Skip to content
  • There are no suggestions because the search field is empty.

Reports are not copied to the network share configured in output action in RSA Security Analytics Reporting Engine

Issue

Reporting Engine has an output action configured to copy the report to a network share.
However, the reports do not appear in the network share even when the Report Status shows "COMPLETED".

src=https://netwitness.file.force.com/servlet/rtaImage?eid=ka04z000000kMn8&feoid=00N5Y00000TPmR9&refid=0EM4z0000052y4w

Cause

This happens due to incorrect "Mounted Path" settings under the Network Share Configuration.


Resolution

Navigate to Administration -> Services -> Reporting Engine -> Config -> Output Actions
Under Network Share Configuration, note the mounted path and not the actual path to the network share.

Example: If the mounted share is \\10.16.8.17\shared and the mounted path is /temp/share

src=https://netwitness.file.force.com/servlet/rtaImage?eid=ka04z000000kMn8&feoid=00N5Y00000TPmRL&refid=0EM4z0000052y4z

Then the configuration should have /temp/share and NOT the actual share path.
src=https://netwitness.file.force.com/servlet/rtaImage?eid=ka04z000000kMn8&feoid=00N5Y00000TPmRL&refid=0EM4z0000052y50

Product Details

RSA Product Set: Security Analytics, NetWitness Logs and Network
RSA Product/Service Type: Reporting Engine
RSA Version/Condition: 10.4.x, 10.5.x, 10.6.x, 11.X
Platform: CentOS
O/S Version: 6, 7

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue