1. A method comprising: accessing a plurality of time series of alarms of a plurality of alarm types in response to the alarms in the plurality of time series being generated due to faults or failures in resources of a network function virtualization (NFV) system; identifying clusters of the plurality of alarm types based on similarities between the plurality of time series; determining causal connections between alarm types in the clusters based on temporal proximity and ordering of the alarm types in the clusters, wherein the casual connections indicate that alarms of a first alarm type caused alarms of a second alarm type; and storing at least one causality template representative of the causal connections.