1. A non-transitory computer readable medium with an executable program stored thereon, where the executable program causes a computer to function as a monitoring apparatus for monitoring a computer system including a plurality of monitoring targets, the monitoring apparatus performing acts comprising: storing configuration information of the plurality of monitoring targets; storing a general rule, where the general rule previously associates a first event which can occur in any of the plurality of monitoring targets and a second event which can cause the first event, and in the case where a previously configured predetermined number or more of the second events occurred in a previously grouped plurality of predetermined monitoring targets among the plurality of monitoring targets, the general rule leads to an estimate that the second events would have caused the first event; storing event information of an event which occurred in the plurality of monitoring targets; generating a correlation rule, where the correlation rule is created based on the general rule and the configuration information; analyzing a cause of an event indicated by the received event information based on the received event information and the correlation rule; upon detecting the predetermined number or more of events corresponding to the second events in events indicated by the event information, indicating, based on the correlation rule, that an event corresponding to the first event of the events indicated by the event information will occur; outputting an analysis result that an event corresponding to the first event of the events indicated by the event information will occur; generating the correlation rule related to the received event information and stored in a memory of the monitoring apparatus; before generating the correlation rule related to the received event information, determining whether the correlation rule is stored in the memory, and in the case where the correlation rule is stored in the memory; not generating another correlation rule; calculating a matching ratio which indicates a ratio of the occurrence number of the event corresponding to the first event of the events indicated by the event information to the number of the predetermined monitoring targets; and saving the matching ratio.