A Fault Management (FaM) system monitoring a telecommunication network is able to determine a root cause of a malfunction within the network. The root cause determination is accomplished by receiving alarms from network elements, which may be physical devices, logical interfaces, or a combination thereof. An alarm typically includes a managed object, an alarm name, object type, timestamp, and the like. FaM systems may receive thousands of alarms, where a root cause alarm indicates a malfunction which triggered other alarms to be reported. Alarms are correlated by the FaM system, and a probability is determined for each correlated alarm to be the root cause. The system may have a learning mode, in which it correlates alarms, and an online mode, in which it receives alarms and determines that the alarms are correlated based on data from the learning mode. In some embodiments, both modes may be executed in parallel.