Network fault manager for maintaining alarm conditions

1. A computer-implemented method for detecting alarm conditions, the method comprising:

receiving a first trigger event notification for a monitored occurrence on a network;

asserting a first alarm condition to represent the first trigger event notification;

receiving a next trigger notification after the first trigger event notification, the next trigger event notification also for the monitored occurrence;

determining whether the next trigger event notification occurred within a predetermined amount of time after the first trigger event notification;

if the next trigger event notification occurred within a predetermined time after the first trigger event notification, maintaining the first alarm condition; and

if the next trigger event notification occurred more than said predetermined amount of time after the first trigger event notification, asserting a second alarm condition to represent the next trigger event notification.

2. The method of claim 1 further comprising:

establishing a redundancy window which specifies the predetermined amount of time;

if said next trigger event notification occurs more than said predetermined amount of time after the first trigger event notification, detecting that the redundancy window has elapsed without an occurrence of a subsequent trigger event notification; and

upon detecting that the redundancy window has elapsed without the occurrence of a subsequent trigger event notification, clearing the first alarm condition.

3. The method of claim 2 , wherein maintaining the first alarm condition further comprises restarting the redundancy window based on when said next trigger event notification was received.

4. The method of claim 1 , wherein the first trigger event notification and said next trigger event notification are traps.

5. A computer-implemented method for detecting alarm conditions, the method comprising:

periodically sampling the rate at which similar trigger event notifications arrive, wherein the trigger event notifications are for monitored occurrences on a network;

comparing the sampled rate to a first threshold;

periodically computing N, wherein N is the number of sampled rates within a preceding window of time that exceed said first threshold;

each time N is computed, performing the operations of:

(a) comparing N to a second threshold;

(b) if N is greater than said second threshold and if a preexisting alarm condition does not exist, asserting a first alarm condition; and

(c) if N is greater than said second threshold and if the preexisting alarm condition does exist, maintaining the preexisting alarm condition for a predetermined future period of time.

6. The computer-implemented method of claim 5 wherein the operations further include (d) if N is not greater than the second threshold and if a preexisting alarm condition does exist and if the predetermined amount of time has elapsed since the immediately preceding last time that N exceeded the second threshold, clearing the preexisting alarm condition.

7. The method of claim 5 , wherein the trigger event notifications are traps.

8. The method of claim 5 , wherein the first threshold is zero.

9. The method of claim 5 , wherein the first threshold is greater than zero.

10. The method of claim 5 , wherein the second threshold varies as a function of time.

11. The method of claim 10 , further comprising computing the second threshold based on past performance of a parameter that is represented by the trigger event notification.

12. A computer-implemented method for detecting alarm conditions, the method comprising:

periodically sampling the rate R i at which similar trigger event notifications arrive, wherein the trigger event notifications are for monitored occurrences on a network, and wherein R i is the sampled rate at time i;

comparing the sampled rate R i to a first threshold;

for each sampled rate R i that exceeds the first threshold, computing an amount M i by which the sampled rate R i exceeds said first threshold;

periodically computing T i which is a sum of M i for all sample times i within a preceding window of time;

for each T i that is computed, performing the operations of:

(a) comparing T i to a second threshold;

(b) if T i is greater than said second threshold and if a preexisting alarm condition does not exist, asserting a first alarm condition; and

(c) if T i is greater than said second threshold and if the preexisting alarm condition does exist, maintaining the preexisting alarm condition for a predetermined future period of time.

13. The computer-implemented method of claim 12 wherein the operations further include (d) if T i is not greater than the second threshold and if a preexisting alarm condition does exist and if the predetermined amount of time has elapsed since the immediately preceding last time that T i exceeded the second threshold, clearing the preexisting alarm condition.

14. The method of claim 13 , wherein the trigger event notifications are traps.

15. The method of claim 13 , wherein the first threshold is zero.

16. The method of claim 13 , wherein the first threshold is greater than zero.

17. The method of claim 13 , wherein the second threshold varies as a function of time.

18. The method of claim 17 , further comprising computing the second threshold based on past performance of a parameter that is represented by the trigger event notification.