Provided is a system operation management device by which the burden on a system administrator at the time of applying an judgment criterion for future failure detection can be reduced. The system operation management device (1) comprises a performance information accumulation unit (12), a model generation unit (30), and an analysis unit (31). The performance information accumulation unit (12) stores performance information in chronological order, the performance information including a plurality of types of performance values in the system. The model generation unit (30) generates a correlation model including at least one correlative relationship between the different types of performance values stored in the performance information accumulation unit (12), in each of a plurality of periods having any of a plurality of attributes. The analysis unit (31) uses the input performance information of the system and a correlation model corresponding to the attribute of the period during which the performance information was acquired, and performs malfunction detection of the performance information.