he alarm ID to signify a connection loss and CONN200 to signify connection established. This way we can associate logs. In a fault database notification ID is unique while alarm ID can be repeated. Generation This is the time when the error scenario occurred and the notification was generated on the NE. Some applications also have "Notification time," which signifies the time when the management application received an alarm notification from the NE. Resource The information about the network element and the resource on the network element that caused the error condition is available in log body. Alarm If the alarm is a new alarm, an alarm for overwriting status, or purpose a clear alarm. For example, when a resource is having some trouble an alarm is raised, as the resource is restarted another alarm is send to overwrite the existing alarm and once the resource is back in service, a clear alarm can be raised. Probable This is another parameter for classifying data. Consider the cause example of CONN100 for connection loss. We might want to classify connection logs associated with a call server and connection logs associated with a media gateway in two different categories. This classification can be achieved with probable cause keeping same alarm ID. Alarm type In addition to classification based on cause, 3GPP recommends the use of alarm types for grouping alarms. Some of the alarm types recommended by 3GPP are: communications alarm, processing error alarm, environmental alarm, quality of service alarm, or equipment alarm. Severity The usual severity conditions are minor, major, critical, and unknown severity. Alarm This part will contain complete problem descriptions, which information includes the resource information and the attribute that gets affected. Sometimes the alarm information will even specify the corrective action to be taken when the log appears. ITU-T FCAPS Event Filtering: The corrective action for alarms are not the same. It varies with the probable cause. There could also be corrective action