Sections on the Overview tab for Log Analytics groups

For a detailed description of Log Analytics groups, see Types of Health Log Analytics alerts.

Correlations banner

During initial analysis, alerts are scored. Each correlation in the alert's log data with another alert contributes to the score. The higher the score, the more likely the alert is to be included as a Log Analytics alert in a Log Analytics alert.

The following kinds of data are considered when determining whether alerts are correlated:

• Time: The events all occurred within a configured time interval.
• Metadata: The alerts have matching values in log-line metadata. For example, all alerts involve the same host.
• Message text: The message text in the log data is similar or identical between alerts.
• Trend: The alerts show a similar tendency in values or rates. For example, a particular metric value is increasing in all alerts.

Click the More info link on the Correlations banner to view the list of correlations that relate the Log Analytics alerts.

1. List of correlations: The first correlation in the list is expanded to show the individual Log Analytics alerts that are correlated and the log correlator that the alerts share. The number in parentheses is the number of alerts in the correlation.
2. An individual log correlator: The identifier for a group of correlated Log Analytics alerts. The alerts are grouped by the log-line data or metadata that is common to the alerts (for example, IP address, host name, or user name). The number in parentheses indicates the number of correlated alerts.
3. Log Analytics alerts that are correlated.

Alerts in group

For a Log Analytics alert (Alert0010166 in the example), the Alerts in group section shows the Log Analytics alerts that are grouped under the Log Analytics alert.

Click a Log Analytics alert to view its details. To view the full list of Log Analytics alerts, click View more or click the Alerts in group tab.

Configuration Items

To view more detailed information on the CIs that are associated with the alerts, click the Configuration Items tab or click View more in the Configuration Items section. See Operator phase 1: Analyze and acknowledge an alert.

Impacted services

To view detailed information on the services that are impacted by the alerts, click the Impacted services tab. See Operator phase 1: Analyze and acknowledge an alert.