1. A computer-readable storage medium storing a system analysis program for analyzing an operational form of a network to which a plurality of servers that constitute a multi-layered system are connected, by using a computer, wherein the system analysis program makes the computer execute processing comprising: collecting messages captured by a switch; analyzing contents of the collected messages; determining process types requested by the collected messages and message types indicating whether or not each of the collected messages is a request message or a response message; storing the determined process types and message types in a protocol-log storage unit as a protocol log; upon input of an instruction for generation of a model: identifying at least one process corresponding to each process type, based on at least one correspondence relationship between at least one request message and at least one response message corresponding to each of the process types which are indicated in the protocol log; selecting a set of messages in accordance with a selection criterion based on certainty of existence of caller-called relationships; generating a transaction model which satisfies at least one limiting condition related to the caller-called relationships between the identified processes, based on the selected messages; upon input of an instruction for analysis: extracting, from the protocol-log storage unit, the protocol log corresponding to at least one caller-called relationship indicated by the transaction model; analyzing a processing status of a transaction constituted by a message indicated by the extracted protocol log; and outputting a result of the analyzing; wherein the selecting determines whether, in a processing time span from a request message to a response message corresponding to an identified process executed by a server belonging to a top layer of the multi-layered system, a message corresponding to another identified process in the top layer of the multi-layered system exists or not, and when no message corresponding to another identified process exists, selects the set of messages that includes the request message, the response message corresponding to the identified processes, and all messages in the processing time span corresponding to identified processes executed by servers belonging to lower layers than the tip layer, the top layer being a layer where the request message from a client computer is received, wherein the transaction model has the caller-called relationships and processing times, wherein the limiting condition includes a condition that a processing time span of a caller process includes a processing time span of a called process, and directions of calls between the plurality of the servers, and wherein the generating generates the transaction model based on the selected set of messages, generates one or more patterns of occurrence each indicating a combination of processes which can be called from processes of each process type, calculates a probability of each of the one or more patterns of occurrence, chooses a predetermined number of ones of the one or more patterns of occurrence having higher probabilities, and generates said transaction model based on the chosen ones of the one or more patterns of occurrence.