Typically each channel in the cable will generate an alarm message when it is cut and another notification when it is restored. An event storm overloads the operators with information making it difficult to tell what kind of incident and where the incident occurred. To solve this problem an event correlation stage is inserted between the network and the management station. The correlator translates a groups of events into a single event that better describes the nature of the incident. The correlator applies the expertise of the operator in judging the cause of the event storm.
Some commercial products use an expert system to perform the correlation.
These tend to be slow, too slow for event storms in large networks. C. This will give a fast correlator but one that is difficult to maintain. The event correlation technology in HP ECS falls in between these extremes. The correlator algorithm is implemented as a network of processing nodes called the correlation circuit. Each node operates on one or more input streams of events to produce an output stream of events.