LOG ANALYSIS DEVICE, UNAUTHORIZED ACCESS AUDITING SYSTEM, LOG ANALYSIS PROGRAM, AND LOG ANALYSIS METHOD

A log collection part 110 of a log analysis server 100 collects an application log 211 from a WF server 200, collects an operation log 511 from an ID control part 500 which relays an access from an operator terminal 400 to a business server 600, and which as well records access status to the business server 600 as an operation record in the operation log 511, and collects an access log 611 from the business server 600 which records accessed status as an access record in the access log 611. A log analysis part 130 determines, based on the application log 211, the operation log 511, and the access log 611 collected by the log collection part, whether or not the accessed status recorded as the access record is an authorized access.