According to an alarm correlation analysis method, apparatus, and system, alarm analysis rules are grouped according to a certain policy; each alarm analysis rule group is correlated with one analysis engine, and the analysis engine performs, according to an alarm analysis rule in the alarm analysis rule group corresponding to the analysis engine, correlation analysis for an alarm that has a correlation with the alarm analysis rule group, so that multiple analysis engines implement concurrent analysis on a large quantity of alarms, thereby fully utilizing a multi-core resource, and improving efficiency of alarm correlation analysis.