> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/about-health-issues/investigate-and-resolve-health-issues.md).

# Investigate and resolve health issues

The following tasks explain how to investigate and resolve health issues. You can see health issues on the following pages:

* Go to Settings → Health Issues
* Go to Cases & Issues → Issues and change the table view to Health Domain.

### **Investigate data ingestion errors**

A data ingestion issue identifies disruption in the data ingestion pipeline. For example, a data source is not sending logs, or there is a significant drop in log collection compared to the calculated ingestion baseline.

1. Identify the error: Type = Ingestion.
2. Right-click and select Investigate in XQL query.

   The Query Builder opens and runs a prefilled query to display related data ingestion metrics entries.
3. Review the query results.

   The results provide context for the issue and the events leading up to it. For more information about data ingestion metrics and setting up correlation rules with your own data ingestion logic, see [Monitor data ingestion health](/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/about-health-issues/monitor-data-ingestion-health.md).
4. Investigate data collector errors. Return to the Health Issues page, right-click the issue, and select Pivot to views → View collector details.

   Depending on the type of collector in error, the relevant data collector settings page opens, filtered by data collector.

### **Investigate collection errors**

A collection issue identifies connectivity disruption in your collection integrations, custom collectors, and Marketplace integrations.

1. Identify the error: Type = Collection.
2. See the current status of the collector.

   Right-click and select Pivot to views → View collector details. Depending on the type of collector in error, the relevant data collector settings page opens, filtered by data collector.

   If the data collector is still in error, you can update the collector settings as required.
3. Investigate the collector error status.

   Run a query on the `collection_auditing` dataset to see all the connectivity changes of the collector over time, the escalation or recovery of the connectivity status, and the error, warning, and informational messages related to status changes.

   This example searches for status changes for the "instance1" data collector integration:

   ```
   dataset = collection_auditing 
   |filter collector_type = "STRATA_IOT" and instance = "instance1"
   ```

   <br>

   For more information about troubleshooting collector errors and setting up correlation rules to trigger additional collection issues, see [Verify collector connectivity](/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/verify-collector-connectivity.md).

### **Investigate correlation errors**

A correlation issue identifies errors in your correlation rules.

1. Identify the error: Type = Correlation.
2. Right-click and select Investigate Correlation Auditing.

   The Query Builder opens and runs a prefilled query to display related correlation execution records.
3. Review the query results.

   Identify the correlation rule in error and take steps to resolve the error. For more information about how Cortex XDR identifies correlation rule errors, see [Monitor correlation rules](/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/about-health-issues/monitor-correlation-rules.md).

### **Investigate automation errors**

Automation issues identify potential misconfigurations in automations, enabling you to take a proactive approach to fixing misconfiguration issues before they affect system performance.

1. Identify the error: Type = Automation.
2. Click the automation health issue to view the details of the related case or component.
3. Based on the details of the automation health issue, review any related automations, such as playbooks and integrations, for possible misconfigurations.

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/about-health-issues/investigate-and-resolve-health-issues.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.