JP2007279991A - Log management program and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To facilitate the management of a computer by creating an effective log file. <P>SOLUTION: The log management program 40 for managing the operation history of a client 2 in a server 3 executes a step of capturing the display image of the client 2 as image log data every time a predetermined event occurs in the client 2, a step in which the client 2 automatically transmits the image log data through a communication network N to the server 3, and a step in which the server 3 automatically stores the received image log data in a log database 4. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a log management program and a recording medium for suitably managing computer operation records.

In some conventional computer systems, processing information such as program activation, error information, and the like are recorded in a computer as a log file (see Patent Document 1). According to this, when an abnormality such as a system failure occurs, the system administrator can determine the cause of the abnormality by analyzing the log file, which is useful for system recovery.
JP 2002-328817 A

  However, since the conventional log file is recorded as text data in which specialized words are arranged, the log file cannot be effectively used unless it is a system administrator having advanced knowledge. Moreover, even a highly skilled system administrator takes time to analyze a log file, and a great amount of labor is required for system recovery work.

  Furthermore, since the conventional log file only records the rough contents of processing such as the type of the program started by the user and the error result, the system administrator is accompanied by the program start even if the log file is viewed. There is no detailed operation to know. Then, the system administrator interviews the user to investigate the cause, but the system recovery work can be done by the user failing to tell the system administrator the operation causing the abnormality or making a wrong testimony. May be extremely confusing.

  Accordingly, an object of the present invention is to create an effective log file so that management of a computer becomes easy.

  The present invention has been made in view of the above circumstances, and a log management program according to the present invention is a log management program for managing an operation history of a client at a server, and a predetermined event is detected at the client. Each time it occurs, the step of capturing the display screen of the client as image log data, the step of automatically transmitting the captured image log data to a server via a communication network, and the server receiving the server Automatically storing image log data in a log database.

  In this way, the display screen for each event occurrence at the client is automatically saved in the server's log database as image log data, so the administrator can simply browse the client's display screen transition visually on the server side. It is possible to perform log analysis. Therefore, when a system failure or the like occurs due to an operation on the client side, the administrator can easily determine the cause, and labor and time required for system recovery are greatly reduced.

  Further, in the case of a conventional text log file, the history of program start / end and the like is merely saved. However, in the present invention, image log data is generated every event occurrence, so the contents of the keyboard input of the client, etc. Can also be grasped as a history. Therefore, the administrator can know the operation history at the client in more detail than before, and the cause investigation at the time of system failure is greatly promoted. In addition, since the operation history of the client is recorded in detail as an image, a deterrent to prevent unauthorized use by the user of the client 2 also works. Further, since the image log data is generated every time an event occurs, useless image storage is suppressed, and display screen transition can be browsed without waste. Furthermore, if the administrator views the image log data on the server side, it becomes possible to easily check the operation skill (for example, software development skill) of the user (for example, an employee) using the client.

  When the communication between the client and the server is disconnected, the client temporarily stores the captured image log data in its own storage unit, and the temporary storage when the communication is connected A step of automatically transmitting the processed image log data to the server may be executed.

  In this way, even if the client user works in a state where the communication with the server is disconnected so that the image log data is not transmitted to the server, the client temporarily stops when the communication between the client and the server is connected later. Since the stored image log data is automatically transmitted to the server, the server can reliably collect the image log data.

  The server may execute a step of automatically storing the image log data in a designated folder corresponding to each client on the log database in a state where date and time information is given.

  In this way, it is possible to easily browse the image log data of a specific date and time of a specific client.

  On the screen of the administrator terminal that can access the log database by predetermined authentication, the image log data of the specified client on the log database is played back in a time-sequential manner to reproduce the specified A view program for continuously reproducing and displaying the display screen transition of the client may be provided.

  In this way, if the administrator designates the client, the display screen transition of the specific client can be automatically browsed like a picture by the view program, and the workability of log analysis is greatly improved.

  The specified folder of the log database may not be accessible from the client.

  In this way, since the user cannot delete the image log data of the used client, the server can surely collect the image log data and prevent the client user from unauthorized use. There is an advantage that power works.

  The present invention is also a log management program for managing an operation history of a computer, each time a predetermined event occurs in the computer, the step of capturing the display screen of the computer as image log data, and the capture And a step of automatically storing image log data in a log database by the computer.

  In this way, it is possible to grasp the transition of the display screen of the computer by simply visually browsing the image log data automatically stored in the log database, and it is possible to easily perform log analysis. Therefore, when a failure or the like occurs in the computer, the cause can be easily identified, and labor and time required for recovery are greatly reduced. Further, in the case of a conventional text log file, the history of starting / ending the program is only saved, but in the present invention, the display screen is captured every time an event occurs, so the contents of keyboard input, etc. are also recorded as history. It is easy to grasp and the accuracy of log analysis is greatly improved.

  The present invention also provides a computer-readable recording medium in which the log management program is recorded.

  The present invention also includes a step of capturing a display screen of the client as image log data every time a predetermined event occurs in the client, and the client automatically captures the captured image log data to a server via a communication network. There is provided a log management method comprising: a transmitting step; and the server automatically storing the received image log data in a log database.

  The present invention further includes a server that receives image log data from a client that captures a display screen as image log data every time a predetermined event occurs, and automatically saves the image log data in a log database. A log management system is provided.

  As is clear from the above description, according to the present invention, since the display screen for each event occurrence is automatically saved in the log database as image log data, the administrator can simply view the display screen transitions easily. It is possible to perform log analysis.

  Embodiments according to the present invention will be described below with reference to the drawings.

(First embodiment)
FIG. 1 is a schematic diagram showing a log management system 1 according to the first embodiment of the present invention. As shown in FIG. 1, the log management system 1 includes a server 3, a plurality of clients 2 connected to the server 3 via a communication network N, and a management connected to the server 3 via a communication network N. Person terminal 5. A log database 4 is connected to the server 3.

  FIG. 2 is a block diagram of the client 2. As shown in FIG. 2, the client 2 includes a client main body 7 in which Windows (registered trademark) is installed as an OS (Operating System), an input device 8 such as a keyboard and a mouse connected to the client main body 7, and a client. A display device 9 such as a liquid crystal display or a CRT connected to the main body 7 is provided. The client body 7 includes a CPU (Central Processing Unit) 10 that performs various arithmetic processes, a memory 11 for temporary storage, an interface 12 for connecting the input device 8 to the client body 7, and a display device 9. An interface 13 for connecting to the communication network N, an interface 14 for connecting the client body 7 to the communication network N, and a storage unit 15 comprising a hard disk device or the like.

  A client-side resident program 16 constituting a log management program is installed in the storage unit 15. The storage unit 15 is provided with a temporary folder 17 for temporarily storing image log data. The temporary folder 17 may be set to be inaccessible by the user of the client 2.

  FIG. 3 is a block diagram of the server 3. As shown in FIG. 3, the server 3 is connected to a CPU (Central Processing Unit) 20 that performs various arithmetic processes, a memory 21 for temporary storage, an interface 22 for connecting to a communication network N, and a log database 4. And a storage unit 24 comprising a hard disk device or the like. A server-side resident program 25 that constitutes a log management program is installed in the storage unit 24. The log database 4 is provided with designated folders 26 corresponding to the respective clients 2. Each designated folder 26 is set to be inaccessible from each client 2, and a user other than the administrator cannot delete image log data stored in the designated folder 26 of the log database 4.

  FIG. 4 is a block diagram of the administrator terminal 5. As shown in FIG. 5, a terminal main body 30 in which Windows (registered trademark) is installed as an OS (Operating System), an input device 31 such as a keyboard or a mouse connected to the terminal main body 30, and a connection to the terminal main body 31. And a display device 32 such as a liquid crystal display or a CRT. The terminal main body 30 includes a CPU (Central Processing Unit) 33 that performs various arithmetic processing, a memory 34 for temporary storage, an interface 35 for connecting the terminal main body 30 to the communication network N, and an input device 31. An interface 36 for connecting to the terminal main body 30, an interface 37 for connecting the display device 32 to the terminal body 30, and a storage unit 38 comprising a hard disk device or the like. A view program 39 constituting a log management program is installed in the storage unit 38. Further, the administrator terminal 5 can access the log database 4 when the administrator successfully authenticates the ID and password.

  Then, the log management program 40 (see FIG. 5) including the client-side resident program 16, the server-side resident program 25, and the view program 39 is stored on a computer-readable recording medium (for example, a CD-ROM). It is distributed in a stored state and installed in the client 2, the server 3, and the administrator terminal 5 from the recording medium, respectively. The log management program 40 may be distributed by downloading via the Internet or the like.

  Next, the operation of the log management system 1 will be described with reference mainly to FIG. FIG. 5 is a chart showing an operation sequence of the log management system 1. As shown in FIG. 5, when the client-side resident program 16 detects that an event has occurred in the OS of the client 2 (step S1), the client-side resident program 16 captures the entire display screen of the display device 9 at the time of the event occurrence to generate a bitmap format. The image data which is the still image is generated (step S2). Here, the event refers to an event that causes a change in the state of the software. For example, in a window system such as Windows (registered trademark), program start / end, file open / close, keyboard ENTER key Events such as pressing and mouse click operations are used. The event detected by the client-side resident program 16 is an event detected by a program other than the client-side resident program.

  Next, the client-side resident program 16 reduces the image data to a vertical and horizontal size of 50% and then compresses the image data into a JPEG format or the like to generate image log data (step S3). At this time, the client side resident program 16 adds the ID of the client 2 and the creation date and time to the file name of the image log data.

  Then, the client-side resident program 16 determines whether or not the client 2 is communicably connected to the server 3 (step S4), and if connected, transmits image log data to the server 3 (step S5). . On the other hand, if the communication between the client 2 and the server 3 is disconnected, the client-side resident program 16 temporarily stores the image log data in the temporary folder 17 of the storage unit 15 of the client 2 (step S6). The image log data stored and stored in the temporary folder 17 is stored in the server 3 when the client-side resident program 16 detects that the communication between the client 2 and the server 3 is connected (step S4). Automatic transmission is performed (step S5). The above steps S1 to S6 are automatically performed by background processing so that the user of the client 2 is not recognized. In other words, the client-side resident program 16 executes steps S1 to S6 in the background without displaying a window for the program 16 in the multi-window system.

  When the server-side resident program 25 receives the image log data from the client-side resident program 16 (step S10), the server-side resident program 25 determines the client ID by referring to the file name of the image log data, and designates the designated folder 26 corresponding to the client ID. The image log data is stored in the log database 4 and the log database 4 is updated (step S11). The log database 4 stores image log data of the most recent predetermined time or predetermined number of days (for example, the current day and the previous day), and image log data before that (for example, the day before the previous day) is automatically deleted. It is set.

  In addition, the server-side resident program 25 patrols and monitors each designated folder 26 corresponding to each client in the log database 4, and sets the designated folder 26 in spite of the client 2 accessing the server 3. The date and time when the image log data is not stored is recorded (step S12). As a result, the client 2 can know whether or not the transmission of the image log data to the server 3 is illegally prevented.

  The view program 39 of the administrator terminal 5 has a viewer function and an export function. First, the viewer function will be described. FIG. 6 is a diagram illustrating an example of a view program operation screen 50 in the administrator terminal 5. As shown in FIG. 6, the operation screen 50 for the viewer function includes a screen reproduction area 51 for displaying image log data, a viewer setting area 52, and an operation area 53.

  The viewer setting area 52 is provided with a client designation unit 54 for designating a client that performs log browsing, and a date / time range designation unit 55 for designating a date / time range for performing log browsing. The date / time range designation unit 55 includes a start point designation unit 56 that designates the start point of the date and time when the log is browsed, and an end point designation unit 57 that designates the end point of the date and time when the log is browsed. The operation area 53 includes a playback button 58 for continuously reproducing the image log data by frame advance in time series based on the contents set in the viewer setting area 52, and a stop button 59 for stopping the frame advance reproduction of the image log data. A rewind button 60 for returning the image log data by one frame and a fast-forward button 61 for advancing the image log data by one frame are provided.

  As shown in FIGS. 5 and 6, the administrator designates the client by the client designation unit 54 using the operation screen 50 of the administrator terminal 5 and designates the date / time range by the date / time range designation unit 55. The playback button 58 is clicked (step S20). Then, the view program 39 refers to the log database 4, and based on the setting contents in the viewer setting area 52, the past image log data is time-sequentially played back like a picture-story show in the image display area 51. At this time, the view program 39 determines the creation date and time of the image log data from the file name. The reproduction of the image log data can be executed in real time.

  Next, the export function will be described. As shown in FIG. 5, when an administrator designates a client and a date / time range and deletes image log data on an operation screen (not shown) of the view program 39 (step S30), the view program 39 is to be deleted. A confirmation message as to whether or not to export the image log data is output (step S31). When the administrator inputs “Yes” (step S31), the view program 39 transfers the image log data to be deleted to an external storage medium such as a DVD (step S32), and then deletes the image log to be deleted from the log database 4. Data is deleted (step S33). On the other hand, when the administrator inputs “No” (step S31), the view program 39 deletes the image log data to be deleted from the log database 4 without exporting (step S33). Note that the export function may be provided independently of the deletion function.

  With the above configuration, the display screen for each event occurrence in the client 2 is automatically saved as image log data in the log database 4 of the server 3, so that the administrator accesses the server 3 from the administrator terminal 5 to view the view program. The log analysis can be easily performed simply by visually viewing the display screen transition of the client 2 by 39. Therefore, when a system failure or the like occurs due to an operation on the client 2 side, the administrator can easily determine the cause, and the labor and time required for system recovery are greatly reduced.

  Further, since the image log data is generated every time an event occurs, for example, when text input is performed at the client 2 and the ENTER key is pressed, the input displayed on the screen when the ENTER key is pressed The administrator can also understand the text contents from the image log data. Therefore, the administrator can know the operation history in the client 2 in more detail than before, and the cause investigation at the time of system failure is greatly promoted. In addition, since the operation history of the client 2 is recorded in detail with images, a deterrent to prevent unauthorized use by the user of the client 2 also works. In addition, since image log data is generated each time an event occurs, it is possible to browse display screen transitions without wasting, as compared to the case where screens are captured regularly at a fixed timing, and unnecessary image storage is suppressed. It becomes possible.

  Even when the system is operating normally, the administrator browses the image log data using the view program 39 of the administrator terminal 5 so that the user who uses the client 2 (for example, an employee) It can also be used for skill checks (for example, checking software development skills).

  Further, even if the user of the client 2 intentionally cuts off the communication with the server 3, the client 2 temporarily stores the image log data in its temporary folder 17, and later when the communication is connected. Since the image log data is automatically transmitted to the server 3, the server 3 can collect the image log data without omission.

  In this embodiment, the client-side resident program 16 constituting the log management program is installed in the client 2 itself. However, when a thin client is used, a function corresponding to the client-side resident program 16 is used. May be provided on the server side. At this time, if communication between the client and the server is disconnected, it is preferable to lock the client OS so that it cannot be operated. Here, a thin client is a generic term for a system in which the client has only a minimum function and manages resources such as application software and files on the server side, or the functions are narrowed down to realize such a system. A client computer.

  In addition, although the present embodiment uses a client / server system, it may be an ASP system. The view program 39 is operated on the administrator terminal 5, which is a separate terminal from the server 3, but may be operated on the server 3.

(Second Embodiment)
Next, a second embodiment will be described. The difference from the first embodiment is that a stand-alone computer 100 is used instead of the client / server system. FIG. 7 is a block diagram illustrating a computer 100 according to the second embodiment. As shown in FIG. 7, a computer 100 includes a computer main body 70 in which Windows (registered trademark) is installed as an OS (Operating System), an input device 71 such as a keyboard and a mouse connected to the computer main body 70, a computer A display device 72 such as a liquid crystal display or a CRT connected to the main body 70 is provided. The computer main body 70 includes a CPU (Central Processing Unit) 73 that performs various arithmetic processing, a memory 74 for temporary storage, an interface 75 for connecting the input device 71 to the computer main body 70, and a display device 72. An interface 76 for connecting to the storage, a storage unit 77 comprising a hard disk device and a log database 78.

A log management program 79 is installed in the storage unit 77. The log management program 79 has substantially the same functions as the client-side resident program, server-side resident program, and view program of the first embodiment.
Further, the computer 100 is shared by a plurality of user IDs, and the log database 78 can be accessed only by a person having administrator authority of the computer 100 by password authentication. The log database 79 is provided with designated folders corresponding to the plurality of users.

  Next, the operation of the log management program 79 will be described with reference mainly to FIG. FIG. 8 is a chart showing an operation sequence of the log management program 79. As shown in FIG. 8, the log management program 79 has a log function, a viewer function, and an export function.

  First, the log function will be described. When the log management program 79 detects that an event has occurred in the OS of the computer 100 (step S50), the log management program 79 captures the entire display screen of the display device 72 at the time of the event occurrence and captures image data that is a bitmap-format still image. Generate (step S51). Next, the log management program 79 reduces the image data to a vertical and horizontal size of 50% and then compresses the image data into a JPEG format or the like to generate image log data (step S52). Then, the log management program 79 stores the image log data in a designated folder corresponding to the user of the log database 78, and updates the log database 78 (step S53). The above steps S50 to S53 are automatically performed in the background process so as not to be recognized by the user of the computer 100. That is, the log management program 79 executes steps S50 to S53 in the background without displaying a window for its own program 79 in the multi-window system.

  Next, the viewer function will be described. The viewer function can only be activated with administrator privileges. The administrator designates the user name and the date / time range using the operation screen as shown in FIG. 6 of the computer 100, and then clicks the play button (step S55). Then, the log management program 79 refers to the log database 78 and reproduces the image log data in a time-series manner like a picture-story show.

  Next, the export function will be described. The export function can only be started with administrator privileges. When the administrator designates the client and the date / time range and deletes the image log data (step S58), the log management program 79 outputs a confirmation message as to whether or not to delete the image log data to be deleted (step S58). S59). When the administrator inputs “Yes” (step S59), the log management program 79 transfers the image log data to be deleted to an external storage medium such as a DVD (step S60), and then deletes the image to be deleted from the log database 78. The log data is deleted (step S61). On the other hand, when the administrator inputs “No” (step S59), the log management program 79 deletes the image log data to be deleted from the log database 78 without exporting (step S61). The export function may be provided independently of the deletion function.

  In each of the above-described embodiments, the display screen is captured every time an event occurs. However, the display screen may be captured periodically at a preset timing, or a combination of these settings. Also good.

  As described above, in the log management program according to the present invention, the display screen for each event occurrence is automatically saved in the log database as image log data, so that the administrator can simply view the display screen transitions easily. It has an excellent effect of log analysis, and is useful when applied to a client / server system, a stand-alone system, an ASP system computer system, or the like.

It is the schematic which shows the log management system which concerns on 1st Embodiment of this invention. It is a block diagram of the client shown in FIG. It is a block diagram of the server shown in FIG. It is a block diagram of the administrator terminal shown in FIG. It is a chart figure showing the operation sequence of the log management system shown in FIG. It is drawing which shows an example of the operation screen of the view program in the administrator terminal shown in FIG. It is a block diagram which shows the computer of 2nd Embodiment. FIG. 8 is a chart showing an operation sequence of the log management program of the computer shown in FIG. 7.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Log management system 2 Client 3 Server 4,78 Log database 5 Manager terminal 15 Memory | storage part 16 Client side resident program 25 Server side resident program 26 Designated folder 39 View program 40, 79 Log management program 100 Computer N Communication network

Claims (7)

A log management program for managing client operation history on the server,
Each time a predetermined event occurs in the client, capturing the display screen of the client as image log data; and
The client automatically transmitting the captured image log data to a server via a communication network;
A step of automatically storing the image log data received by the server in a log database.   When the communication between the client and the server is disconnected, the client temporarily stores the captured image log data in its own storage unit, and the temporary storage when the communication is connected The log management program according to claim 1, wherein a step of automatically transmitting the processed image log data to the server is executed.   3. The log management program according to claim 1, wherein the server executes a step of automatically saving the image log data in a designated folder corresponding to each client on the log database with date and time information added. 4.   On the screen of the administrator terminal that can access the log database by predetermined authentication, the image log data of the specified client on the log database is played back in a time-sequential manner to reproduce the specified 4. The log management program according to claim 3, further comprising a view program for continuously reproducing and displaying the display screen transition of the client.   The log management program according to claim 3 or 4, wherein the designated folder of the log database is inaccessible from the client. A log management program for managing computer operation history,
Capturing a computer display screen as image log data each time a predetermined event occurs in the computer;
And a step of causing the computer to automatically save the captured image log data in a log database.   7. A recording medium on which the log management program according to claim 1 is recorded.