---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Analyze log lines around an anomaly

# Analyze log lines that surround an anomaly in Health Log Analytics {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Review the log lines around an anomaly
to help you identify the root cause of a Log Analytics alert.

## Before you begin

For background information, see [Analyze log lines to identify an alert root cause](https://www.servicenow.com/docs/mX_12iVn5JTgym9vDKoPtA "When Health Log Analytics identifies an anomaly, viewing the logs that surround the anomaly provides clues about the state of faulting systems. This information can help you narrow down the root cause of an alert.").

Role required: evt_mgmt_operator or evt_mgmt_admin

## Procedure

1. In the Service Operations Workspace, open a Log Analytics alert.
2. Select the Surrounding logs tab and review the information.  
   The tab displays the list of log lines that were generated one minute before and one second after the Log Analytics alert. For an explanation of the information on the tab, see [Surrounding logs tab fields](https://www.servicenow.com/docs/sGVLnfd7i3YQrTAT_qLoeg "This section describes the information displayed on the Surrounding logs tab.").
3. **Optional:** View a different time span of the log lines using one of the following methods:
   * Update the time range relative to the alert to a predefined time range in the Select range list.
   * Specify a Start time or End time using the time picker.
   {#hla-op-surrounding-logs-view-sow__choices_k4z_1r5_hnb}
4. **Optional:** View the anomalous log data graphically as a function of time by selecting Log viewer.
{#hla-op-surrounding-logs-view-sow__steps_lf2_1rr_stb}