Patent ID: 8615803

Claim:
A non-transitory program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform a method for processing alarms, that have been triggered by a monitoring system, comprising the steps of: a) entering alarms triggered by a monitoring system into an alarm log; b) evaluating similarity between the alarms; c) grouping similar alarms into alarm clusters; d) creating generalized alarms that cover the clustered alarms, the step of creating generalized alarms comprising at least copying the alarm log to a cluster log and for each alarm in the cluster log, repeating the following steps; e1) counting the number of covered alarms to include alarms that are equal to or more specific than the generalized alarm; e2) if the number of covered alarms exceeds a predetermined minimum number, then terminate repeating and forward said generalized alarm for further processing; e3) selecting, based on a heuristic, an attribute of the alarms in the cluster log, wherein the heuristic comprises at least running a Teiresias method; e4) for each alarm of a cluster log replacing the selected attribute by a more general attribute; and e5) returning to step e1).