A method in a network management node for handling an alarm caused by a fault in a communications system, the communications system comprising the network management node and network elements (130,140), which network elements (130, 140) are adapted to serve users (150, 160), the network management node is accessible to a user activity database, which user activity database comprises user session records, wherein each user session record is associated with parameters relating to a user session, which parameters comprise a record time period during which period the user session took place, an identity of the user (150, 160) using the session, and an identity of each network element (130, 140) involved in the user session during the time period, the method comprising: receiving from a first network element within the communications system, an alarm caused by a fault in the communications system, the alarm being associated with an identity of the first network element, and an alarm time associated with a time when the alarm was active, sending a request to the user activity database, requesting one or more matching records, wherein each of the requested matching records comprises an identity equal to the identity of the first network element associated with the alarm, and a record time period that comprises the time when the alarm was active, receiving the one or more matching records from the user activity database, which one or more matching records identify the user sessions being affected by the alarm, wherein the one or more matching records include a first information, sending a request to a policy repository, requesting a second information, which second information comprises information about user policies and/or service policies associated with each user and/or service affected by the alarm, receiving the requested second information from the policy repository, and handling the alarm based on the one or more matching records and the second information. receiving from a first network element within the communications system, an alarm caused by a fault in the communications system, the alarm being associated with an identity of the first network element, and an alarm time associated with a time when the alarm was active, sending a request to the user activity database, requesting one or more matching records, wherein each of the requested matching records comprises an identity equal to the identity of the first network element associated with the alarm, and a record time period that comprises the time when the alarm was active, receiving the one or more matching records from the user activity database, which one or more matching records identify the user sessions being affected by the alarm, wherein the one or more matching records include a first information, sending a request to a policy repository, requesting a second information, which second information comprises information about user policies and/or service policies associated with each user and/or service affected by the alarm, receiving the requested second information from the policy repository, and handling the alarm based on the one or more matching records and the second information.