: CAN-JD-TMP.kofax.local
- 085B643C: 3C 00 41 00 43 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 3E 00 3C 00 4E 00 61 00 6D 00 65 00 <.A.C.R.e.q.u.e.s.t.>.<.N.a.m.e.
- 085B645C: 3E 00 47 00 65 00 74 00 41 00 43 00 4D 00 65 00 6E 00 75 00 73 00 3C 00 2F 00 4E 00 61 00 6D 00 >.G.e.t.A.C.M.e.n.u.s.<./.N.a.m.
- 085B647C: 65 00 3E 00 3C 00 55 00 73 00 65 00 72 00 4E 00 61 00 6D 00 65 00 3E 00 41 00 53 00 47 00 41 00 e.>.<.U.s.e.r.N.a.m.e.>.A.S.M.A.
- 085B649C: 52 00 44 00 5C 00 74 00 61 00 6E 00 69 00 61 00 2E 00 62 00 61 00 72 00 7A 00 6D 00 65 00 68 00 R.D.\.j.o.e....d.o.e.
- 085B64BC: 72 00 69 00 3C 00 2F 00 55 00 73 00 65 00 72 00 4E 00 61 00 6D 00 65 00 3E 00 3C 00 43 00 6F 00 r.i.<./.U.s.e.r.N.a.m.e.>.<.C.o.
- 085B64DC: 6D 00 70 00 75 00 74 00 65 00 72 00 4E 00 61 00 6D 00 65 00 3E 00 57 00 41 00 54 00 2D 00 54 00 m.p.u.t.e.r.N.a.m.e.>.W.A.T.-.T.
- 085B64FC: 42 00 2D 00 54 00 4D 00 50 00 3C 00 2F 00 43 00 6F 00 6D 00 70 00 75 00 74 00 65 00 72 00 4E 00 B.-.T.M.P.<./.C.o.m.p.u.t.e.r.N.
- 085B651C: 61 00 6D 00 65 00 3E 00 3C 00 43 00 49 00 44 00 3E 00 31 00 31 00 39 00 34 00 3C 00 2F 00 43 00 a.m.e.>.<.C.I.D.>.1.1.9.4.<./.C.
Webcapture
The log contains the following sensitive information
- usernames
- Hostnames (Server, Device, Host, Client)
- Server name
Syntax Example:
WebCaptureError
- Client IP: 10.2.0.390
- Referer: http://can-jd-tmp:3290/ASWCCapture/default.aspx
WebCaptureTrace
- Information, Preparing Job: [Job Id: 5f95df7c-4adb-4815-863d-e2641643eef8, Form Id: 4e66cd17-284b-4a13-810f-7b7c4cca0669, User: [NSi.AutoStore.WebCaptureSite.WebCaptureWcfService.UserInfo], Client Address: 10.209.97.39, Server Address: 10.214.0.155, Server Host Name: AUHASW02AWSP, Field Data: AUSASW02AWSP]
DRS
The log contains the following sensitive information
- usernames
- IP addresses (Server, Device, Host, Client)
- Hostnames (Server, Device, Host, Client)
- Server name
Syntax Example:
ActionError
- Machine: SJ01APTV32188
ActionTrace
- Information, Thread: 13, Job: 0b6b85cf-ab89-42aa-aafd-4a18cc08a013, Device Type Id: 6, Address: 10.183.191.25, Application Profile: Kofax - Nord, Device: ARH-PRN002, Action: Add
ClientError
- MachineName : VIR3S0MPS30A31
- WindowsIdentity : HCS\srvPS0NPS30NOM ConfigurationTrace
- Username
ConfigurationTrace
- Thread Identity: 'domain\username'
PluginError
- Message: Kofax -> The responses status code is not successful from asset request for device 10.189.52.40 on primary DWS : 10.30.248.173
- Message: Kofax -> The responses status code is not successful from asset request for device 10.181.189.101 on primary DWS : xyz.corp.kofax.com
- Machine: NRCXPRNP01
- Error, Kofax -> Cannot perform action Add on device 10.1.139.53, error: com.nuance.docimg.dws.core.devicelifecyclemanager.DeviceInstanceException: failed to create device instance or get serial number for 10.1.109.53
- Error, Kofax - Unable to connect to device: 10.31.184.5
PluginTrace
- Error, Cannot get Status on device 10.243.32.140: Object reference not set to an instance of an object
- Error Message : Trace: RAGetXletInfo(10.245.34.245, 33956099). jRXOPWrap.GetXletInfo. ERRMSG: GetXletInfo: [10.245.33.245] Product 33956099 not installed.
- JSON_CONFIG_DATA={"deviceType":"Kofax","dwsServerList":[{"type":"DWSEndpointType","serverAddress":"10.36.248.473","port":8434,"useSSL":true,"trustSelfSignedCertificates":true},{"type":"DWSEndpointType","serverAddress":"10.24.160.68","port":8434,"useSSL":true,"trustSelfSignedCertificates":true}],"serverEndpoints":[{"type":"AutoStoreEndpointType","serverAddress":"10.247.125.26","port":3210,"useSSL":false,"trustSelfSignedCertificates":false},{"type":"EquitracEndpointType","serverAddress":"10.36.248.573","port":2539,"useSSL":true,"trustSelfSignedCertificates":true,"pinCertificates":false},{"type":"EquitracEndpointType","serverAddress":"10.24.160.68","port":2539,"useSSL":true,"trustSelfSignedCertificates":true,"pinCertificates":false}],"appName":"Print and Scan","logonScreen":"logon","overwriteAuthAgent":true,"cardReaderConfig":{"pid":"9CAA","vid":"13AD"}}
ServiceTrace
- Information, WCF Primary Identity: 'CORP\svc-fr-jdcas01', Windows Identity: 'CORP\svc-fr-cscas01', Thread Identity: 'CORP\svc-fr-cscas01', UI Culture: en, Culture: en.
- Information, Starting Web Service at: http://KOFFAXDREDCE01:8753/DeviceManagementService/
Business Connect - AdminTool, ConfigurationManager, MobileServer and SupportService logs have similar messaging
The log contains the following sensitive information
- usernames
- Hostname
- Server name
Syntax Example:
- MachineName : SMUKOFC9566
- WindowsIdentity : KOF\ayw7014
- Message : Cannot open database "nbebb" requested by the login. The login failed. Login failed for user 'NT AUTHORITY\SYSTEM'.
PanelErrorLogs & PanelTraceLogs (Konica, Xerox, Canon, etc.,)
The log contains the following sensitive information
- Hostname
- Device IP's
Syntax Example:
- Machine: <hostname>
- Information, 10.208.98.39, Successfully cleared user session.
OpenAPISDK1
The log contains the following sensitive information
- Device IP's
Syntax Example:
- SDKBaseLibrary 10.13.228.12 2928 TCP Session Open
InstallLog_<Date/Time>
The log contains the following sensitive information
- usernames
Syntax Example:
- PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Users\<username>\
Equitrac Logs
The log contains the following sensitive information
- usernames
- Server name
Syntax Example:
CAS log
- [TRACE][2022-01-18 10:47:40.515][0x000015f8][0x00000d70][EQCASMiscSubSystem::eqExecSQLQuery][0]'strSQLQuery='SELECT DISTINCT systemhostname FROM cas_installedsoftware WHERE systemname ='CASServer.domain.com''.'
- [TRACE][2022-01-18 10:47:42.121][0x00001630][0x00000f80][EQCASTransactionSubSystem::eqAssertTrxAccountInfo_Validate_CAS][0]'Account Name='equser'.'
- Line 4514: [TRACE][2022-01-18 10:48:42.776][0x00001618][0x00000694][EQCASTransactionSubSystem::eqAssertTrxDeviceInfoByID][0]'stDeviceInfo.strDeviceName=EMB Device at equitrac-mfp-2.domain.com'.'
DCE log
The log contains the following sensitive information
- IP addresses (Server, Device, Host, Client)
- Hostnames (Server, Device, Host, Client)
- Server name
Syntax Example:
- [TRACE][2022-01-18 10:48:42.248][0x00000b04][0x00014aec][NDI::ClientCommunications::ServiceFinder::Find][31]'Returning cached result for /services/services/secure/name/v1-eqcas/host/CASServer.domain.com/namespace/Equitrac'
- [TRACE][2022-01-18 10:48:42.242][0x00000b04][0x00014aec][DCEDeviceResourceProviderLocal::getValuesfromCache][0]' Device IP Address = 10.533.295.211'
DCE WEDP
The log contains the following sensitive information
- usernames
- IP addresses (Server, Device, Host, Client)
- Server name
Syntax Example:
- [TRACE][2022-01-20 14:28:45.537][0x0000101c][0x00000000][DCE_JobServicesHelperPJMImpl::getAllJobsForUser][0]'Input params:Authenticated account='equser';Delegators=0;Job filter=specified;DRE list=unspecified
- [INFO ][2022-01-20 14:18:36.113][0x0000101c][0x00000000][DCE_JobServicesHelperPJMImpl::getJobsFromPJM][0]'PJM Job_0details: '{
- "printJobId": "equitrac:https://vm000004691.kofax.net:2934/3848377656",
- [TRACE][2022-01-20 14:14:54.634][0x00002290][0x00000000][DCEWEDPUserOperations::Logout][0]'Doing housekeeping for logout of user [c972987] / [usr] from device [10.73.198.61]'
DME Log
The log contains the following sensitive information
- Server name
Syntax Example:
- [TRACE][2022-01-18 10:47:52.924][0x00000664][0x00000000][NDI::ClientCommunications::ServiceFinder::TraceFoundServices][107]'local v1-eqcas at https://CASServer.domain.com:2910/'
DRE log
The log contains the following sensitive information
- usernames
- Hostnames (Server, Device, Host, Client)
- Server name
Syntax Example:
- [TRACE][2022-01-18 10:48:23.477][0x00002f20][0x00000000][NDI::ClientCommunications::ServiceFinder::Find][31]'Returning cached result for /services/services/secure/name/v1-eqcas/host/CASServer.domain.com/namespace/Equitrac'
- [TRACE][2022-01-18 10:48:23.457][0x00002f20][0x00000000][EqDRECASManager::ValidateTransaction][0]'Looking for pending transactions of the account [domain\equser]'
- [TRACE][2022-01-18 10:48:35.929][0x00001da4][0x00000000][][0]'[EqDREPrinterStatus::SetWindowsPrinterStatus] \\DREServer\prn-2: Device Status (unknown), Printer Status (unknown), Detected Error State ().'
SLP Log
The log contains the following sensitive information
- usernames
- IP addresses (Server, Device, Host, Client)
- Hostnames (Server, Device, Host, Client)
- Server name
Syntax Example:
- [TRACE][2022-01-18 10:47:42.172][0x00001338][0x00000000][slpLogDebug][25]'Peer IP address: 185.73.224.293, Header: version = 2, functionid = 2, length = 108, flags = 0, extoffset = 0, xid = 14125, langtag = en'
- [TRACE][2022-01-18 10:48:23.534][0x00001338][0x00000000][slpLogDebug][25]'Message SRVREG: service-url = service:printjobs.equitrac:storage:xps:https://EQDREServer.domain.com:2334/ACCOUNTID/block1, scope = bolten.uia.no, attributes = (ACCOUNTID=#,Equser1,EQUser2,EqUser3)'
SPE log
The log contains the following sensitive information
- Server name
Syntax Example:
- [TRACE][2022-01-18 10:47:46.950][0x00001674][0x00000000][NDI::ClientCommunications::ServiceFinder::TraceFoundServices][107]'local v1-eqcas at https://CASServer.domain.com:2810/'
EMB log
The log contains the following sensitive information
- IP addresses (Server, Device, Host, Client)
Syntax Example:
- [TRACE][2022-01-20 14:18:04.532][0x00002528][0x00000000][DCEWEDPDeviceTokenManager::GenerateDeviceToken][0]'Searching for device with identifier: 3774095364 MAC address: host name: 10.78.138.61 product name: Kofax product version: 10.2.4.659'
DWS logs
The log contains the following sensitive information
- usernames
- IP addresses (Server, Device, Host, Client)
- Hostnames (Server, Device, Host, Client)
- Server name
Syntax Example:
DwsUISession
- 2022.01.14 09:02:51.701 [DEBUG] class com.nuance.ui.session.UISessionManager.removeDisplay(): nuance-exec-1: done remove display for instance: DeviceInstanceImpl [deviceIdentifier=3774095364, productName=Kofax, hostname=10.93.84.16, version=1.0.0]
DwsUIUI
- 2022.01.14 09:01:37.012 [DEBUG] class com.nuance.eq.ui.kofaxnext.LaunchWindow.ctor(): nuance-exec-2: device: DeviceInstanceImpl [deviceIdentifier=3774095364, productName=Kofax, hostname=10.38.83.16, version=1.0.0]
DwsWebRenderer
- 2022.01.14 09:02:51.186 [DEBUG] class com.nuance.ui.web.event.EventServlet.getSession(): nuance-exec-1: session found: true device: DeviceInstanceImpl [deviceIdentifier=3774095364, productName=Kofax, hostname=10.83.84.16, version=1.0.0]
KofaxXSALogin.KofaxSmartAuthWebService
- 2022.01.14 09:02:51.904 [DEBUG] class com.kofax.www.webservices.office.smart_auth._1.impl.XsaComponentUtils.forceLogout(): nuance-exec-1: xsaSession: c3485b60-e289-45ca-b75b-4d4ddc4cc7e6 ret: true device: DeviceInstanceImpl [deviceIdentifier=3774095364, productName=kofax, hostname=10.85.83.16, version=1.0.0]
- 2022.01.14 09:01:28.699 [ INFO] class com.kofax.www.webservices.office.smart_auth._1.impl.XsaComponentUtils.callInitLogin(): Thread-34: tryTime: 0, Session c3485b60-e289-45ca-b75b-4d4ddc4cc7e6, calling initiateLogin() at
KofaxLogin.KofaxSmartAuthWebService
- 2022.01.14 09:02:51.904 [DEBUG] class com.kofax.www.webservices.office.smart_auth._1.impl.XsaComponentUtils.forceLogout(): nuance-exec-1: xsaSession: c3485b60-e289-45ca-b75b-4d4ddc4cc7e6 ret: true device: DeviceInstanceImpl [deviceIdentifier=3774095364, productName=Kofax, hostname=10.98.33.16, version=1.0.0]
- 2022.01.14 09:01:28.699 [ INFO] class com.kofax.www.webservices.office.smart_auth._1.impl.XsaComponentUtils.callInitLogin(): Thread-34: tryTime: 0, Session c3485b60-e289-45ca-b75b-4d4ddc4cc7e6, calling initiateLogin() at https://10.55.231.85:443/webservices...e/smart_auth/1
KofaxDwsImpl.Kofax.JBAPollerProviderImpBase.157
- 2022.01.14 08:59:39.992 [ WARN] class com.nuance.docimg.wedp.jba.pollerprovider.impl.KofaxJBAPoller.pollDevice(): pool-4-thread-6: Poll device: 10.95.33.16
KofaxDwsImpl.KofaxDwsDeviceLifecycleProviderImpl.70
- 2022.01.14 09:04:24.235 [DEBUG] class com.nuance.docimg.dws.common.devicelifecycleprovider.PersistedInstallState.loadMap(): nuance-exec-1: DEVICE_HOSTNAME: 10.95.33.16
WedpJBAPollingServiceWedpJBAPollingImpl.67
- 2022.01.14 08:59:39.883 [DEBUG] class com.nuance.docimg.wedp.jba.pollingservice.impl.JBAPollingServiceImpl$JBAPollingRunnable.startPoll(): Kofax JBA Polling: Put to map and submit the poll for device: 10.95.33.16
WedpInstanceTemplateImpl.kofaxECSP-3774096364.233
- 2022.01.14 08:59:39.852 [DEBUG] KofaxJBA Polling: class com.eq.wasabi.WasabiOnlineTimer$23: Kofax JBA Polling: Calling server at URL: http://CASServer:2339/EmbeddedController/WEDP/1.6.3/soapRequest
- 2022.01.14 09:01:35.606 [ INFO] nuance-exec-2: com.equitrac.wasabi.session.SessionManager beginSession(): nuance-exec-2: Session Details GUID:937f4860-7518-11ec-9738-d51e4659242c UserId:System created 20220114090135606 ParentId:937f4860-7518-11ec-9737-d51e4659242c Start:Fri Jan 14 09:01:35 GMT 2022 End:Fri Jan 14 09:01:35 GMT 2022 Allocation <not set> Pre <not set> Post <not set> Workflow name: Login.12
WedpCoreImpl.WedpCoreConfigurationManagerImpl.27
- 2022.01.14 08:59:39.867 [DEBUG] class com.nuance.docimg.wedp.configmanager.impl.ConfigManager.getConfigurationMostUptodate(): Kofax JBA Polling: provider instance: DeviceInstanceImpl [deviceIdentifier=3774095364, productName=KofaxECSP, hostname=10.94.85.16, version=1.0.0]
Output Manager Logs
Output Manager Application Log
The log contains the following sensitive information
- usernames
- IP addresses (Server, Device, Host, Client)
- Hostnames (Server, Device, Host, Client)
- Server name
- Document Names
Syntax Example:
Device Connection error:MessageId: 62
Client Time: 1/26/2022 5:07:07 PM
Message: Unable to connect to socket 515 on 10.0.0.47.
serverName: CAN-M8-007
Message Module: OM Output
Service name: svcmb_cs
Message Priority: Operator Warning
MessageLogId: 350821
destinationId: 5
destinationString: toeqlpr
groupString: Unrouted
documentId: 177
documentString: trrrrwterter
sourceId: 10
sourceString: Mail Inbox (mbmail)
snmpDeviceld: 0
Beps Module Id: -1
Beps Message Id: -1
exceptionType:
exceptionDesc:[[No connection could be made because the target machine actively refused it 10.0.0.83:515]]
exceptionStackTrace:[[ at System.Net.Sockets.TcpCient.Connect(String hostname, Int32 port) at NSLOutputManager.OutputlprDevice.SendFile(String
server, Int32 inport, Int64 joblD, String queue, String user, String filename, String documentname)]]
error: 10061
Error converting document:
MessageId: 335
Client Time: 1/25/2022 7:51:49 PM
Message: Error converting document. MCF1033E Error processing input file 1 \\can-mb-007 \omfilestore\GRP0000000\D000000000178\2106.00310.PDF15.pdf(CpRc='1051'). Error code 1051
serverName: CAN-MB-007
Message Module: OM Rules Agent
Service name: svcmb_cs
Message Priority: Operator Warning
MessageLogid: 350270
destinationId: 0
destinationString: Unrouted
groupString: Unrouted
documentld: 178
documentString: 2106.00610.PDF15.pdf
snmpDeviceld: 0
Beps Module Id: -1
Beps Message Id: -1
error: 1051
Incoming Email
MessageId: 6767
Client Time: 1/25/2022 7:51:27PM
Message: HeaderDictionary Key=From, Value="John Doe' <john.doe@kofax.com>\r\n
serverName: CAN-MB-007
Message Module: OM Input Service
name: svcmb_cs
Message Priority: Support Trace
MessageLogId: 350124
destinationId: 0
destinationString: Unrouted
groupString: Unrouted
snmpDeviceId: 0
Beps Module Id: -1
Beps Message Id: -1
OM Metadata.xml (In Filestore)
The log contains the following sensitive information
- usernames
- Hostnames (Server, Device, Host, Client)
- Server name
- Document Names
Syntax Example:
Document Information
<Data Trimmed due to length>
<Nup>1</Nup>
<SubmitterUserName>svcmb_cs</SubmitterUserName>
<NotifyName>svcmb_cs</NotifyName>
<InMachineName>\\CAN-MB-007</InMachineName>
<DestinationName>PowerPDFToOM</DestinationName>
<File>WorkOrders2 (1).pdf</File>
<Orientation>1</Orientation>
<Data Trimmed due to length>
<JOB_INFO_2>
<JobId>3</JobId>
<PrinterName>PowerPDFToOM</PrinterName>
<MachineName>\\CAN-MB-007</MachineName>
<UserName>svcmb_cs</UserName>
<Document>WorkOrders2 (1).pdf</Document>
<NotifyName>svcmb_cs</NotifyName>
<DataType>NT EMF 1.008</DataType>
<Data Trimmed due to length>
<DOC_INFO_1>
<DataType/>
<DocName>WorkOrders2 (1).pdf</DocName>
<OutputFile/>
</DOC_INFO_1>
<Data Trimmed due to length>
Email Job
<Data Trimmed due to length>
<EmailSource>
<To>guestprint@kofax.local</To>
<From>GuestUser@jdoe.local</From>
<Subject>TEst File</Subject>
<Body> test </Body>
</EmailSource>
<File>1 - Back 2 School Night Video LINK - Google Docs.pdf</File>
<SourceType>EMAIL</SourceType>
<NotifyName>svcmb_cs</NotifyName>
<MachineName>CAN-MB-007</MachineName>
<Data Trimmed due to length>
Compart
The log contains the following sensitive information
- usernames
- Hostnames (Server, Device, Host, Client)
- Server name
- Document Names
Syntax Example:
Rules logs
<Data Trimmed due to length>
APP1004I Platform: WIN64 [64]
APP1011I Host Name: CAN-MB-007
APP1007I Architecture: X86
<Data Trimmed due to length>
MCF1140E Error processing input page '2'
MCF1051E Error converting all pages of file '\\can-mb-007\omfilestore\GRP0000000\DOC0000000172\2103.00610.PDF15.pdf' to '\\can-mb-007\omfilestore\GRP0000000\DOC0000000172\2106.00610.PDF15.PCL6'(CpRc='1140')
MCF1033E Error processing input file '\\can-mb-007\omfilestore\GRP0000000\DOC0000000172\2106.00610.PDF15.pdf'(CpRc='1051')
MCF1122I -> '\\can-mb-007\omfilestore\GRP0000000\DOC0000000172\2103.00610.PDF15.PCL6' (1 page; 1.761 s)
<Data Trimmed due to length>
Rules txt file
<Data Trimmed due to length>
-pro "C:\Users\svcmb_cs\AppData\Local\Kofax, Inc.\Resource Cache\3.2.27.0\RulesAgent\1"
-i "\\can-mb-007\omfilestore\GRP0000000\DOC0000000172\2106.00310.PDF15.pdf"
-type PDF
-o "\\can-mb-007\omfilestore\GRP0000000\DOC0000000172\2103.00610.PDF15.PCL6"
-type PXL
-logdir "\\can-mb-007\omfilestore\GRP0000000\DOC0000000172"
<Data Trimmed due to length>
Product | Version |
---|---|
ControlSuite | 1.x |
AutoStore | 7.x |
Equitrac | 5.x |
Output Manager | 4.x |
Article # 3039319