You can access the Reporting Engine log files which are stored in the following logs directory /var/netwitness/re-server/rsa/soc/reporting-engine/logs/
Current logs in the reporting-engine.log file.
Backup copies of previous logs in the reporting-engine.log.* file.
All UNIX script logs in the files that have the following syntax: reporting-engine.sh_timestamp.log (for example, reporting-engine.sh_20120921.log)
The Reporting Engine rarely writes command line error messages to the rsasoc/nohup.out file.
The Reporting Engine appends the log messages and output written by systemd system and the commands used to start the reporting-engine to the directory /var/log/messages. A /var/log/messages log file is a system log file so only the root user can read it.