An alarm root cause analyzing method, comprising: obtaining, by an alarm root cause analyzing device, at least one alarm of a managed network; sending, by the alarm root cause analyzing device, an alarm raising time of the at least one alarm to a failed link locating device; listening, by the failed link locating device, to a link state database update message sent by a network control plane and storing a pre-failure link state database and a post-failure link state database; obtaining, by the failed link locating device, an alarm raising time sent from the alarm root cause analyzing device; comparing, by the failed link locating device, the pre-failure link state database and the post-failure link state database that are corresponding to the alarm raising time to determine a failed link; wherein the step of comparing the pre-failure link state database and the post-failure link state database that are corresponding to the alarm raising time to determine the failed link comprises: comparing a state of each link in the pre-failure link state database corresponding to a stored alarm raising time and the state of each link in the post-failure link state database corresponding to the stored alarm raising time, and determining a link in invalid state as the failed link; determining, by the failed link locating device, in an entire-network path vector matrix, an affected edge device corresponding to the failed link and a device interface of the affected edge device; and sending, by the failed link locating device, an identifier of the failed link, an identifier of the affected edge device, and an identifier of the device interface of the affected edge device to an alarm root cause analyzing device; receiving, by the alarm root cause analyzing device, the identifier of the failed link, the identifier of the affected edge device, and the identifier of the device interface of the affected edge device that are sent by the failed link locating device; querying, by the alarm root cause analyzing device, whether any alarm from the failed link exists in the at least one alarm, and if an alarm from the failed link exists in the at least one alarm, marking the alarm from the failed link as a root cause alarm; and querying, by the alarm root cause analyzing device, whether any alarm from the affected edge device exists in the at least one alarm, and if an alarm from the affected edge device exists, further judging whether a service object corresponding to the alarm from the affected edge device is borne over the device interface of the affected edge device, and if yes, marking the alarm from the affected edge device as a derivative alarm. obtaining, by an alarm root cause analyzing device, at least one alarm of a managed network; sending, by the alarm root cause analyzing device, an alarm raising time of the at least one alarm to a failed link locating device; listening, by the failed link locating device, to a link state database update message sent by a network control plane and storing a pre-failure link state database and a post-failure link state database; obtaining, by the failed link locating device, an alarm raising time sent from the alarm root cause analyzing device; comparing, by the failed link locating device, the pre-failure link state database and the post-failure link state database that are corresponding to the alarm raising time to determine a failed link; wherein the step of comparing the pre-failure link state database and the post-failure link state database that are corresponding to the alarm raising time to determine the failed link comprises: comparing a state of each link in the pre-failure link state database corresponding to a stored alarm raising time and the state of each link in the post-failure link state database corresponding to the stored alarm raising time, and determining a link in invalid state as the failed link; determining, by the failed link locating device, in an entire-network path vector matrix, an affected edge device corresponding to the failed link and a device interface of the affected edge device; and sending, by the failed link locating device, an identifier of the failed link, an identifier of the affected edge device, and an identifier of the device interface of the affected edge device to an alarm root cause analyzing device; receiving, by the alarm root cause analyzing device, the identifier of the failed link, the identifier of the affected edge device, and the identifier of the device interface of the affected edge device that are sent by the failed link locating device; querying, by the alarm root cause analyzing device, whether any alarm from the failed link exists in the at least one alarm, and if an alarm from the failed link exists in the at least one alarm, marking the alarm from the failed link as a root cause alarm; and querying, by the alarm root cause analyzing device, whether any alarm from the affected edge device exists in the at least one alarm, and if an alarm from the affected edge device exists, further judging whether a service object corresponding to the alarm from the affected edge device is borne over the device interface of the affected edge device, and if yes, marking the alarm from the affected edge device as a derivative alarm.