An apparatus for monitoring a computer system includes a data collecting unit that collects performance data on a plurality of performance items related to the performance of the computer system; a performance degradation cause model 30 in which a cause event and degradation performance items which are one or more performance items degraded by the cause event are associated with one another; and an outlier score calculator 50 that specifies a degree of deviation, when target performance data which is performance data of degradation performance items collected by the data collecting unit deviates from a normal range under a condition that the normal range of the performance data of the one or more degradation performance items for the cause event is predetermined, and outputs information on the cause event based on a temporal change in the degree of deviation.