--- sourceDocument: Yokohama IT Operations Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management Release : - yokohama ft:locale : - en-US ft:publication_title : - Yokohama IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # How Health Log Analytics generates alerts # How Health Log Analytics generates alerts {#ariaid-title1} * Release version: Yokohama * * Updated January 30, 2025 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of How Health Log Analytics generates alerts Health Log Analytics (HLA) uses AI to identify patterns and detect anomalies in your log data. When it finds unusual behavior, it sends predictive alerts to the ServiceNow Event Management application. These alerts help operators proactively address IT issues before they impact users, enhancing operational efficiency and system reliability. Show full answer Show less ## Alert Generation Methods * **Log Anomaly Detection:** HLA tracks baseline metrics like the average rate of specific log messages over time. Significant deviations from this baseline trigger alerts, allowing early identification of abnormal system behavior. * **Alert Metrics:** Metrics are monitored per unique source (service instance and component). When anomalies occur in a metric, an alert is generated. Operators can provide feedback to mark alerts as significant or mute them, improving alert relevance and reducing noise. * **Lexical Keywords:** HLA scans logs for critical keywords (e.g., "crashed," "failed") and generates alerts when their occurrence exceeds defined thresholds. This helps detect issues indicated by specific log terms. * **Correlations:** Log correlators identify related alerts by detecting common keys or values across different log entries, enabling correlation of issues across multiple service components. ## Alert Management and Customization * **Feedback and Tuning:** Operators can mark alerts as significant to increase their priority or mute less important alerts to avoid distractions. Muted alerts stop generating until reactivated. * **Advanced Alert Filtering:** Custom filters can be created to drop non-significant alerts based on specified conditions, further reducing noise and focusing on critical issues. * **Custom Alert Rules:** Users can define alert rules for specific log metrics and thresholds, enabling tailored alerting to meet unique operational needs. ## Practical Benefits for ServiceNow Customers By leveraging Health Log Analytics alerts, ServiceNow customers gain early detection of emerging IT incidents, reducing downtime and improving service quality. The ability to customize, mute, or prioritize alerts ensures that operators receive actionable notifications without overwhelming noise. Integrating these alerts into Event Management streamlines incident response workflows and supports proactive IT operations. Health Log Analytics identifies patterns in your log data and learns pattern behavior. When HLA's AI engine detects anomalous behavior, it sends an event to the ServiceNow Event Management application. As an operator, you can use these predictive alerts to handle emerging IT issues before they impact users. ## Log anomaly detection {#hla-op-anomalies-detecting__section_vlx_gtf_qmb} There are many kinds of anomalous (abnormal or unexpected) behavior. In this example, the system tracks the baseline rate---the average number of events per minute---of particular messages. The chart shows the values for the previous day as the lightly peach-shaded area and the values for today as a blue line. The chart shows a dramatic deviation from the expected baseline values at around 10:10. This anomalous behavior generates an alert. Figure 1. Anomalous behavior Health Log Analytics uses various methods to detect anomalies and generate alerts. ## Alert metrics {#hla-op-anomalies-detecting__section_mh2_1q2_ymb} Health Log Analytics monitors multiple metrics in the log stream to detect anomalous behavior. Each metric is associated with a unique source: the combination of service instance and component. When the system identifies an anomalous pattern for a metric, it generates an alert. As an operator, you can provide feedback about the generated alerts. Your feedback "teaches" Health Log Analytics that a specific alert is significant or irrelevant to you. The application then either raises the priority of the alert metric or mutes it to reduce noise. * A significant alert is more likely to be included in a Log Analytics group when the associated metric behaves anomalously. For more information, see [Mark an alert as significant](https://servicenow-prod.fluidtopics.net/vbBe7V4SM7Jxz9B0cubT7A "Make an alert more likely to be included in a Log Analytics group when the associated metric behaves anomalously by labeling the alert as meaningful.") * Mute an alert for a specified source to eliminate distracting new alerts for unimportant issues. When a metric is muted, Health Log Analytics removes the current alert and any other alerts based on that metric from the feed. It also stops generating new alerts from that metric. For more information, see [Mute an unimportant alert](https://servicenow-prod.fluidtopics.net/ognPpLajLU0OZ4bNrWuNAw "Eliminate distracting new alerts for insignificant issues by muting them."). * When the situation changes, you can return a significant metric to its default significance. You can also reactivate a muted metric to cause the system to start generating alerts again. For more information, see [Restore a muted alert or a significant alert](https://servicenow-prod.fluidtopics.net/ZapYmJxNos59Ukxgg~ZLLw "If you no longer want a muted alert or an alert that was marked as significant to be treated specially, you can restore normal importance to the metric involved in generating it."). {#hla-op-anomalies-detecting__ul_a1n_stg_f4b} ## Lexical keywords {#hla-op-anomalies-detecting__section_gdn_bbn_3nb} Health Log Analytics scans your logs for words that can indicate important issues. Lexical keywords such as "crashed" or "failed" signal a condition that can merit attention. The system sets a threshold for each lexical keyword that is based on what it considers the normal occurrence pattern and frequency of that keyword in your logs. When it scans your logs, it finds all occurrences of the keyword. If the number exceeds the threshold, it generates an alert. For more information, see [View the lexical keywords that generate alerts](https://servicenow-prod.fluidtopics.net/hIWBHI1~1ZI2h~J~AzMccw "View the list of lexical keywords that can indicate important issues in log entries."). For information about managing global keywords, see [Add, edit, or delete Health Log Analytics lexical keywords](https://servicenow-prod.fluidtopics.net/JWUKsaJPYBAPesmZ38K0Hw "Manage the keywords that Health Log Analytics looks for in your log data."). To create or delete keywords for a specific source type, see [Configure source type capabilities](https://servicenow-prod.fluidtopics.net/XJbufIhIjrYtw5IoNifuDQ "Health Log Analytics extracts source types automatically in the mapping process. You can add timestamp formats and specify, delete, or exclude keywords for individual source types."). ## Correlations {#hla-op-anomalies-detecting__section_jxp_dq2_ymb} Log correlators are keys or values in log data that detect correlations between alerts. For example, a log correlator could detect when the ID of a particular network device occurs simultaneously in multiple warnings across different service instances. For more information, see [Log correlators for identifying related alerts](https://servicenow-prod.fluidtopics.net/Zgp6T7g6fBWpxgZrqK4A1g "In Health Log Analytics, log correlators are keys or values in log data that detect correlations between alerts. These correlations help you determine whether an alert is part of a larger issue."). ## Advanced alert filtering {#hla-op-anomalies-detecting__section_drm_y1n_3nb} Add advanced log alert filters to scan alerts for conditions that you specify. The filters reduce noise by dropping alerts that do not indicate a significant issue. While developing a filter, you can test, update, publish, or activate the filter at any time. For more information, see [Create advanced log alert filters](https://servicenow-prod.fluidtopics.net/qytzwSYJEw0kkX9336q~6Q "Add advanced log alert filters to scan alerts for conditions that you specify. The filters reduce noise by dropping alerts that do not indicate a significant issue. While developing a filter, you can test, update, publish, or activate the filter at any time."). ## Custom alert rules {#hla-op-anomalies-detecting__section_vxf_lj2_knb} Define a Log Analytics alert rule when you encounter log data that should generate an alert. The alert rule generates an alert for a specified metric with a threshold that you specify and sets the properties of the generated alert. For more information, see [Add a Log Analytics alert rule](https://servicenow-prod.fluidtopics.net/3fd~u5BXbP7EM4Qvmm5NPQ "Define a Log Analytics alert rule when you encounter log data that should generate an alert. The alert rule generates an alert for a specified metric with a threshold that you specify and sets the properties of the generated alert.").