Embodiments of the present invention disclose an alarm information processing method, including: acquiring, by an EMS, a first alarm information set reported by a VNFM, where the first alarm information set is generated after the VNFM performs correlation analysis on at least one piece of NFVI alarm information and at least one piece of VIM alarm information; acquiring, by the EMS, a second alarm information set reported by a VNF, where the second alarm information set includes at least one piece of VNF alarm information; and performing, by the EMS, correlation analysis on the first alarm information set and the second alarm information set, and dispatching a configured work order for alarm information that has a correlation relationship. By using the present invention, a cross-layer association between alarm information can be implemented to reduce a quantity of work orders.