Accessing Reporting Engine Log Files

You can access the Reporting Engine log files which are stored in the following logs directory /var/netwitness/re-server/rsa/soc/reporting-engine/logs/

  • Current logs in the reporting-engine.log file.
  • Backup copies of previous logs in the reporting-engine.log.* file.
  • All UNIX script logs in the files that have the following syntax: reporting-engine.sh_timestamp.log (for example, reporting-engine.sh_20120921.log)

The Reporting Engine rarely writes command line error messages to the rsasoc/nohup.out file.

The Reporting Engine appends the log messages and output written by systemd system and the commands used to start the reporting-engine to the directory /var/log/messages. A /var/log/messages log file is a system log file so only the root user can read it.