1. A computer program for causing a computer to function as a monitoring apparatus wherein the monitoring apparatus is for monitoring a computer system including a plurality of monitoring targets, the computer program comprising: a configuration information storing part configured to store configuration information of the plurality of monitoring targets; a general rule storing part configured to store a general rule, wherein the general rule previously associates a first event which can occur in any of the plurality of monitoring targets and a second event which can cause the first event, and in the case where a previously configured predetermined number or more of the second events occurred in a previously grouped plurality of predetermined monitoring targets among the plurality of monitoring targets, the general rule leads to an estimate that the second events would have caused the first event; an event information storing part configured to store event information of an event which occurred in the plurality of monitoring targets; an correlation rule generating part configured to generate an correlation rule, wherein the correlation rule is created based on the general rule and the configuration information, and in the case where the predetermined number or more of events corresponding to the second events are detected in events indicated by the event information, the correlation rule indicates that an event corresponding to the first event of the events indicated by the event information will occur, and an analyzing part configured to analyze a cause of an event indicated by the received event information based on the received event information and the correlation rule.