A system analysis device comprising: a performance information collection unit for collecting performance information (S101) from monitored device ; a correlation function generation unit for selecting a pair of metrics (S102), and for generating a plurality of candidates for a correlation function for each of pairs of metrics based on performance information during a predetermined modeling period (S103), the correlation function being a function for predicting a value of one of the metrics of the pair by inputting measurements of time series of both the metrics or the other metric of the pair into the correlation function; a correlation function storage unit for storing the plurality of candidates for a correlation function; a correlation function extraction unit for extracting one correlation function as the correlation function for the pair of metrics from the plurality of candidates for the correlation function by comparing detection sensitivities calculated for the plurality of candidates for the correlation function (S106), the detection sensitivity of a correlation function indicating a degree of effect of an abnormality of a metric associated with the correlation function on a prediction value of the correlation function and being calculated based on a coefficient of the correlation function; a correlation destruction detection unit for detecting correlation destruction in the extracted correlation function by using newly collected performance information (S106); and an abnormality cause extraction unit for extracting a candidate for an abnormality cause metric on the basis of the correlation function for which the correlation destruction is detected (S107). a performance information collection unit for collecting performance information (S101) from monitored device ; a correlation function generation unit for selecting a pair of metrics (S102), and for generating a plurality of candidates for a correlation function for each of pairs of metrics based on performance information during a predetermined modeling period (S103), the correlation function being a function for predicting a value of one of the metrics of the pair by inputting measurements of time series of both the metrics or the other metric of the pair into the correlation function; a correlation function storage unit for storing the plurality of candidates for a correlation function; a correlation function extraction unit for extracting one correlation function as the correlation function for the pair of metrics from the plurality of candidates for the correlation function by comparing detection sensitivities calculated for the plurality of candidates for the correlation function (S106), the detection sensitivity of a correlation function indicating a degree of effect of an abnormality of a metric associated with the correlation function on a prediction value of the correlation function and being calculated based on a coefficient of the correlation function; a correlation destruction detection unit for detecting correlation destruction in the extracted correlation function by using newly collected performance information (S106); and an abnormality cause extraction unit for extracting a candidate for an abnormality cause metric on the basis of the correlation function for which the correlation destruction is detected (S107). <EOS>