You are on page 1of 11

NOKIA NMS/2000

FOR MANAGING CELLULAR NETWORKS

ALARM CORRELATION

Introductory Document

Document number/Issue

NTC TAN 0500/2 en

Copyright Nokia Telecommunications Oy

The information in this document is subject to change without notice and describes only the software version
defined in the introduction of this document. This document is intended for the use of Nokia
Telecommunications customers only, and no part of it may be reproduced or transmitted in any form or
means without the written permission of Nokia Telecommunications.
The information or statements given in this document concerning the suitability, capacity, or performance of
the mentioned hardware or software products cannot be considered binding but shall be defined in the
agreement made between Nokia Telecommunications and the customer. Nokia Telecommunications will not
be responsible in any event for errors in this document or for any damages, incidental or consequential
(including monetary losses), that might arise from the use of this publication or the information in it.
This material and the software described in this document are copyrighted according to the applicable laws.
Trademarks
The Nokia name and the Nokia logo are trademarks of Nokia Telecommunications Oy.
Other product names mentioned in this document may be trademarks and they are mentioned for
identification purposes only.
This document was produced and printed at Nokia Telecommunications, Network Management Systems,
Hatanpnkatu 3, 33100 Tampere, Finland.

No. of
pages
11/MEN

Edited by

Author

Approved by

M Nurminen
29 Jun 1997

M Nurminen
29 Jun 1997

R Granat
2 Jul 1997

Previous issue
(1) approved
24 Sep 1996

Copyright Nokia Telecommunications Oy 1997. All rights reserved.

Document number/Issue

NTC 0500/2 en

Copyright Nokia Telecommunications Oy

TABLE OF CONTENTS
1

OVERVIEW OF ALARM FILTERING AND CORRELATION . . . . 4


1.1

FUNCTIONAL DESCRIPTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1
2.2
2.3
2.4

Benefits of the Feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

What is New in T10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .


Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Correlation Types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
How Alarm Correlation is Used. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

7
7
8
9

ADDITIONAL INFORMATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.1
3.2

Use of Feature with Other Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11


Where to Find More . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Document number/Issue

NTC TAN 0500/2 en

Copyright Nokia Telecommunications Oy

Overview of Alarm Filtering and Correlation

OVERVIEW OF ALARM FILTERING AND


CORRELATION
In a normal alarm monitoring situation, monitoring personnel have full
responsibility for processing an enormous number of alarms. This job includes:

Sifting through the enormous amount of information presented by alarms.

Deciding which of the thousands of alarms shown are important.

Making associations between alarms, trying to decide which ones are


possibly caused by the same fault, and grouping those alarms together.

Finding solutions for the problems causing the alarms.

Normally, the first three of these activities, although requiring a good deal of
work, have to be done in a matter of seconds. They also have to be done
continuously for a huge flow of incoming alarms. The end result can be that
faults go unnoticed or unresolved.
Using correlation techniques, part of the responsibility for these activities is
turned over to the NMS. Using the intelligence of the system, the jobs can be
taken care of, in part, before the alarms ever reach the Alarm Monitor. The view
of the alarm situation seen by monitoring personnel, then, has already been
partially sifted through, alarms which are not important are not shown at all, and
associations, or correlations, between certain alarms have already been made and
are shown as correlated alarms.
The Nokia NMS Alarm Correlation feature reduces the number of alarms shown
in the NMS, making the faults causing the alarms easier to spot. The feature uses
correlation rules to:

Reduce the number of alarms shown to the NMS user (although all alarms
are still stored in the database).

Handle multiple occurrences of an alarm as one correlated alarm.

Hide secondary alarms when primary alarms are active.

Document number/Issue

NTC TAN 0500/2 en

Copyright Nokia Telecommunications Oy

Overview of Alarm Filtering and Correlation

Figure 1. Alarm Correlation Principles

1.1

Benefits of the Feature


The main functions of the Alarm Correlation feature are:

Alarm flow reduction

Easier and faster pinpointing of the real problem

Alarm flow reduction is very important to the operator for a number of reasons.
First of all, it reduces the work load. Each alarm requires (or would require) a
certain amount of work it has to be noticed, it has to be acknowledged, it has to
be thought out, possibly its background checked, and a judgement has to be made
for further activities.
The reduction of alarms improves the time spent on (and the quality of) the actual
problem solving. It is easier to spot the real source of problems. It makes the
monitoring situation more effective and it also improves the working conditions
of the operator.
As network grow larger and more complex, the influx of alarms increases. This
makes alarm reduction increasingly important, since the other alternatives are
more manpower (lessening cost efficiency), or lower monitoring standards

Document number/Issue

NTC TAN 0500/2 en

Copyright Nokia Telecommunications Oy

Overview of Alarm Filtering and Correlation

(meaning lower network quality), or both. This could result in higher operating
staff turnover.

Document number/Issue

NTC TAN 0500/2 en

Copyright Nokia Telecommunications Oy

Functional Description

FUNCTIONAL DESCRIPTION

2.1

What is New in T10


Informing Delay: this correlates the type of alarm which is activated, then
cancelled, then activated again repeatedly.
Auto Ack: this automatically acknowledges all of the original alarms in a
correlation.
New criteria in making rules: you can now define correlation rules which cover
an entire alarm class. And for suppression rules, you can now define a time
window in which the alarms must occur, and an order for the alarms (alarm a
first, b first, or unspecified).

2.2

Implementation
Alarm Correlation consists of the alarm correlator plus the Alarm Correlation
Rule Editor application. Correlation rules concerning specific alarms are made
with the Rule Editor. The correlator matches incoming alarms against the rules
and then correlates all relevant alarms. The correlations are sent to Alarm
Monitor, along with an explanation of the correlation rule concerned and the
original alarms involved. This explanation can be retrieved through a dialog in
Alarm Monitor.
When alarms are correlated, you can choose to have the original alarms be
automatically acknowledged as they are correlated.
Nokia NMS Alarm Correlation also features automatic checking of the object
hierarchy. For example, if you set a correlation rule in which a certain alarm from
BSC-a suppresses an alarm in BTS-b, then the Correlator automatically checks
to make sure that BTS-b belongs to the hierarchy of BSC-a before it correlates
the alarms.

Document number/Issue

NTC TAN 0500/2 en

Copyright Nokia Telecommunications Oy

Functional Description

2.3

Correlation Types
There are several different types of correlation. Each is defined by the way in
which alarms are correlated. In this release, the Nokia NMS supports the
following types:

Compression

Count

Suppression

Informing Delay

Compression
Compression involves taking a number of occurrences of one alarm and
combining them to make only one occurrence. The meaning of the correlated
alarm is identical to that of any one occurrence, with the extra information added
that the alarm has occurred a number of times.
Count
This type of correlation involves implementing time and occurrence thresholds
for a certain alarm. If the alarm occurs more than the designated number of times
within the designated time frame, then the occurrences are correlated and a new
alarm, which could be assigned a higher alarm class, is generated. Typically this
would be used in the case of certain lower class alarms and warnings, which
would be filtered away, but counted. Should they become too numerous, a
higher-class alarm would result.
Suppression
Suppression correlation means inhibiting a low-priority alarm in the presence of
a high-priority alarm. If a specific lower-severity alarm always occurs in
conjunction with a certain higher-severity alarm, then the alarms can be
correlated so that only the high priority alarm is shown to the NMS user. For
example, a PCM line failure generates a number of BTS alarms, which can be
correlated to a great extent using the suppression rule.
Informing Delay
This process takes place in the alarm pipe and is applied to alarms that are usually
cancelled after a few seconds, as is the case, for example, with alarms generated
during a restart of a hardware unit. Informing delay means that the original alarm
is delayed a few seconds to wait for its cancel. If the alarm is cancelled within
the time frame defined by the informing delay feature, then it will not be shown
to the user. The information of alarm plus its cancel is combined, and the alarmcancel pair is filtered from the view, though not from the database.

Document number/Issue

NTC TAN 0500/2 en

Copyright Nokia Telecommunications Oy

Functional Description

2.4

How Alarm Correlation is Used


Correlation rules are made with the Alarm Correlation Rule Editor. The
following picture shows the Adding a Rule dialog, which is used for making new
correlation rules.

Figure 2. Adding a Rule Dialog


The Alarm Monitor application is used to monitor the network alarm situation
under correlation. The user chooses whether to view Alarm Monitor with or
without correlation. The following pictures show an alarm situation without
correlation and an alarm situation with the correlation option on.

Figure 3. Alarm Situation without Correlation

Document number/Issue

NTC TAN 0500/2 en

Copyright Nokia Telecommunications Oy

Functional Description

Figure 4. Alarm Situation with Correlation

Document number/Issue

NTC TAN 0500/2 en

Copyright Nokia Telecommunications Oy

10

Additional Information

ADDITIONAL INFORMATION

3.1

Use of Feature with Other Features


Alarm Correlation is dependent on the Alarm Collection and Storing (standard)
feature, as well as the Alarm Monitor feature (optional).

3.2

Where to Find More


For more detailed information on alarm correlation and correlation types, see
Fault Management Basic Operating Principles and Procedures, TAN 0704.

Document number/Issue

NTC TAN 0500/2 en

Copyright Nokia Telecommunications Oy

11