Viewing the logs for an alert on the Log viewer

  • Release version: Xanadu
  • Updated August 1, 2024
  • 2 minutes to read

    • The Log viewer in the Service Operations Workspace enables you to browse the logs by timestamp or time range, to search for particular log text, and to visualize the frequency of anomaly occurrences in a particular time period. If you discover an important metric in the log data, you can use it to define a Log Analytics alert rule.

    The Log viewer displays a chart of the frequency of anomalous log lines during one minute before and one minute after the Log Analytics alert. In addition, the viewer lists the associated log lines.

    Table 1. Information on the Log viewer table
    Column Description
    Time Timestamp of the log line in the format that the source uses. If no value appears, then check the source type structure of the raw data.
    Application service Application service in which the metric was found.
    Component Logical component of the service instance that generated the event. Multiple CIs can sometimes perform the same function.
    Message Inner message of the raw log line that contains the text of the system-generated log message regarding the nature of the occurrence.
    Level Type of event. The available values, in order of importance, are:
    • Emergency
    • Alert
    • Critical
    • Error
    • Warning
    • Notice
    • Informational
    • Debug
    Host Host identifier from the log line that consists of the hostname or IP address of the endpoint.
    Log message The raw log message without the header.
    Note:
    By default, the Raw message column does not appear in the Log viewer table. You can display this column by selecting it from the Filters pane. For more information, see Customize the Log viewer table.
    You can personalize the displayed data on the Log viewer:
    Note:
    These features are supported in the Health Log Analytics application, Version 20.0.11 - July 2021, and the Health Log Analytics Viewer application, Version 20.0.4 - July 2021, available from the ServiceNow Store.

    As you analyze the logs for an alert, you can modify the search query to fine-tune the search, and save useful searches. For more information, see Define, save, and share a search of log data.

    If you discover important relationships in the log data, you can define the type of alert that the data should trigger. For more information, see Add a Log Analytics alert rule.