Abstract: Technologies are provided for correlating alert messages using placeholder correlation records. When a network alert message is received, a network component associated with the alert can be identified and a correlation record can be created that is associated with the identified network component. A model of the computer network can be used identify another network component that is related to the identified network component. If a correlation record for the related component does not exist, then a placeholder correlation record for the related component can be created. If another alert message is received that is associated with another component that is also related to the same component, then the placeholder correlation record can be used to correlate the alert messages. An event message can be generated that indicates an occurrence of a network event involving the related component associated with the placeholder correlation record.

Abstract: Technologies are provided for correlating alert messages using correlation domains. Alert messages can be received that are related to computer network components. The alert messages can be partitioned using separate correlation domains and analyzed by separate alert processors. When an alert message is received, it can be analyzed to determine a correlation domain with which the alert message is associated. The alert message can then be correlated with other alert messages associated with the correlation domain, and alert messages that are not associated with the correlation domain can be ignored. Groups of alert messages associated with different correlation domains can be correlated independently by different alert processors. Events generated by an alert processor can include correlation domain information. Events associated with different correlation domains can be handled differently.