When the NSM On-Premises instance is in SafeMode, extra logging information is kept that can be downloaded. The logs are available from the SafeMode web management interface, which can be accessed via the URL provided at the bottom of the Management Console screen.
In SafeMode, the web management interface is only available via http (not https).
To download logs from SafeMode
Navigate DIAGNOSTICS tab.