HPE ArcSight

From the introduction of the CORR backend, the important logs have changed. These are the one's I've seen HPE ArcSight Tech Support call for. These are the one's I've been using to troubleshoot almost everything that wasn't able to be worked within the console or system/resource monitor webpages.

Manager

/opt/arcsight/manager/logs/default/*.log

Most important files:

1. server.std.log
2. server.log

CORR-E

/opt/arcsight/logger/current/arcsight/logger/logs/*.log
/opt/arcsight/logger/data/mysql/*.log
/opt/arcsight/logger/data/pgsql/serverlog*