Troubleshooting PaperCut Integrated Scanning

AVAILABLE TO CUSTOMERS ON:

“Help! I’m a PaperCut MF administrator and I’m trying to troubleshoot a problem with PaperCut Integrated Scanning. How should I go about troubleshooting this?”

Where did my scan job go?

Before diving into troubleshooting it helps to take a moment to understand how the process works and the different stages of a scan job.

1. The user logs onto a “device” (any PaperCut Integrated Scanning-capable hardware) and then scans a document. Then the device uploads the scan to the PaperCut MF server.
2. (Optional) If certain features are selected such as “Make PDF searchable”, the document will get routed through the Document Processing Service. By default, this service runs in the cloud, but there is a locally-hosted option as well. There the job will be processed and returned to the PaperCut MF server.
3. Then the scan job is routed to the destination configured in the scan action. This could be a file share, an email mailbox, or a user’s Cloud Storage such as Dropbox or OneDrive.

When there is a problem sending the scan job to its destination, then an error will often be recorded in the PaperCut MF server’s Application Log and usually will start with “Delivering scan images for scan job…” as you can see in the screenshot below.

Generic Errors

Error: Failed to save file for scan job

Failed to save file for scan job: D:\Program Files\PaperCut MF\server\data\scan\jobs\jbinks\41074\e120028a-811e-4fd4-a4ab-0f9078eae57d, free space in the partition: 57404850176 bytes, exception: Scan job Id: e120028a-811e-4fd4-a4ab-0f9078eae57d size: 29368240 bytes, allowed: 20971520 bytes

PaperCut MF specifies a maximum allowed scan size depending on the type of scan action, and sometimes scan jobs may exceed this size. If you see this error, it means that PaperCut NG/MF has blocked the scan job because it is larger than the allowed amount.

You can manage this threshold in PaperCut with three Advanced Config Keys using the Advanced Config Editor. These keys are…

These can be set to any value, but care must be taken when editing system.scan.email-max-job-size-kb ​in particular. Most email servers have an upper limit for attachment sizes somewhere between 20 and 50MB, and a large scan can easily exceed that amount. When that happens the email server will reject the message and the user will get no warning, instead of in the application log, you may find the error “Message size exceeds fixed maximum message size” described below. More information on this scenario can be found in our article Large Scan to Email jobs fail.

Scan to Folder Errors

Error: The system cannot find the path specified

Delivering scan images for scan job jobid@<jobID>@<scanActionID>:task@0 failed with an error: \\FileServer\path\myscan.pdf. (The system cannot find the path specified). See more details in the server log.

This error only happens in the case of a “Scan to Folder” action. In the example above this failed because the scan action was misconfigured with a space in the file path.

Solution: Double-check the file path specified in the scan action. Remember macOS and Linux systems paths are case sensitive.

Error: Access is denied/permission is denied

Delivering scan images to user jhutt failed with the error: /filesrv01/user/scans/Scans/scan_jhutt_2016–01–04–09–59–41.pdf (Permission denied). See more details in the server log.

This error only happens in the case of a “Scan to Folder” action. The service account that PaperCut is running needs to have read/write access to the directory to be able to upload the scan file.

Know that in the world of windows the local SYSTEM account only has rights to the local server. Service accounts running as SYSTEM cannot write or modify a network share hosted on another server.

Solution: Scan to a file share that’s hosted locally on the primary PaperCut server or set up PaperCut to run as a Domain User or Service Account that has read/write access to the directory. See: Run PaperCut Services with a Domain User Account

Error: Logon failure: unknown username or bad password

Delivering scan images to user bfett failed with the error: \\filesrv01\home$\bfett\Scans\scan_bfett_2017–11–17–09–40–01_1.jpg (Logon failure: unknown user name or bad password). See more details in the server log.

This error only happens in the case of a “Scan to Folder” action. This sounds like the service account that PaperCut NG/MF is running as has failed to authenticate to the network server hosting the file share.

You might see this after changing the password for the Service Account used by PaperCut, or if the password expired. See: Run PaperCut Services with a Domain User Account

Solution: open services.msc, find the PaperCut Primary Application Server service and update the service so that it is configured with the up-to-date password.

Scan to Email Errors

Issues with Scan to Email actions are often caused by misconfigured SMTP server details in PaperCut. We’ve included common errors here, but this article will discuss troubleshooting this area of PaperCut in greater depth: Troubleshooting email issues with PaperCut NG/MF.

Error: Client does not have permissions to send as this sender

Delivering scan images to user c3p0 failed with the error: Failed messages: com.sun.mail.smtp.SMTPSendFailedException: 550 5.7.1 Client does not have permissions to send as this sender. See more details in the server log.

This error only happens in the case of a “Scan to Email” action. This error is most commonly seen when customers transition from an on-premise Exchange server to Office365 as the email provider. Why? Traditionally an on-premise exchange server will let anyone “send-as” whatever user account so long as they are connecting from within the LAN. However, Office365 in the cloud is by necessity a lot more restrictive, and will only let a user “send-as” the user account they are authenticated as.

In this situation, customers can set up an SMTP relay or configure the scan action in PaperCut so that the “from” address matches the email account in the SMTP server details.

Solution: Set up an SMTP relay as mentioned in our article Client does not have permissions to send as this sender. Or try configuring the scan action so that it sends from the From address that matches what’s configured in Options > Notifications > Email Options.

Error: Connection reset by peer

Delivering scan images for scan job jobId@dc3985a8-a14e-414f-8379-c8041f4025c5:scanAction@1001:task@0 failed with an error: Failed messages: javax.mail.MessagingException: IOException while sending message; nested exception is: java.net.SocketException: Connection reset by peer: socket write error. See more details in the server log.

This error only happens in the case of a “Scan to Email” action. The message suggests that the PaperCut MF server is unable to contact the email server. In one case this was because ports to the SMTP (email) server were blocked. In other cases, this could be because a security appliance (firewall, proxy, content filter) is blocking the connection.

Solution: Check the SMTP server options in PaperCut. Make sure that the port used by the email provider is open to the PaperCut server and not blocked by a firewall.

Error: Message size exceeds fixed maximum message size

Delivering scan images for scan job jobId@adea2b25–64af-4a38-ad7a-682b00b843d9:scanAction@1001:task@0 failed with an error: Failed messages: com.sun.mail.smtp.SMTPSendFailedException: 552 4.3.1 Message size exceeds fixed maximum message size . See more details in the server log.

This error only happens in the case of a “Scan to Email” action. The scan job was rejected by the email provider because the attachment size was too large.

Solution: consult your email provider’s documentation to increase the attachment size limit, or follow the steps in our article Large Scan to Email jobs fail to configure PaperCut to send users a notification email when their scans are too large. If scanning large files is a requirement, consider setting up Scan to Email or Scan to Cloud Storage actions instead.

Scan to Cloud Storage Errors

This article focuses on the specific errors you may see in the Application log when scanning fails, but a broader discussion of Troubleshooting Scan to Cloud Storage can also be found in our manual here.

Error: Failed to get Session URI

Delivering scan images for scan job jobId@3da22721-f430–48ca-b86b-412ad4f0c9b2:scanAction@3003:task@0 failed with an error: Failed to get Session URI, error Failed to connect to storage.googleapis.com/172.217.25.144:443. See more details in the server log.

This error only happens in the case of a “Scan to Cloud Storage” action. In one case, this happened because the access to storage.googleapis.com was blocked by a security appliance.

Solution: check our article Firewall Ports used by NG & MF to see the list of URLs that the PaperCu server needs to reach. In the short term, consider setting up a Scan to Folder or Scan to Email action while troubleshooting.

It could also be possible that there’s a problem with our Scan to Cloud service. You should check our Status Page to see if there is any current outage.

Error: Failed to create scan cloud job, response status: 401

Delivering scan images for scan job jobId@42b847c0-bbd1–4def-80e0–3c319d666ed2:scanAction@1001:task@0 failed with an error: Failed to create scan cloud job, response status: 401, message: . See more details in the server log.

This error has been seen to happen in the case of a “Scan to Cloud Storage” action. The HTTP 401 (unauthorized) error suggests a problem related to the license.

One customer reported that reinstalling the license file and restarting the server fixed the problem. In another case deactivating and then reactivating Scan to Cloud worked.

Solution: check on the About page to confirm that the PaperCut MF server has a current license installed. If that doesn’t resolve the problem, then try deactivating and reactivating the Scan to Cloud service by opening the Advanced Config editor, and find the key system.scan.cloud.enabled, change the value to “N” and click update, then browse to the scan action and attempt to reactivate it, making a note if there are any error messages.

Error: Unable to find valid certification path to requested target

Delivering scan images for scan job jobId@7892af0c-a52d-47da-ae62–8fa5e095fcd6:scanAction@5006:task@0 failed with an error: unable to find valid certification path to requested target. See more details in the server log.

This error has been seen to happen in the case of a “Scan to Cloud Storage” action. What we have found through trial and error is that this is a problem related to the SSL/TLS handshake process, often caused by a security appliance (like a firewall, secure proxy, or content filter) doing SSL/TLS packet inspection (AKA Man-in-the-Middle). When this happens, encrypted SSL traffic is opened, inspected, and then re-encrypted using whatever certificate is installed on the network appliance. If the PaperCut server didn’t trust the certificate then they might see SSL handshake errors like this.

Further Scan to Cloud troubleshooting

This section only applies to “Scan to Cloud Storage” actions. The most common problem we hear with PaperCut Scan to Cloud Storage is that the user doesn’t see the authorization email, or they clicked the link in the authorization email but did not receive the scan. There are a few things that you should look at when this happens.

• Double-check which user you performed the scan as and make sure this account has the correct primary email address.
• Make sure that the authorization email hasn’t gone into a spam or clutter folder instead, and isn’t being held up by a spam filter.
• Make sure that your email system is not blocking or graylisting emails from scans@papercut.com .
• Was the user signed into the wrong account in the browser when they clicked the authorization link? This would have incorrectly associated their PaperCut account with the wrong Cloud Storage account. To resolve this, this user should figure out what account they were signed in with when they clicked the link and then follow these steps to Revoke Access.
• Lastly, if there was a problem sending the first authorization link email to the user’s mailbox, and we received an NDR (non-delivery report (also known as a bounceback) from your email provider then our mail service will cache that the user’s email was bad and will not send any more messages to that address. Reach out to us for assistance if you have exhausted the other troubleshooting options.

Document Processing Errors

This article focuses on the specific errors you may see in the Application log when scanning fails, but a broader discussion of Troubleshooting Document Processing can also be found in our manual here.

Error: Failed to create a job request

Failed to create a job request for the file scanned by <user> on <device>

This only happens when scan jobs are routed through the PaperCut Document Processing Service but the service cannot be reached.

Solution: To get people scanning right now, try disabling ALL features that require this service, including “Make PDF searchable”, “DOCX”, “Blank Page Detection”, “Despeckle”, and “Deskew”. Instructions here: How to turn off PaperCut’s Document Processing.

Then work out why the PaperCut server can’t reach the cloud service.

It could also be possible that there’s a problem with our Cloud Document Processing service. You should check our Status Page to see if there is any current outage.

If that’s not the case, then the most likely problem that we’ve seen is that some network security appliance such as a Firewall, Secure Proxy, or Content Filter is blocking the connection.

Try testing connection to URLs for the scan to cloud storage using the PowerShell command Test-NetConnection <ur>l -port 443 with just the relevant URLs. If you find that these URLs are accessible on the correct port, then engage your security and network teams to determine if an IPS (intrusion protection system) or content filter may be intermittently blocking traffic.

Here’s what one customer told us:

“When resolving storage.googleapis.com, there are multiple IP blocks that get returned. If the PaperCut server resolves one set and the firewall resolves to a different set, then the server will get denied access out of the firewall because the IPs don’t match. This becomes a timeout in the PaperCut server log, and one of the “failed to upload/download” errors. I think PaperCut will retry a number of times, and this could be contributing to the scan delays. We are still thinking of a workaround, but we can test by opening the policy up temporarily.”

More information on troubleshooting Document Processing can be found in our article Troubleshooting Document Processing scans, including OCR.

Even more troubleshooting

Not seeing your error in this article, or encountering a different problem with PaperCut Integrated Scanning? If you are able to reproduce the problem please help us help you by doing the following…

• Make a note of the exact time, username, and device that the scan was performed which demonstrates the issue.
• Make a copy of the failed scans folder on your PaperCut MF server to share with us. On a 64-bit Windows server, this would be found in C:\Program Files\PaperCut MF\server\data\scan\failed.
• Visit our Support Portal to start a troubleshooting ticket.

For more general information on Integrated Scanning have a look at our manual section on Integrated Scanning and in the article Common Questions about Integrated Scanning (FAQ).