A management system of one embodiment of the invention has a management computer and a managed computer which is managed by the management computer. The management computer comprises a communication device configured to receive operating data of a monitoring object inside a managed computer and information relating to an event. A processor is configured to identify from the operating data received by the communication device a portion of the operating data which relates to the event, based on the operating data and the information relating to the event indicating trouble occurrence or performance decrement of the monitoring object.