1. A management method of a computer system including one or more nodes to be monitored, and a management system which is coupled to the one or more nodes via a network and which monitors and manages the one or more nodes, wherein the management system performs the steps of: acquiring a processing performance value representing processing performance of the one or more nodes to detect occurrence of a fault in the one or more nodes on the basis of the acquired processing performance value, applying the detected fault to an analysis rule representing a relationship of a combination of one or more condition events capable of occurring in the one or more nodes with a conclusion event set as a fault cause of the combination of the condition events, to calculate a confidence value which is the information representing the possibility of occurrence of the fault in the one or more nodes, selecting, as a start-point cause candidate, one of the conclusion events set as a plurality of fault causes, to extract the condition events related to the start-point cause candidate, selecting, as a related cause candidate, a conclusion event which relates to the extracted condition event, and which is set as one or more fault causes different from the conclusion event selected as the start-point cause candidate, and performing classification processing of the conclusion event selected as the start-point cause candidate, and the conclusion event of the related cause candidate separately from the other conclusion events, to display the classified conclusion events on a display screen.