To provide a log analysis system which is capable of detecting unauthorized access, an analysis device, an analysis method and a storage medium on which an analysis program is stored, a client terminal communicates with an external communication device. A relay device relays communications between the external communication device and the client terminal, in accordance with a request from the client terminal. An analysis device analyzes the content of communications by the client terminal. Then, the client terminal stores program information indicating a program that handled communications with the external communication device. The relay device stores a relay log that indicates each request, made by the client terminal, to communicate with the external communication device. In addition, the analysis device compares the program information and the relay log.