Event monitoring system and event monitoring method

An event monitoring method executed by an event monitoring system which includes a processor and a storage unit,

• the storage unit holding an event message that includes a character string related to an event occurring in an information system and guide information that includes one or more guides,
• the guide including a guide message that includes a predetermined character string, notified in response to the event, and information regarding a coping method for the event,
• the event monitoring method comprising:
• causing the processor to compare the event message and the guide;
• causing the processor to associate the guide with the event in a case where the guide further includes information for identifying a variable portion of the guide message and a portion other than the variable portion of the guide message coincides with a portion other than a portion corresponding to the variable portion in the event message;
• and
• causing the processor to receive an input of information indicating a correct answer of a guide to be associated with the event in a case where the guide does not include the information for identifying the variable portion.