[Edited Title] - Configuring a Follow Me/Pull Print queue on CUPS to handle failed jobs properly

[bdaileyumich]

I'm running CUPS 2.4.1 on Ubuntu 22.0.4, and am seeing an issue with folks printing password protected PDFs clogging up print queues.

We have a "Follow Me"/pull-print queue set up, and the current ErrorPolicy is set to abort-job. MaxJobTime is the default (3 hours). If I send a password protected PDF to our Follow Me queue, CUPS fails to process the job, but the job remains "active" in the queue until MaxJobTime is reached and the job is purged.

Perhaps I misunderstand how "abort-job" should work, but I'd expect if a filter fails or is stopped, the job should no longer remain "active" since it obviously cannot be printed. Is there a different ErrorPolicy (or some other configuration option) I could use to auto-purge jobs like this, or at least make them inactive so other jobs can process?

relevant error_log file snippet:
I [11/Apr/2023:12:50:28 -0400] [Job 524] Started filter /usr/lib/cups/filter/pdftopdf (PID 1921979)
I [11/Apr/2023:12:50:28 -0400] [Job 524] Started backend /usr/lib/cups/backend/papercut (PID 1921980)
D [11/Apr/2023:12:50:28 -0400] [Job 524] papercut: CUPS Provider Version: 109.20.0.6242-B953C26 UID: 0
D [11/Apr/2023:12:50:28 -0400] [Job 524] pdftopdf: Last filter determined by the PPD: -; FINAL_CONTENT_TYPE: application/postscript => pdftopdf will not log pages in page_log.
E [11/Apr/2023:12:50:28 -0400] [Job 524] loadFilename failed: /var/spool/cups/d00524-001: invalid password
D [11/Apr/2023:12:50:28 -0400] [Job 524] Set job-printer-state-message to "loadFilename failed: /var/spool/cups/d00524-001: invalid password", current level=ERROR
D [11/Apr/2023:12:50:28 -0400] [Job 524] PID 1921979 (/usr/lib/cups/filter/pdftopdf) stopped with status 1.

Thanks!

[bdaileyumich]

Update:

It looks like the issue may be that after the job fails, CUPS still attempts to connect to the printer. Because this is a "Follow Me" print queue with no real, physical endpoint, it does not have a valid IP, we just have it use "LPT1" as an IP placeholder. Since this isn't a real IP, CUPS fails to connect to the "printer", and thus it decides that the job failed because the printer is unreachable, not because the filter failed, and thus it leaves the bad job as "active":

D [11/Apr/2023:12:50:28 -0400] [Job 524] STATE: +connecting-to-device
D [11/Apr/2023:12:50:28 -0400] [Job 524] Looking up "LPT1"...
D [11/Apr/2023:12:50:28 -0400] [Job 524] Unable to locate printer "LPT1".
[ -- redundant lines removed -- ]
D [11/Apr/2023:12:55:18 -0400] [Job 524] Unable to locate printer "LPT1".
D [11/Apr/2023:12:55:28 -0400] [Job 524] PID 1921980 (/usr/lib/cups/backend/papercut) exited with no errors.
E [11/Apr/2023:12:55:28 -0400] [Job 524] Job stopped due to filter errors; please consult the /var/log/cups/error_log file for details.
D [11/Apr/2023:12:55:28 -0400] [Job 524] The following messages were recorded from 12:50:28 to 12:50:28
D [11/Apr/2023:12:55:28 -0400] [Job 524] Mapping media to Pagesize=Letter
D [11/Apr/2023:12:55:28 -0400] [Job 524] Mapping sizes to Duplex=DuplexNoTumble
D [11/Apr/2023:12:55:28 -0400] [Job 524] After mapping finishings Duplex=DuplexNoTumble
D [11/Apr/2023:12:55:28 -0400] [Job 524] After mapping finishings PageSize=Letter
D [11/Apr/2023:12:55:28 -0400] [Job 524] End of messages
D [11/Apr/2023:12:55:28 -0400] [Job 524] printer-state=3(idle)
D [11/Apr/2023:12:55:28 -0400] [Job 524] printer-state-message="Unable to locate printer "LPT1"."
D [11/Apr/2023:12:55:28 -0400] [Job 524] printer-state-reasons=none

If I change our Follow Me queue to use a "real" IP address, it handles the job as I would expect - the job is stopped due to the filter failure, and jobs queued behind it are permitted to process.

What is the recommended way to configure a "Follow Me" queue in CUPS? It does not make sense to me to have it point to a real endpoint because there are no assurances that a single particular endpoint will always be reachable, and the Follow Me queue should not be dependent on the status of an unrelated print device.

Thank you!

[bdaileyumich]

Moving this to a Discussion in the OpenPrinting repository.