Reports OutputActions are not running when report partially completed in RSA NetWitness

Issue

When reports complete partially, the OutputActions like EMAIL notifications will not work. Logs indicate that "OutputActions are not executing" as below.

/home/rsasoc/rsa/soc/reporting-engine/logs/reporting-engine.log

 2017-02-14 12:21:53,785 [EXEC_RUNDEF_10220_20170214115617] DEBUG com.rsa.soc.re.outputaction.report.ReportOutputActionExecutor - Start Instantiating and executing OutputActionHandler 
 
2017-02-14 12:21:53,785 [EXEC_RUNDEF_10220_20170214115617] DEBUG com.rsa.soc.re.outputaction.report.ReportOutputActionExecutor - OutputActionType is EMAIL 
 
2017-02-14 12:21:53,785 [EXEC_RUNDEF_10220_20170214115617] INFO com.rsa.soc.re.outputaction.report.ReportOutputActionExecutor - Report execution status is PARTIAL for reportName :
 
 PCI - Compliance Report, scheduleName: testEmail, executionId: EXEC_RUNDEF_10220_20170214115617 ; Not executing outputActionType EMAIL outputAction based on the configuration 
 
2017-02-14 12:21:53,785 [EXEC_RUNDEF_10220_20170214115617] DEBUG com.rsa.soc.re.outputaction.report.ReportOutputActionExecutor - OutputAction Execution completed successfully

Cause

By default, Report OutputActions work only for completed reports. But not for partial Reports.

Resolution

Please follow below steps to get OutputActions to be working for Partial,Failed and Completed reports.

1. Login to Security Analytics GUI as admin.
2. Navigate to Administration->Services page. Select Reporting Engine and navigate to Config page.
3. In General Tab, Under System Configuration, Uncheck option for "Enable Output Actions for Completed Reports" and Click apply as highlighted below.

4. Test the Report and Verify the Output action working now.

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Reporting Engine
RSA Version/Condition: 10.5.X,10.6.X

Summary

When report complete partially, the OutputActions like EMAIL will not work as by default, Report OutputActions work only for completed reports. This article outlines the procedure to get OutputActions working even for partial reports.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue