---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Log Analytics alerts

# Overview tab sections for Log Analytics alerts {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The Overview tab in Health Log Analytics helps you understand Log Analytics alerts.
For a detailed description of Log Analytics alerts, see [Types of Health Log Analytics alerts](https://www.servicenow.com/docs/3rjQy6fEjIlRvY0_DLUWhQ "Health Log Analytics generates several types of alerts.").

## Summary {#hla-op-ovrvw-tab-single-ci-alerts-sow__section_bps_jnw_wtb}

Identified issue

:   This card describes the issue that led to the alert. The identified issue appears on the card and in the title for the alert. Information about the alert appears in the banner.

    Figure 1. Identified issue

    Select Details for more information about the alert.

    Select View surrounding logs to view the log lines that were generated one minute before and one minute after the alert. See [Analyze log lines that surround an anomaly in Health Log Analytics](https://www.servicenow.com/docs/Rfllo06J_J2v3UwOQOUKug "Review the log lines around an anomaly to help you identify the root cause of a Log Analytics alert.").

Anomaly

:   This card illustrates the anomalous activity that led to the alert.

    The chart shows:

    * Recent anomalous activity
    * Expected behavior (the learned baseline)
    * Baseline values from one day earlier
    * Baseline values from the previous week
    {#hla-op-ovrvw-tab-single-ci-alerts-sow__ul_jdh_wdm_4tb}  
    In this example, the system tracks the baseline rate (the average number of events per minute) for a specific log pattern. When this typically inactive log generates a spike in events, the system detects the deviation from the baseline and generates an alert.Figure 2. Anomaly card

    In this example, the blue line represents the current average number of events per minute. The orange-shaded area represents the baseline values for the same hour in the previous week.  
    Figure 3. Anomaly card with baseline values one week earlier

    For more information on the kinds of anomalies that you might encounter, see [Types of anomalous behavior in Health Log Analytics](https://www.servicenow.com/docs/N_chw7Cp7ha8QAeOVFikGw "Anomalous behavior in a CI or a service can indicate an important issue. For example, a spike in the frequency or number of messages of a particular type can indicate a problem.").

## Impact {#hla-op-ovrvw-tab-single-ci-alerts-sow__section_wjf_4nw_wtb}

Configuration Items
:   This card provides information about the CIs that are impacted by the alert.

Impacted services
:   This card provides information about the services that are impacted by the alert.  
    Figure 4. Impact section

## Cause {#hla-op-ovrvw-tab-single-ci-alerts-sow__section_pms_xnw_wtb}

Meaningful log properties
:   On this card, each bar chart shows the distribution of values for a single log property that contributed to the anomaly. Each property value is associated with a color. The length of a color bar correlates to the percentage that the property value
    holds in comparison with all other values for the property.  
    Figure 5. Meaningful log properties