Debugging Information

NetWitness Log Files

The following files contain NetWitness log information.

Component File
rabbitmq /var/log/rabbitmq/nw@localhost.log
/var/log/rabbitmq/nw@localhost-sasl.log
collectd /var/log/messages
nwlogcollector /var/log/messages
nwlogdecoder /var/log/messages
sms /opt/rsa/sms/wrapper.log
sms /opt/rsa/sms/logs/sms.log
sms /opt/rsa/sms/logs/audit/audit.log
NetWitness /var/lib/netwitness/uax/logs/nw.log
NetWitness /var/lib/netwitness/uax/logs/audit/audit.log
NetWitness /opt/rsa/jetty9/logs

Files of Interest

The following files are used in key NetWitness components, and can be useful when trying to track down miscellaneous issues.

Component File Description
rabbit /etc/rabbitmq/rabbitmq.config RabbitMQ configuration file. This configuration file partially drives the behavior of RabbitMQ, particularly around network/SSL settings.
rabbit /etc/rabbitmq/rabbitmq-env.
conf 		RabbitMQ environment configuration file. This file specifies the RabbitMQ node name and location of the enabled plugins file.
rabbit /etc/rabbitmq/rsa_enabled_plugins This file specifies the list of enabled plugins in RabbitMQ. This file is managed by the RabbitMQ server, with the rabbitmq-plugins command. This file overrides the /etc/rabbitmq/enabled_plugins path to work around issues with upgrading the Log Collector from early versions.
rabbit /etc/rabbitmq/ssl/truststore.pem The RabbitMQ trust store. This file contains a sequence of PEM-encoded X.509 certificates, represented trust CAs. Any clients that connect to RabbitMQ and present a certificate that is signed by a CA in this list is considered a trusted client.
rabbit /var/log/rabbitmq/mnesia/
nw@localhost 		The RabbitMQ Mnesia directory. Mnesia is the Erlang/OTP database technology, for storing Erlang objects persistently. RabbitMQ uses this technology for storing information such as the current set of policies, persistent exchanges and queues, and so forth.

Importantly, the msg_store_persistent and msg_store_transient directories are where RabbitMQ stores messages that have been spooled to disk, for example, if messages are published as persistent messages, or have paged off to disk due to memory limitations. Keep a close eye on this directory if disk or memory alarms have tripped in RabbitMQ.

Caution: Do not delete these files manually. Use RabbitMQ tools to purge or delete queues. Modifying these files manually may render your RabbitMQ instance inoperable.