ITOM: Health Log Analytics (HLA) || Knowledge & Troubleshooting Resources

I recommend bookmarking this article so that you are automatically notified by email when changes are made by me.

If you miss any content, please leave it as a comment and I will add it to this article.

My library Knowledge Sources To Go is very popular, but it was intended mainly as a thematically grouped guide to standard sources and was provided by me as a PDF file. For certain topics, however, there is so much content that I can no longer include it in that document, as it cannot continue to grow forever.

For this reason, I have decided to handle such topics in individual community articles like this one instead.

What is Health Log Analytics (HLA)?

Health Log Analytics collects logs streaming into your ServiceNow instance from endpoints or data lakes, such as Splunk and Elasticsearch. The instance receives the logs via the MID Server connector instance. In ServiceNow it identifies and triages anomalies in your log data using unsupervised machine-learning (ML) models. It then groups the anomalies together and applies further algorithms to help identify the root cause of the issue.

Product information

Entry point to the official product information pages

Product Documentation

Entry point to the official product documentation.

What is log analytics?

Overview of that topic with answers to the most important questions

Product Architecture Blueprint

Describes the inherent functionality of the product and outlines the technical components in the form of a diagram.

Deployment Guide

Provides implementation steps to achieve a prescribed set of product outcomes

Trainings & Courses

Health Log Analytics Essentials

This learning path begins with a required Technical Overview, which is a highly detailed look at the data journey and HLA processing. The path continues with Fundamentals which includes instruction on setting up log ingestions, tagging, and parsing to alert creation in Operator Workspace for triage and outage prevention. You will see how data shipping agents are used to ingest logs into a MID Server. Demonstrations include inputting both Linux system logs and Windows event logs. You will see how Health Log Analytics uses machine learning to generate patterns in log data and proactively alert you when anomalies are detected.

Health Log Analytics Extras

This course provides additional topics for learners already familiar with Health Log Analytics. Choose only the HLA topics you need, or view them all for more ideas on tuning your implementation.

Articles & Blog Posts

2021-07-09, by Will Hallam

Parsing Filebeat Logs In Health Log Analytics

This article shows an example of how to further refine log entries from Filebeat in order to empower AIOps.

2021-12-02, by Will Hallam

Configuring a Cribl Logstream Destination for Health Log Analytics

2022-02-25 by ServiceNow Support

Health Log Analytics

Walkthrough the product with installation and configuration instructions.

2022-11-15, by Will Hallam

Sending Pod Logs From EKS Clusters into HLA

Here's an example of how I set up logs to flow from an EKS cluster into Health Log Analytics.