000034838 - Reports OutputActions are not running when report partially completed in RSA NetWitness

Document created by RSA Customer Support Employee on Mar 16, 2017Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000034838
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Reporting Engine
RSA Version/Condition: 10.5.X,10.6.X
IssueWhen reports complete partially, the OutputActions like EMAIL notifications will not work. Logs indicate that "OutputActions are not executing" as below.
2017-02-14 12:21:53,785 [EXEC_RUNDEF_10220_20170214115617] DEBUG com.rsa.soc.re.outputaction.report.ReportOutputActionExecutor - Start Instantiating and executing OutputActionHandler 
2017-02-14 12:21:53,785 [EXEC_RUNDEF_10220_20170214115617] DEBUG com.rsa.soc.re.outputaction.report.ReportOutputActionExecutor - OutputActionType is EMAIL
2017-02-14 12:21:53,785 [EXEC_RUNDEF_10220_20170214115617] INFO com.rsa.soc.re.outputaction.report.ReportOutputActionExecutor - Report execution status is PARTIAL for reportName :
PCI - Compliance Report, scheduleName: testEmail, executionId: EXEC_RUNDEF_10220_20170214115617 ; Not executing outputActionType EMAIL outputAction based on the configuration
2017-02-14 12:21:53,785 [EXEC_RUNDEF_10220_20170214115617] DEBUG com.rsa.soc.re.outputaction.report.ReportOutputActionExecutor - OutputAction Execution completed successfully

CauseBy default, Report OutputActions work only for completed reports. But not for partial Reports.
ResolutionPlease follow below steps to get OutputActions to be working for Partial,Failed and Completed reports.
1. Login to Security Analytics GUI as admin.
2. Navigate to Administration->Services page. Select Reporting Engine and navigate to Config page.
3. In General Tab, Under System Configuration, Uncheck option for "Enable Output Actions for Completed Reports" and Click apply as highlighted below.
User-added image
4. Test the Report and Verify the Output action working now.