A processor calculates a correlation between a first data item and a second data item, based on values of the first data item in a first log and values of the second data item in a second log, and determines an influence direction by comparing values of a first chronological item with values of a second chronological item. The processor collects third and fourth logs respectively generated later than the first and second logs. The processor determines whether the correlation holds with respect to values of the first data item in the third log and values of the second data item in the fourth log, and outputs an anomaly report, when the correlation does not hold, to indicate which of the first and second data items is a cause data item (i.e., the source of an anomaly), based on the influence direction.