An event analysis device (10, 50) comprising: one or more event collector (101, 501) configured to collect event log data during a plurality of work periods, the event log data recording an operation history of an operation performed on a distributed control system by an operator of the distributed control system; characterized by an event analyzer (103, 503) configured to extract one or more basic unit operations from the event log data collected by the event collector (101, 501) and extract one or more unit operations from the extracted basic unit operations, the basic unit operations representing a method of the operation performed on the distributed control system by the operator of the distributed control system, the unit operations representing an intention of the operation performed on the distributed control system by the operator of the distributed control system; an operation sequence extractor (104, 504) configured to generate a plurality of operation sequences for each of the work periods, the operation sequence arranging the unit operations extracted by the event analyzer (103, 503) in chronological order based on an operation time; an operation sequence clusterer (105, 505) configured to cluster the operation sequences based on a difference between the operation sequences in every work period; and an operation procedure generator (108, 508) configured to sort the operation sequences clustered in a same type in the order of the time order, to extract the one or more unit operations configuring the operation sequences, to acquire information regarding whether a relation between the one or more unit operations is sequential or parallel and information regarding an order of the one or more unit operations in a case in which there is a branch in the one or more unit operations, and to generate an operation procedure. one or more event collector (101, 501) configured to collect event log data during a plurality of work periods, the event log data recording an operation history of an operation performed on a distributed control system by an operator of the distributed control system; characterized by an event analyzer (103, 503) configured to extract one or more basic unit operations from the event log data collected by the event collector (101, 501) and extract one or more unit operations from the extracted basic unit operations, the basic unit operations representing a method of the operation performed on the distributed control system by the operator of the distributed control system, the unit operations representing an intention of the operation performed on the distributed control system by the operator of the distributed control system; an operation sequence extractor (104, 504) configured to generate a plurality of operation sequences for each of the work periods, the operation sequence arranging the unit operations extracted by the event analyzer (103, 503) in chronological order based on an operation time; an operation sequence clusterer (105, 505) configured to cluster the operation sequences based on a difference between the operation sequences in every work period; and an operation procedure generator (108, 508) configured to sort the operation sequences clustered in a same type in the order of the time order, to extract the one or more unit operations configuring the operation sequences, to acquire information regarding whether a relation between the one or more unit operations is sequential or parallel and information regarding an order of the one or more unit operations in a case in which there is a branch in the one or more unit operations, and to generate an operation procedure.