---
sourceDocument: Zurich IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-operations-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Log Analytics alerts on the Alerts in group tab

# Log Analytics alerts on the Alerts in group tab {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Log Analytics alerts on the Alerts in group tab

This content explains the columns and details presented in theAlerts in grouptab for Log Analytics alerts within a Log Analytics group, as viewed in the ServiceNow Operator Workspace dashboard.
It helps ServiceNow customers understand how to interpret alert data generated by Health Log Analytics and prioritize their response effectively.
Show full answer Show less  

## Key Features

* **Number:** Unique identifier for each alert, clickable to access detailed alert information.
* **Group:** Indicates whether the alert is a standalone Log Analytics alert or part of a Component-based alert group.
* **Description:** Explains the anomalous pattern or metric that triggered the alert.
* **Severity:** Categorizes alerts by impact level, ranging from Critical (immediate action) to Info (informational) and Clear/Resolved (no action needed).
* **Priority group:** Defines alert resolution order with values Urgent, High, Moderate, and Low. Priority group holds more weight than severity alone for response prioritization.
* **State:** Shows alert processing status, including Open, Reopen, Flapping (frequent repeated events), and Closed (resolved alerts).
* **Configuration item (CI):** The CMDB item affected by the alert.
* **Node:** The specific node or asset referenced in the log message, often matching the CI name or identifier (e.g., computer name, IP address).
* **Source:** Always listed as Log Analytics, indicating the alert was generated by Health Log Analytics.
* **Metric name:** The specific metric whose anomaly caused the alert, such as a delayed I/O request.
* **Updated:** Timestamp of the most recent update to the alert's information or state.

## Key Outcomes

By understanding these columns and their meanings, ServiceNow customers can efficiently interpret Log Analytics alerts, determine the criticality and priority of issues, and take appropriate action to maintain system health. This enables faster triage and resolution of anomalies detected in monitored metrics, improving operational reliability.  
The table describes the Log Analytics alerts in a Log Analytics group on the Alerts in group tab.
{#hla-alerts-in-group-ref__table_egk_qqf_tmb__entry__2}

| Column | Description |
|-|-|
| Number | The number of the alert that appears in the list of alerts on the Operator Workspace dashboard. To view detailed information for an alert on the Details tab, click the alert number. This field is automatically set. |
| Group | Type of group that the alert belongs to: a standalone Log Analytics alert or a Component-based alert. |
| Description | Anomalous pattern or metric that caused the alert to be generated. |
| Severity | Severity value for the alert. The available values are: * Critical: Immediate action is required. Either the resource is not functional or critical problems are imminent. * Major: Major functionality is severely impaired or performance has degraded. * Minor: Either performance has degraded or there is a partial, non-critical loss of functionality. * Warning: Attention is required even though the resource is still functional. * Info: An informational message. An alert is created, but the resource is still functional. * Clear or Resolved: No action is required. An alert is not created from this event. Existing alerts are closed. {#hla-alerts-in-group-ref__ul_vmx_h5t_hdb} |
| Priority group | Priority group that indicates the order in which to resolve alerts. Choices are as follows: * Urgent * High * Moderate * Low {#hla-alerts-in-group-ref__ul_nct_h3f_vmb} The priority group value is more important than severity alone. For example, a high priority and low severity alert should be addressed before a low priority and high severity alert. For information on how priority is calculated, see [Alert priority](https://www.servicenow.com/docs/qP5u8HVuH4tRZvuPase~mQ "Determine the order in which to handle alerts according to the alert priority score. Multiple factors determine the alert priority score and this value changes with changes to the underlying factors."). |
| State | Processing state of the alert. A newly generated alert is in the Open state. Other states are as follows: * Reopen: A previously closed alert is open again, and it requires your attention. * Flapping: The alert is receiving identical events from the same source at high frequency. This state can cause an alert to re-open from the Closed state, resulting in a high frequency of changes between Open and Closed states. * Closed: The alert is closed and does not require any further action. You close an alert when it is remediated. {#hla-alerts-in-group-ref__ul_wmx_h5t_hdb} |
| Configuration item | CI in the CMDB. The CI is applied to by the alert. |
| Node | Node field that is received in the log message. The event described in the log message occurred on this node. Often, the node is the name of the CI that is associated with the alert. For example, a computer name, IP address, FQDN, or MAC address. |
| Source | All Log Analytics alerts have the value Log Analytics in the Source column to indicate that Health Log Analytics generated the alert. |
| Metric name | Name of the metric whose anomalous behavior led to the alert. For example, the I/O request in the case that the I/O request took longer than 15000 ms to complete. |
| Updated | Most recent time when the alert information or state was updated. |
[Table 1. Alerts in group tab]

{#hla-alerts-in-group-ref__table_egk_qqf_tmb}