--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Monitor log data flow and optimize integration settings # Monitor log data flow and optimize integration settings {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Monitor log data flow and optimize integration settings The Overview screen in Health Log Analytics (HLA) provides a detailed view of the log-processing pipeline for a specific active integration. It enables ServiceNow administrators to monitor the streaming status of log data from sources through the MID Server (or ITOM Gateway for certain integrations) to the HLA engine. This screen helps troubleshoot streaming issues, provides real-time metrics, and allows quick access to related configuration pages and the Log Viewer, enhancing operational visibility and control over log data ingestion. Show full answer Show less ## Key Features * **Streaming Status Monitoring:** Displays the current status of log data flow between the log source, MID Server or ITOM Gateway, and the HLA engine, including logs per minute metrics. It automatically refreshes every minute and can be customized via system properties. * **Streaming Failure Handling:** If streaming fails, the integration is automatically deactivated, and the screen highlights the failure component with guidance or support references for resolution. * **Support for Multiple Integration Types:** Shows MID Server status for MID-based integrations and ITOM Gateway status for MID-less or OTLP integrations such as Amazon Data Firehose. * **Log Streaming Sources Table:** Lists all active log sources for the integration with details such as status, last event and processing times, and streaming rates of raw and preprocessed log lines. This table is not available for the System Logs Retriever integration. * **Warning Notifications:** Alerts administrators if no live data has streamed for a configurable interval (default 4 hours), ensuring timely awareness of data gaps. * **Direct Access to Configuration Pages:** Provides links to Data Input Mapping, Source Type Structures, Log Sources, and the Log Viewer, contextualized to the current integration for efficient troubleshooting and configuration. ## Practical Use and Outcomes ServiceNow administrators can use the Overview screen to ensure continuous and healthy log data flow into their instance, which is critical for real-time anomaly detection and alert generation by HLA. For example, if log streaming to the MID Server fails due to authentication errors, administrators can quickly identify the issue through status indicators and error messages, correct credentials, and restore the connection. Once streaming resumes, HLA can process logs and generate alerts effectively. This functionality helps maintain operational continuity and improves the reliability of log analytics and monitoring workflows. The Overview screen in Health Log Analytics provides a comprehensive view of the components in the log-processing pipeline of a specific active integration. From this screen, you can troubleshoot any streaming issues for this integration and adjust its settings if needed. The Overview screen shows the log data streaming status and streaming sources of an active integration. It provides direct access to the Data Input Mapping, Source Type Structures, and Log Sources pages, as well as the Log Viewer, all with context from the current integration. Figure 1. Overview screen and View menu items ## Streaming status {#hla-integration-overview-tab__section_hq5_fsw_vfc} The Streaming status section on the Overview screen shows the status of data streaming between the log source and the MID Server and between the MID Server and the HLA engine. In addition, it displays the number of logs per minute passing through the MID Server and through the HLA engine. Note: For the ServiceNow System Logs Retriever integration, the Overview screen doesn't display the MID Server streaming status because that integration doesn't run on a MID Server. The ServiceNow AIOps component shows the total number of alerts that the HLA engine has created. These statistics are updated when the Overview screen loads and are automatically refreshed every minute to show live data. You can change the default auto-refresh time interval through the system property sn_itom_integ_app.overview_page_data_input_stats_auto_refresh_interval_seconds. If data streaming fails, the integration is automatically deactivated and the Streaming status marks the component where the failure occurred. In addition, a banner explains the failure and either proposes steps to take to fix it or refers to ServiceNow support. For MID-less or OpenTelemetry Protocol (OTLP) integrations, such as Amazon Data Firehose, the Overview screen displays the ITOM Gateway as a component in the log-processing pipeline. The MID Server component is not shown in the pipeline, because log data is sent directly from the source to the ITOM Gateway. The logs are then processed by the HLA engine to find anomalies. For these integrations, the Overview screen shows the average rate of logs per minute over the last 15 minutes passing through the ITOM Gateway and the HLA engine, similar to the metrics shown for MID-based ingestion. Note: The ITOM Gateway component is shown only if the MID Server property mid.hla.itom_gateway_streaming.enabled is set to true. For more information, see [MID Server properties](https://www.servicenow.com/docs/access?context=r_MIDServerProperties&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US). When the integration isn't streaming live data from the source, a warning message is displayed. There is a 4-hour interval between the last log source time and the current time before this message is generated. You can change the default time interval through the system property sn_itom_integ_app.overview_page_log_source_time_threshold_hours. Note: The warning message is displayed only when the HLA engine is up and running. ## Log streaming sources {#hla-integration-overview-tab__section_edy_dsw_vfc} The Log streaming sources section displays all sources that are currently streaming log data to HLA through this integration. Depending on your integration, the Log streaming sources table displays the following information about the integration's log streaming sources. Note: This table isn't available for the ServiceNow System Logs Retriever integration. {#hla-integration-overview-tab__table_gjq_xtk_pcc__entry__2} | Column | Description | |-|-| | Name | The name of the log data source. | | Status | The streaming status: Active or Not active. | | Data input | The integration streaming the data to your ServiceNow instance. | | MID Server | The MID Server to which the log data is streaming. | | Last event time | The time when the integration received the latest event. | | Last log processing time | The time when the last log was received or processed. | | Raw log lines/sec | The average number of raw log lines that streamed to the MID Server per second in the last one-minute interval. Note: This value represents the number of raw log lines before preprocessing. | | Pre-processed log lines/sec | The average number of preprocessed log lines that streamed to the MID Server per second in the last one-minute interval. Note: This value can differ from the number of raw log lines per second. For example, the difference can be a result of logs having been dropped during preprocessing. | [Table 1. Log streaming sources] {#hla-integration-overview-tab__table_gjq_xtk_pcc} ## Example {#hla-integration-overview-tab__section_okh_hnk_mhc} As an admin, you use the integration Overview page to verify continuous data flow into the ServiceNow instance. If log streaming fails, HLA doesn't receive the real-time data needed to detect anomalies or generate alerts. For example, the Streaming Status for an active Elasticsearch integration may show a red circle with a white X for the MID Server component in the log-processing pipeline. This indicates that logs are not reaching the MID Server. The Log Streaming Sources table shows a state of Authentication Failed or Connection Error, with an error message indicating invalid credentials. This points to an issue with the Elasticsearch credentials. Fixing the credentials and either restarting the log service or waiting for the next polling cycle, restores the connection. The Log Streaming Sources table now shows a connection state of Connected or Active with successful authentication. The Streaming Status displays a green circle with a white check mark for the MID Server component. With log streaming restored, HLA can resume processing data and generating anomaly alerts. **Related tasks** * [Review log streaming data and adjust integration settings in Health Log Analytics](https://www.servicenow.com/docs/c93sPag2a8S34_XnnjmqaQ "Review the log data streaming status and streaming sources of an active integration for Health Log Analytics on the integration's Overview screen. From this tab, you can investigate streaming issues and refine the integration settings. Leverage the displayed data to refine how HLA reads the log data by adjusting the integration's configuration.")