Dear Mohd,
This guide should give you a full insight on your inquiry https://community.rsa.com/docs/DOC-83319
Also the below info tells you how to view logs for the provided services on each node of the NetWitness 11.0 solution.
On the Admin node, /var/log/netwitness/ has logs for
• admin-server
• appliance
• broker
• bootstrap
• config-management
• config-server
• deployment-upgrade
• investigate-server
• orchestration-client
• orchestration-server
• respond-server
• security-client
• security-server
On a Packet Hybrid, /var/log/netwitness has logs for:
• appliance
• bootstrap
• concentrator
• config-management
• decoder
• security-client
On ESA, /var/log/netwitness has logs for:
• bootstrap
• config-management
• contexthub-server
• esa-analytics-server (Entity Analytics AKA c2)
• orchestration-client
• security-client
• And /opt/rsa/esa/logs/esa.log for ESA
Hope this is will be helpful to you.
Thank you
