ITOM deep-dive · Lesson

Health Log Analytics

Quick answer

Health Log Analytics (HLA) reads the log streams from your applications and infrastructure and detects anomalies before they become outages, spotting the unusual pattern that precedes a failure, often ahead of any threshold-based alert.

Key takeaways

Logs as an early-warning signal
How it works
Part of AIOps
Common mistakes

Health Log Analytics (HLA) reads the log streams from your applications and infrastructure and detects anomalies before they become outages, spotting the unusual pattern that precedes a failure, often ahead of any threshold-based alert.

Logs as an early-warning signal

Where Event Management reacts to alerts that monitoring tools already raised, HLA looks deeper, at raw logs, and learns each system's normal behaviour. A sudden spike in error patterns or log volume becomes an anomaly signal.

Log streams  -->  learn a baseline of "normal" per source
                   detect deviation (error spike, volume surge, new pattern)
                   -->  anomaly alert  -->  bound to a CI  -->  AIOps pipeline

How it works

Ingest

Collect logs from apps, hosts and services via the MID Server / agents.

Baseline

Machine-learn normal log behaviour per source over time.

Detect

Flag deviations, anomalies, and score them.

Correlate

Bind anomalies to CIs and feed the same alert pipeline as Event Management.

Part of AIOps

HLA reduces mean-time-to-detect by catching the anomaly in the logs rather than waiting for a hard failure and a user complaint. It complements Event Management (which needs a threshold to trip) by finding the unknown-unknowns, patterns no one wrote a rule for.

Common mistakes

Expecting value on day one, the baseline needs time to learn.
Feeding it unstructured, unlabelled logs and hoping for signal.
Treating HLA as a replacement for, not a complement to, Event Management.
Ignoring the anomalies it raises because they don't fit an existing rule.

Want to learn this properly?

Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.

See the course Ask a question

Check your understanding

HLA detects problems by:
- A. Learning normal patterns and flagging anomalies
- B. Scanning ports
- C. Sending surveys
Show answer
A. Learning normal patterns and flagging anomalies
HLA baselines normal behaviour and surfaces deviations.
HLA sits at which end of ITOM?
- A. Proactive / early warning
- B. Purely reactive
- C. Reporting only
Show answer
A. Proactive / early warning
HLA aims to catch issues before they become incidents.
Anomalies are most useful when mapped to:
- A. Configuration items
- B. Fonts
- C. Portals
Show answer
A. Configuration items
Mapping to CIs gives the anomaly business context.

Frequently asked questions

What does the term Health Log Analytics refer to in ServiceNow?

What is another point to note about Health Log Analytics?

Where Event Management reacts to alerts that monitoring tools already raised, HLA looks deeper, at raw logs, and learns each system's normal behaviour.

What else is worth knowing about Health Log Analytics?

A sudden spike in error patterns or log volume becomes an anomaly signal.

What tends to go wrong with Health Log Analytics?

Expecting value on day one, the baseline needs time to learn. Feeding it unstructured, unlabelled logs and hoping for signal. Treating HLA as a replacement for, not a complement to, Event Management.