ServiceNow Health Log Analytics: Log Anomalies

ServiceNow Health Log Analytics

Spot problems in log noise before they become outages.

Quick answer

Health Log Analytics ingests application and infrastructure logs through the MID Server or agents, learns a baseline of normal behaviour per source, and flags deviations such as an error spike or a new pattern as scored anomalies bound to CIs. It feeds the same alert pipeline as Event Management, and catches what no threshold rule was written for.

Key takeaways

Logs as an early-warning signal
How it works
Part of AIOps
Common mistakes

Health Log Analytics (HLA) reads the log streams from your applications and infrastructure and detects anomalies before they become outages, spotting the unusual pattern that precedes a failure, often ahead of any threshold-based alert.

Logs as an early-warning signal

Where Event Management reacts to alerts that monitoring tools already raised, HLA looks deeper, at raw logs, and learns each system's normal behaviour. A sudden spike in error patterns or log volume becomes an anomaly signal.

Log streams  -->  learn a baseline of "normal" per source
                   detect deviation (error spike, volume surge, new pattern)
                   -->  anomaly alert  -->  bound to a CI  -->  AIOps pipeline

How it works

Ingest

Collect logs from apps, hosts and services via the MID Server / agents.

Baseline

Machine-learn normal log behaviour per source over time.

Detect

Flag deviations, anomalies, and score them.

Correlate

Bind anomalies to CIs and feed the same alert pipeline as Event Management.

Part of AIOps

HLA reduces mean-time-to-detect by catching the anomaly in the logs rather than waiting for a hard failure and a user complaint. It complements Event Management (which needs a threshold to trip) by finding the unknown-unknowns, patterns no one wrote a rule for.

Common mistakes

Expecting value on day one, the baseline needs time to learn.
Feeding it unstructured, unlabelled logs and hoping for signal.
Treating HLA as a replacement for, not a complement to, Event Management.
Ignoring the anomalies it raises because they don't fit an existing rule.