A log collection system comprising an in-vehicle apparatus, the in-vehicle apparatus comprising: a log collection unit configured to collect a log; a log storage unit for accumulation of at least a part of the log; a log priority information storage unit storing log priority information indicating a priority of a log to be accumulated in the log storage unit; an accumulation log determination unit configured to determine a log to be accumulated in the log storage unit based on the log priority information; a communication unit configured to transmit a log accumulated in the log storage unit to a server; and a log priority table management unit configured to update the log priority information stored on the log priority information storage unit based on an update command from the server; wherein the server is connected to the in-vehicle apparatus via a network, and the server comprises: a log analysis unit configured to analyze a log received from the in-vehicle apparatus and compare it to a log received from another in-vehicle apparatus mounted on a different vehicle and detect a possibility of attack from the network; and a log priority change instruction unit configured to transmit the update command to the in-vehicle apparatus to update the log priority information stored in the log priority information storage unit, when the log analysis unit detects a possibility of attack. a log collection unit configured to collect a log; a log storage unit for accumulation of at least a part of the log; a log priority information storage unit storing log priority information indicating a priority of a log to be accumulated in the log storage unit; an accumulation log determination unit configured to determine a log to be accumulated in the log storage unit based on the log priority information; a communication unit configured to transmit a log accumulated in the log storage unit to a server; and a log priority table management unit configured to update the log priority information stored on the log priority information storage unit based on an update command from the server; wherein the server is connected to the in-vehicle apparatus via a network, and the server comprises: a log analysis unit configured to analyze a log received from the in-vehicle apparatus and compare it to a log received from another in-vehicle apparatus mounted on a different vehicle and detect a possibility of attack from the network; and a log priority change instruction unit configured to transmit the update command to the in-vehicle apparatus to update the log priority information stored in the log priority information storage unit, when the log analysis unit detects a possibility of attack. a log analysis unit configured to analyze a log received from the in-vehicle apparatus and compare it to a log received from another in-vehicle apparatus mounted on a different vehicle and detect a possibility of attack from the network; and a log priority change instruction unit configured to transmit the update command to the in-vehicle apparatus to update the log priority information stored in the log priority information storage unit, when the log analysis unit detects a possibility of attack.