1. A fault analysis rule extraction device comprising: an event preprocessing section configured to create a set of event logs for an inputted event log file every certain time period with reference to event occurrence time in event logs, and perform a cluster analysis on the sets of event logs to classify a plurality of clusters; and a fault analysis rule extraction section configured to relate the event logs to each other in each of the plurality of clusters which is classified by the event preprocessing section, and output a fault analysis rule file indicating a fault analysis rule which relates event logs that can be presumed to occur from the same fault.