Alarm correlation

Alarm correlation is a fundamental feature of monitoring tools, yet its implementation often lacks efficiency and relevance. The Canopsis correlation engine, designed through close collaboration with our clients and prospects, introduces a more advanced approach—enhancing event analysis and delivering clearer, more actionable insights.
The alarms presented by Canopsis are accompanied by additional information that determines whether they are the cause or consequence of another alarm.

Alarm correlation can take place at several levels:

• Thanks to repository information describing links between components
• Thanks to management rules defined by users / administrators
• Thanks to control rules validated by application managers

From an operational point of view, alarms that are dependent on each other can be grouped together to form a meta-alarm
on an alarm list, in the APIs.

The basic functions can also be applied in bulk whenever possible.

The correlation results in a significant reduction in the number of alerts presented to
the user.

Update 2024: Pre-correlation time window
Added the possibility of introducing a delay before correlations are performed. So, when an alert is eligible for a alarm correlation rule, it will only be activated at the end of the desired time delay.

For more information on correlation, visit our dedicated article or the Canopsis documentation.