---
sourceDocument: Xanadu IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/it-operations-management

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# How Health Log Analytics generates alerts

# How Health Log Analytics generates alerts {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

ServiceNow
Health Log Analytics identifies patterns in log data and learns pattern behavior. When its artificial intelligence engine detects anomalous behavior, it sends an event to the ServiceNow
Event Management application. These predictive alerts enable operators to remediate emerging IT issues before they impact users.

## What is an anomaly {#hla-op-anomalies-detecting__section_vlx_gtf_qmb}

There are many kinds of anomalous (abnormal or unexpected) behavior. In this example, the
system tracks the baseline rate---the average number of events per minute---of particular messages.
The chart shows the values for the previous day as the lightly peach-shaded area and the values
for today as a blue line. The chart shows a dramatic deviation from the expected baseline values
at around 10:10. This anomalous behavior generates an alert.
Figure 1. Anomalous behavior

Anomalous behavior at around 10:10.
Health Log Analytics uses the following methods to generate alerts:

## Alert metrics {#hla-op-anomalies-detecting__section_mh2_1q2_ymb}

Health Log Analytics monitors multiple metrics in the log stream to detect
anomalous behavior. Each metric is associated with a unique source. A source is the combination
of service instance and
component. When the system identifies an anomalous pattern for a metric, it generates an
alert.  
Operators can provide the following types of feedback about alerts to "teach" the application whether a specific alert is significant or it should be muted.

* A significant alert is more likely to be included in a Log Analytics group when the associated metric behaves anomalously. For more information, see [Mark an alert as significant](https://www.servicenow.com/docs/aV4p64d18irp4qP0WJpznA "Make an alert more likely to be included in a Log Analytics group when the associated metric behaves anomalously by labeling the alert as meaningful.")
* Mute an alert for a specified source to eliminate distracting new alerts for unimportant issues. For more information, see [Mute an unimportant alert](https://www.servicenow.com/docs/jiKNp_h0Vxa7emQ7K64ndg "Eliminate distracting new alerts for insignificant issues by muting them.").
* When the situation changes, you can return a significant metric to its default significance. You can also reactivate a muted metric to cause the system to start generating alerts again. For more information, see [Restore a muted alert or a significant alert](https://www.servicenow.com/docs/iu4S47I1zn0But5iQsmSTA "If you no longer want a muted alert or an alert that was marked as significant to be treated specially, you can restore normal importance to the metric involved in generating it.").
{#hla-op-anomalies-detecting__ul_a1n_stg_f4b}

## Lexical keywords {#hla-op-anomalies-detecting__section_gdn_bbn_3nb}

Lexical keywords can indicate important issues in log entries.

The system sets a threshold for each lexical keyword. It bases the threshold on the normal
occurrence pattern and frequency of the keyword. The system detects all occurrences of the
keyword. When the pattern or frequency exceeds the threshold, the system generates an alert. For
more information, see [View the lexical keywords that generate alerts](https://www.servicenow.com/docs/5CgTjb5H3EWh7iCQrsVPvQ "View the list of lexical keywords that can indicate important issues in log entries.").

## Correlations {#hla-op-anomalies-detecting__section_jxp_dq2_ymb}

Log correlators are keys or values in log data that detect correlations between alerts. For example, a log correlator could detect when the interface ID of a particular network device occurs simultaneously in multiple warnings across different service instances. For more information, see [Using log correlators to detect relationships in log data](https://www.servicenow.com/docs/8QdAOI6qABa5Sj~HHrBpnw "Log correlators are keys or values in log data that detect correlations between alerts. For example, a log correlator could detect when the interface ID of a particular network device occurs simultaneously in multiple warnings across different service instances.").

## Advanced alert filtering {#hla-op-anomalies-detecting__section_drm_y1n_3nb}

Add advanced log alert filters to scan alerts for conditions that you specify. The filters reduce noise by dropping alerts that do not indicate a significant issue. While developing a filter, you can test, update, publish, or activate the filter at any time. For more information, see [Create advanced log alert filters](https://www.servicenow.com/docs/tUClTL5qXvj0CaK5TmrOMQ "Add advanced log alert filters to scan alerts for conditions that you specify. The filters reduce noise by dropping alerts that do not indicate a significant issue. While developing a filter, you can test, update, publish, or activate the filter at any time.").

## Custom alert rules {#hla-op-anomalies-detecting__section_vxf_lj2_knb}

Define a Log Analytics alert rule when you encounter log data that should generate an alert. The alert rule generates an alert for a specified metric with a threshold that you specify and sets the properties of the generated alert. For more information, see [Add a Log Analytics alert rule](https://www.servicenow.com/docs/OBQKsNOIKfTKGMr2tc2SLQ "Define a Log Analytics alert rule when you encounter log data that should generate an alert. The alert rule generates an alert for a specified metric with a threshold that you specify and sets the properties of the generated alert.").