You typically use those logs in conjunction with one another. For instance if you're interested in SASLogon, then you're likely to consult both the Lev1/Web/Logs/SASServer1_1/SASLogon9.4.log and Lev1/Web/WebAppServer/SASServer1_1/logs/server.log.
This is typical pattern with Java Web applications, the web server/container has its own log, and then individual applications running inside have their own logs as well.
you may find the middle tier component section of the admin guide helpful as well.
https://go.documentation.sas.com/?cdcId=bicdc&cdcVersion=9.4&docsetId=bimtag&docsetTarget=titlepage.htm&locale=en
... View more