Following a device kill (wipe) in the BES log

Sometimes you need to wipe a device and when you do, you need some sort of confirmation the wipe was successful. The wipe request is executed by the BlackBerry Policy Service and the logfile of this service, when set to Debug Log Level 4, contains relevant logging.

To test this I have activated a BlackBerry device and powered it off.

The logging shown below is from a 5.0 SP3 BlackBerry Enterprise Server with timestamps removed for brevity.

Step 1 – Using the “Erase Data and Disable Handheld” command (a.k.a. a remote wipe) on the device:

[40000] :{0x20A4} {user@example.com, PIN=XXXXXXXX, UserId=1}SCS::ScheduleCommand – Queuing KILL_DEVICE_REQUEST request
[40000] :{0x2094} {user@example.com, PIN=XXXXXXXX, UserId=1}RequestHandler::DoWork – Processing KILL_DEVICE_REQUEST request
[30000] :{0x2094} {user@example.com, PIN=XXXXXXXX, UserId=1}RequestHandler::FormatGMETransactionForDevice – Sending KILL_DEVICE_REQUEST request to device, contentType=ITADMIN, size=51, RefId=0, TransactionId=-222333, SRPID=S12345678, Tag=9
[40000] :{0x2094} {user@example.com, PIN=XXXXXXXX, UserId=1}RequestHandler::SendData – Submit ToRelaySendQ, PIN=XXXXXXXX, Tag=9
[40000] :{0x2094} {user@example.com, PIN=XXXXXXXX, UserId=1}RequestHandler::DoWork – Completed KILL_DEVICE_REQUEST request

Above you see the Policy service accepting, processing and queuing the wipe (Kill_Device_Request).

Step 2 – The device is powered on and receives the KILL_Device_Request:

[40000] :{0x208C} {user@example.com, PIN=XXXXXXXX, UserId=1}RequestHandler::DoWork – Processing DEVICE_SEND_STATUS_EVENT request
[30000] :{0x208C} {user@example.com, PIN=XXXXXXXX, UserId=1}RequestHandler::DoDeviceSentProcessing – Message has been delivered to device, Tag=9
[40000] :{0x208C} {user@example.com, PIN=XXXXXXXX, UserId=1}RequestHandler::DoITPolicyDeviceSentProcessing – ITPolicy GME Receive Ack for the command KILL_HANDHELD_COMMAND – Processing packet, Tag=9
[40000] :{0x208C} {user@example.com, PIN=XXXXXXXX, UserId=1}RequestHandler::DoWork – Completed DEVICE_SEND_STATUS_EVENT request
[40000] :{0x2088} {user@example.com, PIN=, UserId=1}RequestHandler::DoWork – Processing NEW_MESSAGE request
[40000] :{0x2088} {user@example.com, PIN=, UserId=1}RequestHandler::DoGMEReceiveProcessing – Receiving packet from device, size=49, TransactionId=-333444, Tag=883, content type=ITADMIN, cmd=0x3
[30000] :{0x2088} {user@example.com, PIN=, UserId=1}RequestHandler::HandleITADMINDataCommand – Ack command KILL_HANDHELD_COMMAND
[40000] :{0x2088} {user@example.com, PIN=, UserId=1}RequestHandler::SendStatus – Submit ToRelaySendQ, Tag=883
[40000] :{0x2088} {user@example.com, PIN=, UserId=1}RequestHandler::DoWork – Completed NEW_MESSAGE request

First the device receives the command and sends a receive acknowledgement. Soon after that the device sends an acknowledgement for the Kill_Handheld_Command and starts erasing data.

Two very important notes are:

  1. Do not disable the data service for the device too early, without a data service the device will not be able to receive the Kill_Handheld_Command.
  2. When you remove the user from the BES, you also remove the Kill_Handheld_Command from the queue.

For more information and details refer to KB04529 on the BlackBerry Knowledge base.