Incremental alarm correlation method and apparatus

Abstract

Alarms are processed in view of an historical context to determine instances of correlation such that alarms are partitioned into correlation sets where the alarms within one set have a high probability of being caused by the same network fault. As each new alarm is received, a check is made to se whether a managed object originating that alarm is a member of a previous set and is already in an alarmed state. If so, the alarm is added to that managed object. If not, a set is built containing that alarmed managed object and its related managed objects as determined from consideration of alarm propagation rules and network topology. That set is then compared with previously built sets to determine the existence of any correlation as measured by whether the sets share managed objects in common or satisfy some other correlation test. When such correlation is found, the sets are merged together to form a larger set relating to the same network fault.

Dependencies are inferred from the claim text.