Service Command  Log File Location Purpose
Admin Server service rsa-nw-admin-server restart /var/log/netwitness/admin-server/admin-server.log The NetWitness Suite Administration Server (Admin server) is the back-end service for administrative tasks in the NW UI. It abstracts authentication, global preferences management, and authorization support for the UI. The Admin server requires the Config server and the Security server to be online to perform its role.
Broker service nwbroker restart  /var/log/messages The broker service is same as in 10.x
Config Server service rsa-nw-config-server restart /var/log/netwitness/config-server/config-server.log The Config server stores and manages configuration sets. A configuration set is any logical configuration group that is managed independently. The Config server facilitates the sharing of properties among services, provides configuration backup and restore facilities, and tracks changes to properties.
Investigate Server service rsa-nw-investigate-server restart /var/log/netwitness/investigate-server/investigate-server.log It is responsible for investigation.
Orchestration Server service rsa-nw-orchestration-server restart /var/log/netwitness/orchestration-server/orchestration-server.log Internal, system management service that runs on the NW Server to provision, install, and configure all services in your NetWitness Suite deployment.
Reporting Engine service rsasoc_re restart /var/netwitness/re-server/rsa/soc/reporting-engine/logs/reporting-engine.log RE services is same as in 10.x versions
Respond Server service rsa-nw-respond-server restart /var/log/netwitness/respond-server/respond-server.log Its basically rsa-im service of 10.x, responsible for Respond on 11.x (IM on 10.x)
Security Server service rsa-nw-security-server restart /var/log/netwitness/security-server/security-server.log The NetWitness Suite Security Server (Security server) manages the security infrastructure of a NetWitness Suite deployment. It handles the following security-related concerns.

 Users and the authentication accounts
Role Based Access Control (RBAC)
Deployment PKI infrastructure
Additional Services
Jetty  service jetty restart  /var/lib/netwitness/uax/logs/sa.log Same as in10.x version
SMS  service rsa-sms restart  /opt/rsa/sms/logs/sms.log Same as in10.x version
Collectd  service collectd restart  NA Same as in10.x version
Salt Master service salt-master restart /var/log/salt/master It runs on the Admin server
Salt Minion service salt-minion restart /var/log/salt/minion It runs on all hosts
Salt API service salt-api restart /var/log/salt/api It runs on the Admin server
Topic: