A system analysis device comprising: a correlation destruction pattern storage means adapted to store a plurality of correlation destruction patterns each of which is a set of correlations in which correlation destruction has been detected, when a failure has occurred in the past, among correlations of pairs of metrics in a system including one or more monitored devices each belonging to any one of one or more device groups, a metric being a combination of a monitored device and an item of a performance value, a measured value of the metric being collected from the monitored device, a correlation function being a function that uses measured values at and before time t of a first metric of a pair of the first metric and a second metric and a measured value before time t of the second metric to predict a value of the second metric at time t, the correlation destruction being detected if a difference between a value of the second metric predicted by inputting measured values of the pair of the first metric and the second metric into the correlation function and a measured value of the second metric is equal to or larger than a predetermined value; an aggregated destruction pattern generation means adapted to generate an aggregated destruction pattern which is obtained by aggregating correlation destruction patterns of the same type among the plurality of correlation destruction patterns, the correlation destruction patterns of the same type being correlation destruction patterns including a predetermined number or more, or a predetermined ratio or more of correlations of the same type, the correlations of the same type being correlations having the same pair of metric types, a metric type for a metric being a combination of a device group to which a monitored device including the metric belongs and an item of performance value for the metric, the aggregated destruction pattern being a set of aggregated correlations obtained by aggregating correlations of the same type among the correlation destruction patterns of the same type, the aggregated correlations being pairs of metric types with respect to the correlations of the same type; and a similarity calculation means adapted to calculate and to output a similarity between the aggregated destruction pattern and a correlation destruction pattern detected at present. a correlation destruction pattern storage means adapted to store a plurality of correlation destruction patterns each of which is a set of correlations in which correlation destruction has been detected, when a failure has occurred in the past, among correlations of pairs of metrics in a system including one or more monitored devices each belonging to any one of one or more device groups, a metric being a combination of a monitored device and an item of a performance value, a measured value of the metric being collected from the monitored device, a correlation function being a function that uses measured values at and before time t of a first metric of a pair of the first metric and a second metric and a measured value before time t of the second metric to predict a value of the second metric at time t, the correlation destruction being detected if a difference between a value of the second metric predicted by inputting measured values of the pair of the first metric and the second metric into the correlation function and a measured value of the second metric is equal to or larger than a predetermined value; an aggregated destruction pattern generation means adapted to generate an aggregated destruction pattern which is obtained by aggregating correlation destruction patterns of the same type among the plurality of correlation destruction patterns, the correlation destruction patterns of the same type being correlation destruction patterns including a predetermined number or more, or a predetermined ratio or more of correlations of the same type, the correlations of the same type being correlations having the same pair of metric types, a metric type for a metric being a combination of a device group to which a monitored device including the metric belongs and an item of performance value for the metric, the aggregated destruction pattern being a set of aggregated correlations obtained by aggregating correlations of the same type among the correlation destruction patterns of the same type, the aggregated correlations being pairs of metric types with respect to the correlations of the same type; and a similarity calculation means adapted to calculate and to output a similarity between the aggregated destruction pattern and a correlation destruction pattern detected at present.