Method and system for reducing false alarms in network fault management systems

In a system for analyzing faults in devices by correlating a plurality of indicators over a window of time and generating alarms based upon the correlation, the window of time comprising a plurality of time slices in each of which a state of each indicator is probed, a method for reducing false alarms comprising:

• determining which of the indicators changed state in similar fashion during a first time slice in the window or did not change state during the first time slice;
• computing a time slice transition factor that relates a number of the indicators whose state changed in similar fashion or did not change during the first time slice to a total number of the indicators;
• and
• adjusting the correlation of the indicators over the window of time using the time slice transition factor.

A computer readable medium storing program code which, when executed, causes a computer to perform a method for reducing false alarms in a system for analyzing problems by correlating a plurality of indicators over a window of time and generating alarms based upon the correlation, the window of time comprising a plurality of time slices in each of which a slate of each indicator is probed, the method comprising:

• determining which of the indicators changed state in similar fashion during a first time slice in the window or did not change state during the first time slice;
• computing a time slice transition factor that relates a number of the indicators whose state changed in similar fashion or did not change during the first time slice to a total number of the indicators;
• and
• adjusting the correlation of the indicators over the window of time using the time slice transition factor.

A method for correlating a number of indicators in a rules-based correlation system, wherein a plurality of indicators each having multiple possible values and expected to relate to a problem are correlated over a window of time, the method comprising:

• dividing the window of time into a plurality of time slices;
• determining a value for each indicator during each of a plurality of the time slices;
• determining a transition state for each indicator during each of the plurality of time slices, the transition state representing whether and bow the indicator changed state during the time slice;
• and
• correlating the indicators over the window of time based upon the determined indicator values and transitions states.

A computer readable medium storing program code which, when executed, causes a computer to perform a method for correlating a number of indicators in a rules-based correlation system, wherein a plurality of indicators each having multiple possible values and expected to relate to a problem arc correlated over a window of limit, the method comprising:

• dividing the window of time into a plurality of time slices;
• determining a value for each indicator during each of a plurality of the time slices;
• determining a transition state for each indicator during each of the plurality of time slices, the transition state representing whether and how the indicator changed state during the time slice;
• and
• correlating the indicators over the window of time based upon the determined indicator values and transitions states.