Cameras that are related to an alarm and a time period of an image that each camera records are defined in advance, and at a time of alarm occurrence, management data is made with reference to the definition contents. A surveillance object's transfer path is presumed, and on the basis of this presumption, with each of cameras installed along the pathway, the time periods of the images that are to be associated with an event are each delayed and defined. By this, it is possible to record the suspicious behavior that the surveillance object demonstrates at the time of alarm occurrence and the suspicious behavior that the surveillance object demonstrates on its transfer path to a surveillance area as an event image. Furthermore, it is possible to narrow the time periods of images in which the surveillance object may be caught.