A virtual network function audit method, performed on a virtual network function audit apparatus and used to audit a plurality of virtual network functions, VNFs, generated by a platform that comprises an authentication and authorization component, a service component, and a virtualized infrastructure, wherein the method comprises: receiving at least one authentication and authorization event that is triggered by a first VNF operation and reported by the authentication and authorization component, receiving at least one service event that is triggered by a second VNF operation and reported by the service component, and receiving at least one access event that is triggered by a third VNF operation and reported by the virtualized infrastructure; obtaining an event occurrence sequence of each VNF according to the at least one authentication and authorization event, the at least one service event, and the at least one access event, wherein an event occurrence sequence is used to indicate an occurrence order of multiple events corresponding to one VNF; and auditing the event occurrence sequence of each VNF to obtain an audit result of the VNF, wherein the obtaining an event occurrence sequence of each VNF according to the at least one authentication and authorization event, the at least one service event, and the at least one access event comprises: classifying the at least one authentication and authorization event, the at least one service event, and the at least one access event according to a user identifier in event information corresponding to each of the at least one authentication and authorization event, the at least one service event, and the at least one access event, to obtain all events corresponding to each user identifier; analyzing, according to a VNF identifier comprised in event information corresponding to each event in all the events corresponding to each user identifier, all the events corresponding to the same user identifier to obtain all events corresponding to each VNF identifier; and sorting, according to occurrence time comprised in event information corresponding to each event in all the events corresponding to each VNF identifier, all the events corresponding to each VNF identifier to obtain an event occurrence sequence of a VNF corresponding to each VNF identifier. receiving at least one authentication and authorization event that is triggered by a first VNF operation and reported by the authentication and authorization component, receiving at least one service event that is triggered by a second VNF operation and reported by the service component, and receiving at least one access event that is triggered by a third VNF operation and reported by the virtualized infrastructure; obtaining an event occurrence sequence of each VNF according to the at least one authentication and authorization event, the at least one service event, and the at least one access event, wherein an event occurrence sequence is used to indicate an occurrence order of multiple events corresponding to one VNF; and auditing the event occurrence sequence of each VNF to obtain an audit result of the VNF, wherein the obtaining an event occurrence sequence of each VNF according to the at least one authentication and authorization event, the at least one service event, and the at least one access event comprises: classifying the at least one authentication and authorization event, the at least one service event, and the at least one access event according to a user identifier in event information corresponding to each of the at least one authentication and authorization event, the at least one service event, and the at least one access event, to obtain all events corresponding to each user identifier; analyzing, according to a VNF identifier comprised in event information corresponding to each event in all the events corresponding to each user identifier, all the events corresponding to the same user identifier to obtain all events corresponding to each VNF identifier; and sorting, according to occurrence time comprised in event information corresponding to each event in all the events corresponding to each VNF identifier, all the events corresponding to each VNF identifier to obtain an event occurrence sequence of a VNF corresponding to each VNF identifier. classifying the at least one authentication and authorization event, the at least one service event, and the at least one access event according to a user identifier in event information corresponding to each of the at least one authentication and authorization event, the at least one service event, and the at least one access event, to obtain all events corresponding to each user identifier; analyzing, according to a VNF identifier comprised in event information corresponding to each event in all the events corresponding to each user identifier, all the events corresponding to the same user identifier to obtain all events corresponding to each VNF identifier; and sorting, according to occurrence time comprised in event information corresponding to each event in all the events corresponding to each VNF identifier, all the events corresponding to each VNF identifier to obtain an event occurrence sequence of a VNF corresponding to each VNF identifier.