ALARM CORRELATION SYSTEM AND METHOD OF USING
A system for identifying correlated alarms includes a non-transitory computer readable medium configured to store instructions thereon; and a processor connected to the non-transitory computer readable medium. The processor is configured to execute the instructions for identifying a parent alarm from an alarm log based a plurality of rules, wherein the alarm log comprises a plurality of alarm, and the plurality of alarms contains the identified parent alarm. The processor is configured to execute the instructions for determining whether the plurality of alarms includes a child alarm associated with the identified parent alarm based on the plurality of rules. The processor is configured to execute the instructions for generating an incident in response to a determination that the plurality of alarms includes the child alarm, wherein the incident includes instructions for resolving the parent alarm.
1 . A system for identifying correlated alarms, wherein the system comprises:
a non-transitory computer readable medium configured to store instructions thereon; and
a processor connected to the non-transitory computer readable medium, wherein the processor is configured to execute the instructions for:
identifying a parent alarm from an alarm log based a plurality of rules, wherein the alarm log comprises a plurality of alarm, and the plurality of alarms contains the identified parent alarm;
determining whether the plurality of alarms includes a child alarm associated with the identified parent alarm based on the plurality of rules; and
generating an incident in response to a determination that the plurality of alarms includes the child alarm, wherein the incident includes instructions for resolving the parent alarm.
2 . The system of claim 1 , wherein the processor is further configured to execute the instructions for:
receiving the alarm log; and
receiving the plurality of rules.
3 . The system of claim 2 , wherein the processor is further configured to execute the instructions for:
receiving the plurality of rules from a user.
4 . The system of claim 1 , wherein the processor is further configured to execute the instructions for:
identifying a plurality of parent alarms from the alarm log based on the plurality of rules.
5 . The system of claim 4 , wherein the processor is further configured to execute the instructions for:
selecting a target parent alarm from the plurality of parent alarms based on the determination of whether the plurality of alarms includes the child alarm; and
generating the incident for resolving the target parent alarm.
6 . The system of claim 5 , wherein the processor is further configured to execute the instructions for:
selecting the target parent alarm based on a number of child alarms, determined to be in plurality of alarms, associated with each of the plurality of parent alarms, wherein the target parent alarm has a highest number of child alarms amongst the plurality of parent alarms.
7 . The system of claim 5 , wherein the processor is further configured to execute the instructions for:
selecting the target parent alarm based on a percentage of child alarms, determined to be in plurality of alarms, associated with each of the plurality of parent alarms, wherein the target parent alarm has a highest percentage of child alarms amongst the plurality of parent alarms.
8 . The system of claim 5 , wherein the processor is further configured to execute the instructions for:
selecting the target parent alarm based on a time that each of the plurality of parent alarms was initiated.
9 . The system of claim 1 , wherein the processor is further configured to execute the instructions for:
aggregating the plurality of alarms based on the alarm log.
10 . A method of identifying correlated alarms, wherein the method comprises:
identifying a parent alarm from an alarm log based a plurality of rules, wherein the alarm log comprises a plurality of alarm, and the plurality of alarms contains the identified parent alarm;
determining whether the plurality of alarms includes a child alarm associated with the identified parent alarm based on the plurality of rules; and
generating an incident in response to a determination that the plurality of alarms includes the child alarm, wherein the incident includes instructions for resolving the parent alarm.
11 . The method of claim 10 , further comprising:
receiving the alarm log; and
receiving the plurality of rules.
12 . The method of claim 11 , wherein receiving the rule comprises receiving the plurality of rules from a user.
13 . The method of claim 10 , further comprising:
identifying a plurality of parent alarms from the alarm log based on the plurality of rules;
selecting a target parent alarm from the plurality of parent alarms based on the determination of whether the plurality of alarms includes the child alarm; and
generating the incident for resolving the target parent alarm.
14 . The method of claim 13 , wherein selecting the target parent alarm comprises:
selecting the target parent alarm based on a number of child alarms, determined to be in plurality of alarms, associated with each of the plurality of parent alarms, wherein the target parent alarm has a highest number of child alarms amongst the plurality of parent alarms.
15 . The method of claim 13 , wherein selecting the target parent alarm comprises:
selecting the target parent alarm based on a percentage of child alarms, determined to be in plurality of alarms, associated with each of the plurality of parent alarms, wherein the target parent alarm has a highest percentage of child alarms amongst the plurality of parent alarms.
16 . The method of claim 13 , wherein selecting the target parent alarm comprises:
selecting the target parent alarm based on a time that each of the plurality of parent alarms was initiated.
17 . A non-transitory computer readable medium configured to store instructions thereon that when executed by a process cause the processor to:
identify a parent alarm from an alarm log based a plurality of rules, wherein the alarm log comprises a plurality of alarm, and the plurality of alarms contains the identified parent alarm;
determine whether the plurality of alarms includes a child alarm associated with the identified parent alarm based on the plurality of rules; and
generate an incident in response to a determination that the plurality of alarms includes the child alarm, wherein the incident includes instructions for resolving the parent alarm.
18 . The non-transistor computer readable medium of claim 17 , wherein the instructions are further configured to cause the processor to:
identify a plurality of parent alarms from the alarm log based on the plurality of rules;
select a target parent alarm from the plurality of parent alarms based on the determination of whether the plurality of alarms includes the child alarm; and
generate the incident for resolving the target parent alarm.
19 . The non-transistor computer readable medium of claim 18 , wherein the instructions are further configured to cause the processor to:
select the target parent alarm based on a number of child alarms, determined to be in plurality of alarms, associated with each of the plurality of parent alarms, wherein the target parent alarm has a highest number of child alarms amongst the plurality of parent alarms.
20 . The non-transistor computer readable medium of claim 18 , wherein the instructions are further configured to cause the processor to:
select the target parent alarm based on a percentage of child alarms, determined to be in plurality of alarms, associated with each of the plurality of parent alarms, wherein the target parent alarm has a highest percentage of child alarms amongst the plurality of parent alarms.