An event monitoring system includes a processor and a storage unit. The storage unit holds an event message including a character string related to an event occurring in an information system and guide information including one or more guides. The guide includes a guide message including a predetermined character string, notified in response to the event, and information regarding a coping method for the event. The processor compares the event message and the guide, associates the guide with the event in a case where the guide further includes information for identifying a variable portion of the guide message and a portion other than the variable portion of the guide message coincides with a portion other than a portion corresponding to the variable portion in the event message, and receives an input of information indicating a correct answer of a guide to be associated with the event in a case where the guide does not include the information for identifying the variable portion.