---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Review logs surrounding the anomaly

# Review logs surrounding an anomaly {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
When Health Log Analytics identifies an anomaly, viewing the logs that surround the anomaly provides clues about the state of faulting systems. This information can help you narrow down the root cause of an
alert.
While viewing a Log Analytics alert, the Surrounding logs tab lists the log lines that were generated one minute before and one second after the anomaly occurred. The log lines are related to the metric
or pattern that triggered the alert. The list is filtered to the relevant component.

Logs generated immediately before the anomaly might
indicate warning signs or
conditions that led to the issue. By reviewing these logs, you can trace the sequence of events that led to the anomaly, helping you understand what went wrong. Logs created right after the anomaly can help you evaluate the
impact of the event by analyzing how the system responded and whether other components were affected. The timeline of the logs around the anomaly can help clarify what might have caused the issue, for example a configuration
change or a software update.

You can modify the time range of the displayed log lines. For example, investigate logs from more than one minute before the anomaly or more than a second afterward.  
Note:  
Logs that surround the anomaly are retained and available for 30 days after the creation of the alert. The system does not delete these logs when the global retention period of logs expires. When the retention period expires, the surrounding logs are available only on the Surrounding logs tab and not in the Log viewer.

Health Log Analytics enables you to view the anomalous log data graphically on the Log viewer, accessed from the Service Operations Workspace. The Log viewer displays a chart of the frequency of anomalous log lines during one minute before and one minute after the Log Analytics alert. It lists the associated log lines and automatically shows the query that relates to the anomaly, the selected component, and the appropriate time filter. For more information, see [Review alert-related logs on the Log Viewer](https://www.servicenow.com/docs/VSxmRMC7yhr1sTwLkZrmeA "The Log Viewer tab in Health Log Analytics lets you browse the logs for an alert by timestamp or time range, and visualize anomaly frequency within a specific time period. Customizing the displayed data and adjusting time filters enables you to better understand the framework in which the anomaly occurred, helping you find the root cause faster.").
* **[Analyze log lines around an anomaly](https://www.servicenow.com/docs/9B5JdjdM3~h6MH~~~3OrWQ)**   
  Review the log lines around an anomaly to help you identify the root cause of a Log Analytics alert.

**Related tasks**   

* [Analyze log lines around an anomaly](https://www.servicenow.com/docs/9B5JdjdM3~h6MH~~~3OrWQ "Review the log lines around an anomaly to help you identify the root cause of a Log Analytics alert.")