Abstract: An alarm correlation method for use in a network management device is provided in which alarm correlation is performed between identified root-cause alarms and alarms which have been raised on network elements satisfying particular relationships with the network element that raised the root-cause alarm. A hierarchical network model is provided consisting of a transport termination point for each connection at various layers terminated by each network element, and a connectivity model is maintained which identifies all connections in the network. An impact group of transport termination points for a given transport termination point defines where to look for alarms for correlation for a given root-cause alarm. Preferably, a link between the root-cause alarm and a transport termination point which has been examined is established which allows expeditious correlation of later received symptomatic alarms with the root-cause alarm.