--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Analyzing and resolving alerts # Analyzing and resolving Log Analytics alerts {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Analyzing and resolving Log Analytics alerts As a ServiceNow Operator, you are tasked with analyzing and resolving alerts generated by Health Log Analytics (HLA). When an alert is created, you assess its severity, review the impacted configuration items (CIs), examine the related log data, and consider the affected services. Your goal is to identify the root cause by investigating logs surrounding the anomaly to resolve issues proactively before they impact users. Show full answer Show less ## Key Features * **Express List and ServiceNow Otto:** Use the Express List to access alert details and leverage ServiceNow Otto for in-depth, human-readable analysis and suggested resolutions. * **Log Viewer:** Browse alert logs by timestamp or range to investigate further, with the ability to visualize anomalous log line frequency over time for a clearer understanding of issues. * **Alert Remediation:** Initiate remediation directly from the alert Overview tab, which consolidates alert information, associated log data, impacted CIs, and services. * **Log Correlators:** Identify relationships between multiple alerts to determine if they are symptoms of a broader problem. * **Knowledge Base Integration:** After resolving an alert, add a knowledge base (KB) article to document the solution and assist others in handling similar issues. * **Terminology Reference:** Access Health Log Analytics terminology for quick reference to key terms and concepts used within HLA. ## Practical Use and Outcomes By following this process, ServiceNow customers can proactively monitor their ServiceNow instance to detect and resolve emerging issues efficiently. Utilizing the tools provided, Operators can quickly pinpoint root causes, take corrective actions, and reduce downtime or service degradation. Adding KB articles enhances organizational knowledge and streamlines future alert resolution efforts. Analyze and resolve Log Analytics alerts by investigating log data and taking action to resolve the underlying issue. ## Overview of analyzing and resolving a Log Analytics alert {#hla-analyzing-resolving-hla-alert__cf-using-parent-workflow} As an Operator, you're responsible for analyzing and resolving the alerts that Health Log Analytics generates. When HLA creates an alert, you review the alert's severity, the affected configuration item (CI), the log data associated with the anomaly, and the impacted services. You try to identify the root cause by investigating the logs that surround the anomaly. In the Express List, review alert details and use ServiceNow Otto to get an in-depth analysis of the alert and potential resolutions in straightforward, human-readable language. By drilling down into the alert, you can quickly identify the issue and proceed to resolve it before it affects your users. Using the Log Viewer, you can browse the alert logs by timestamp or range for further investigation. You can visualize the frequency of anomalous log lines in a chart. More detailed information on tasks and procedures for analyzing and resolving Log Analytics is available via the following links. * [Start remediation of a Log Analytics alert from the Overview tab](https://www.servicenow.com/docs/qRAwj0H7oEoFaJ0FBUxeTg "Begin the remediation process of a Log Analytics alert from the alert Overview tab. This tab provides information on the alert, the log data associated with the anomalous behavior, CIs associated with the alert, and services impacted by it.") Begin the remediation process of a Log Analytics alert from the alert Overview tab. This tab provides information on the alert, log data associated with the anomalous behavior, CIs associated with the alert, and services impacted by it. * [Analyze log lines to identify an alert root cause](https://www.servicenow.com/docs/mX_12iVn5JTgym9vDKoPtA "When Health Log Analytics identifies an anomaly, viewing the logs that surround the anomaly provides clues about the state of faulting systems. This information can help you narrow down the root cause of an alert.") Review the log lines surrounding the anomaly for clues about the state of faulting systems. This information can help you narrow down the root cause of the alert. * [Use log correlators to identify relationships in log data](https://www.servicenow.com/docs/4cgoFJ1d9WVr7r7Qy34mkg "In Health Log Analytics, log correlators are keys or values in log data that detect correlations between alerts. These correlations help you determine whether an alert is part of a larger issue.") Identify relationships between alerts to help you determine whether an alert is part of a larger issue. * Navigate to the [Express List](https://www.servicenow.com/docs/OQGRlatOdPinWYNcPHzHnQ "Express List helps you identify health issues across the datacenter on the Service Operations Workspace. It provides quick information on alerts so you can monitor systems and services,​ resolve alerts, evaluate the alert impact,​ track issues, and report incidents more efficiently.") and select an alert from the Alerts list. Use ServiceNow Otto to get an in-depth analysis of the alert and potential resolutions. By drilling down into the alert, you can quickly identify the issue and proceed to resolve it. * [Review alert logs on the Log viewer](https://www.servicenow.com/docs/5c5_griymLoxpOqRTn4AUw "The Log Viewer tab lets you browse the logs for an alert by timestamp or time range, and visualize anomaly frequency within a specific time period. Customizing the displayed data and adjusting time filters enables you to better understand the framework in which the anomaly occurred, helping you find the root cause faster.") For further investigation, navigate to the Log Viewer to browse alert logs by timestamp or time range. You can visualize anomaly frequency within a time period for a comprehensive view of log data. * [Add a KB article to a Log Analytics alert](https://www.servicenow.com/docs/zyo5POzPEMzS7FcmbI9gaw "Add your own knowledge base (KB) article to an alert that was generated by Health Log Analytics. For example, you can provide additional information that might help to resolve the underlying issue.") When you have resolved an alert that Health Log Analytics generated, you can add a knowledge base (KB) article to it. For example, you can provide information that might help others resolve similar issues. {#hla-analyzing-resolving-hla-alert__cf-using-parent-steps-ul} For a brief explanation of key terms and concepts used in HLA, see the [Health Log Analytics terminology](https://www.servicenow.com/docs/0Dx8RD4VxH6xv_QvHs30~A "Before getting started with Health Log Analytics, it's important to familiarize yourself with some key concepts used in the application."). ## Use cases {#hla-analyzing-resolving-hla-alert__cf-using-more-info} [Use Case: Proactive monitoring of your ServiceNow instance in Health Log Analytics](https://www.servicenow.com/docs/G293AkkY3zb1kIRoFuX1YQ "Use Health Log Analytics to detect and resolve emerging issues in your organization's ServiceNow instance before they negatively impact users.") - Use Health Log Analytics to detect and resolve emerging issues in your organization's ServiceNow instance before they affect platform users.