How to decrypt enhanced network logs?

[RuiC-Xerox]

Good luck...

If you remember gives a feedback in the end of all :)

[BSOD2600]

Thanks for looking into it.  Yup, I'm waiting on L3 now.

[RuiC-Xerox]

Good morning.

• I can not access that log number you provided
• Historical data shows similar behaviour on old 56xx. But resolved with firmware upgrade.
• Nothing more related the 57xx.
• You do have the latest firmware available.

To be honest your best way here is to follow the support line with network traces, ESS logs and audit logs. Provide it all for a quicker resolution time..

Like I mentioned if its the service failing on the device than is not much you will be able to analyse. Unless network traces bring some light, such as lost packets, or overflush or snmp traffic that could cause the service to stop on the device.

[RuiC-Xerox]

hum.. interesting. i can have a look at the code tomorrow, but if you already all the exoerts in.. might be hard to bring news to the table.

The wise option would be to gather the logs and send to L3 for investigation, they might be able so see the cause for the service to stop. But I believe you will have to retrieve log quick after error occur.

Network trace can also be achieved by port redirection on router or switch. Otherwise a laptop next to the printer would do the trick. Nut because you cannot replicate when you want this might cause issue.

[BSOD2600]

Ah, didn't realize there was xerox code in those files too.  Interesting.

Network traces is difficult with the location of the device (prohibits hub+pc+wireshark capture) and networking won't enable a trace at the switch/router level.

Abbreviated issue is that randomly the printer's SNMP agent crashes. It doesn't happen on demand. Some times it takes days or hours to occur. When this occurs, the following is displayed on the web interface:

16-586 The Network Management function has failed. User intervention is required to Power Off/On the machine. Printing and other machine services are available.

We've already had multiple techs out over the past month, which have installed various SPAR releases (061.132.222.15103 to 061.132.222.28903), alt-booting, manually config (vs using a cloning file), replaced network controller hardware, etc.  They've seen this exact error message on other different model WorkCentre devices across this facility too, which makes be believe someone has figured out an exploit for this class of printer. 

[RuiC-Xerox]

I'm not sure I can access this log, depending from whic h zone on the globe it was open at or related to..;(

[RuiC-Xerox]

Don't get me wrong... and I do understand your bold "my". I am not expert on legal property side... but my understanding is that a customer owns the device but embedded technology is still manufactur property.

By opening ess logs you not only see network information but as well software development code.

For network information I would advise network traces..

Is the problem you are facing something you can share? Maybe the community can help.

[BSOD2600]

I haven't worked with ESS logs. Can WireShark parse them?  This is all for log id 153237764, in case you want to dig into the problem (which is wider than just my device).  The encrypted file was uploaded to the site too.

[RuiC-Xerox]

Yes, you can. But you would have to still open a ticket with support and get it escalated the way through.
They would not just decrypt and deliver a raw file.

Have you worked with ESS logs previously?

[BSOD2600]

Can I get it through Tier III support then? It's my printer's network logs...