Information on the Overview tab for a Component-based alert
Summarize
Summary of Overview Tab for a Component-based Alert
The Overview tab in Health Log Analytics provides a comprehensive view of Component-based alerts, helping ServiceNow customers quickly understand the root cause, impact, and context of an alert. This tab consolidates key information such as the identified issue, anomaly details, configuration items (CIs), impacted services, and related alerts and incidents.
Show less
Key Sections on the Overview Tab
- Identified Issue: Displays the core problem triggering the alert, shown in the alert title and a dedicated card. Customers can click the information icon to learn how the issue was detected and view surrounding log lines (one minute before and after the alert) to analyze related events.
- Configuration Items (CIs): Lists the specific CIs associated with the alert. Customers can access more detailed CI information by navigating to the Configuration Items tab or selecting "View more."
- Impacted Services: Highlights services affected by the alert. Detailed insights are available by clicking the Impacted services tab, aiding in impact assessment and prioritization.
- Anomaly: Visualizes the anomalous activity that caused the alert using charts with multiple baseline comparisons:
- Blue line: recent anomalous data
- Light shaded area: expected (learned baseline) behavior
- Peach shaded area: baseline for the same hour one day earlier
- Pink shaded area: baseline for the same hour one week earlier
- Meaningful Log Properties: Shows distribution of specific log properties contributing to the anomaly using color-coded bar charts. This helps identify which property values are most significant in the anomaly context.
- Top Alerts: Summarizes data from similar and repeated alerts, providing a total count and a link to detailed insights on similar alert patterns, enabling customers to identify recurring issues.
- Top Incidents: Summarizes incidents related to the affected CI and related CIs, with a total count and link to detailed incident information for faster incident correlation and resolution.
Practical Benefits for ServiceNow Customers
- Quickly identify and understand the core issue causing the alert.
- Access detailed context on impacted configuration items and services for better impact analysis.
- Visualize anomalies against multiple baselines to distinguish unusual behavior from expected patterns.
- Leverage meaningful log property distributions to pinpoint critical contributing factors.
- Correlate alerts and incidents efficiently to prioritize and expedite remediation.
The alert Overview tab in Health Log Analytics helps you understand Component-based alerts.
Sections on the Overview tab for a Component-based alert
For a detailed description of Component-based alerts, see Types of Health Log Analytics alerts.
- Identified issue
The "identified issue" led to the alert. The issue appears in the title for the alert and on a card on the tab. Information about the alert appears in the banner.
Figure 1. Identified issue - Click the information icon (
) to see how the issue was identified. - Click View surrounding logs to view the log lines that were generated one minute before and one minute after the alert. See Analyze log lines that surround an anomaly.
- Click the information icon (
- Configuration Items
- To view more detailed information on the CIs that are associated with the alert, click the Configuration Items tab or click View more in the Configuration Items section. See Operator phase 1: Analyze and acknowledge an alert.
- Impacted services
- To view detailed information on the services that are impacted by the alerts, click the Impacted services tab. See Operator phase 1: Analyze and acknowledge an alert.
- Anomaly
- The Anomaly card illustrates the anomalous activity that led to the alert.
- The blue line shows the recent anomalous activity.
- On some charts, the lightly shaded area indicates the expected (learned
baseline) behavior.
A peach-shaded area represents the baseline values for the same hour one day earlier. A pink-shaded area shows the values for the same period in the previous week.
- Click the information icon to see how the anomaly was identified: .
In this example, the peach-shaded area shows the same data for the same hour one day earlier. The spike in the metric value (events per minute) is clearly visible.Figure 2. Anomaly card In this example, the pink-shaded area represents the baseline values for the same hour in the previous week.Figure 3. Anomaly card with baseline values one week earlier For more information on the kinds of anomalies that you might encounter, see Types of anomalous behavior.
- Meaningful log properties
- On the Meaningful log properties card, each bar chart shows the distribution of values for a single log property that contributed to the anomaly. Each property value is associated with a color. The length of a color bar correlates to the percentage that the property value
holds in comparison with all other values for the property. For the p_a5 property in the example, the value EUR appeared in 56.12% of log lines, GBP in 13.67%, and so on.
Figure 4. Meaningful log properties - Top alerts
-
The Top alerts card displays summaries of data from the Similar alerts and Repeated alerts tabs. The Total results value is the sum of the two values. Click More details to open the Alert Insight Similar Alerts tab. For details, see Information on the Alert Insight Similar Alerts tab.
Figure 5. Top alerts - Top incidents
-
The Top incidents card displays summaries of data from the Incidents on CI and Incidents on related CIs tabs. The Total results value is the sum of the two values. Click More details to open the Incidents on CI tab.
Figure 6. Top incidents