Skip to main content

​
Overview

Monitoring aggregates log streams from all registered infrastructure nodes and services into a centralized, searchable index. Log Analytics lets you query events across your entire environment with full-text search, structured field filtering, and anomaly detection — from a single interface.
Prerequisites

​
Searching Logs

Open Log Explorer

Navigate to Monitor Center > Logging (admin view).

Search and filter

Use the query bar at the top to filter log entries:
Use the Add Filter panel on the left to build queries visually. The query bar updates automatically as filters are applied.

Adjust the time range

Use the time picker to scope your search. For incident investigation, set an exact range spanning the incident window to avoid scrolling through unrelated events.

​
Log-Based Alert Rules

Create alerts that fire whenever a log entry matching a query appears.

Open Log Explorer

Navigate to Monitor Center > Logging (admin view) and build the query that should trigger an alert.

Create alert from query

Click Create Alert in the Log Explorer toolbar.
Log-based alerts have a minimum evaluation interval of 1 minute. For near-real-time security event detection, use the Security and IDS module which processes events with sub-minute latency.

Save and verify

Click Save. The rule activates and evaluates the log query on each collection cycle.
Alert rule appears in Monitor Center > Monitoring (Alerting section, admin view) with type Log.

​
Useful Query Patterns

Set time range to “Last 1h” in the time picker.
Use this for security auditing and failed login detection.
Identifies instances where the kernel killed processes due to memory pressure.
Surfaces disk-level errors that may indicate failing storage devices.
Identifies services that are failing to connect to their dependencies.

​
Next Steps

Metrics & Alerts

Combine log-based alerts with metric thresholds for comprehensive coverage

Monitoring Admin — Log Collection

Configure log source paths and syslog forwarding (administrator)

Network Monitoring

Analyze network traffic alongside log events for incident correlation

Troubleshooting

Diagnose missing or delayed log ingestion