We have a custom alarm field (TICKET REF) used by our operators to assign ticket references to alarms as they are dealt with. This is being used to easily distinguish between 'new' alarms and known alarms.

We've also recently started to implement some correlation rules using the correlation module to help manage the alarm console (the New Alarm option is used in the correlation rule).

Both of these features work really well, however yesterday I noticed something I couldn't explain...

Alarms were being generated as part of planned change activity, and as they were being generated they were correctly being correlated. Operators we applying the change reference to the correlated (and separate non-correlated) alarms using the custom alarm field. This would apply the reference to the raw alarms, and the top-level group alarm. However whenever a change was made to the group of raw alarms (i.e. when one/many were added or cleared) the reference in the custom field would disappear from the top-level group alarm.

Consequently, the correlated alarms seemed to keep re-appearing as new alarms as they didn't have a reference assigned. Each time the same change reference was re-applied to the top-level alarm, but whenever there was a further change to the raw alarms the reference would disappear.

Is there a way to make any custom field assignments permanent to a top-level correlated alarm, with all subsequent raw alarms inheriting the custom field value as they are generated, until all the raw alarms have cleared (and subsequently the top-level alarm).