JP2008129685A - Work content recording system, its method, and its program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To record all processing content or keystrokes for each user with respect to a plurality of servers or terminal devices as a log file, and completely obtain a use history of the user. <P>SOLUTION: A work content recording system comprises a target server agent unit 1B which is provided for each of a plurality of servers or terminal devices connected to a network and transfers in real time a listed log file to be stored; a log data storage means 2 writing the transferred log file on a WORM; and a management console unit 3 monitoring the startup state of the log data storage means 2 and the log file information in real time, retrieving the stored log file to create a report, restoring the backup in the WORM or copying the backup thereof or retrieving the restored log file. The system further comprises a terminal input/output recording means 11 recording in real time the keystroke for each user in the agent unit 1B. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention records all user processing contents or keystrokes in a plurality of servers or terminals of terminals connected to a network in real time as a log file, so that the user's usage history can be completely grasped. The present invention relates to a work content recording system and method, and a program thereof.

  In general, in a server that is always connected through an information communication network such as the Internet, an external connection person connected through the information communication network accesses important internal data of the server and other computers connected to the server. In order to prevent this, the access authority is restricted in the operating system and a firewall is provided. At the same time, the connection route and connection time (connection start time, connection end time, total connection time, etc.) for all the users connected to the server through the information communication network, ID (Identification) of the connected user and activities after the connection Log data (Log Data) relating to the breakdown (for example, file deletion, copying and generation) is stored in an auxiliary storage device such as a hard disk drive.

If an unauthorized user such as a hacker performs unauthorized access by disabling the operating system access authority and firewall, as described above, the connection route and change location etc. are determined by the log data stored in the auxiliary storage device. A system that has been changed or destroyed can be recovered in a short time.
However, as described above, if the log data stored in the auxiliary storage device is arbitrarily changed or deleted after disabling the access authority and firewall in the operating system, it is tracked, changed or destroyed for unauthorized users. Recovery of a damaged system becomes difficult.

As described above, the conventional security system copes with intrusion / attack, but cannot cope with new threats and cannot exert an effect against internal threats.
In particular, in recent years, there are few cases where a pure employee of a company is in charge of computer maintenance, and there are many cases where a third party company is requested to perform computer maintenance and outsourced. When such a form is adopted, the company cannot see what work the contractor has done. Therefore, if a subcontractor has an unskilled person and takes out information stored in a personal information database that should not be accessed, or if a program that causes a malfunction of the company's security information is included, the company will It is extremely inconvenient because the work contents cannot be confirmed.

Therefore, as described in, for example, Japanese Patent No. 3673159 (see Patent Document 1), unauthorized connection can be performed by making it possible to write the log data only once and making rewriting and deletion impossible. A log data storage device for a communication network that can prevent the log data from being changed or deleted by the Internet has been proposed.
Next, the above apparatus will be described.
This apparatus includes a control means for generating log data of a connection person connected to a server computer through an information communication network, a data transmission means for transmitting log data generated from the control means, and log data through the data transmission means. The received medium can be written only once in real time and can be read only in an unlimited form (for example, CD-R, DVD-R, BlueRayDisk-R, etc., hereinafter referred to as WORM (Write Once Read Many)). And storage means for storing.

FIG. 4 is a block diagram of the server computer.
As shown in FIG. 4, the server computer includes a main processor 11A that performs various control operations, a memory 12A that is a temporary storage space for data required when the main processor 11A performs control operations, an operating system, An auxiliary storage device 13 (for example, a hard disk drive) in which a log file in which log data is recorded is stored, a communication network connection unit 14 connected to the communication network to transmit and receive data, and the main processor 11A The log data storage unit connection unit 15 transmits log data to the log data storage unit 40 according to control.

FIG. 5 is a block diagram of the log data storage means 40 in FIG.
The log data storage means 40 selectively drives and accesses the control unit 41, the buffer unit 42, the signal switching unit 43, and the plurality of medium drives 44 and 45, and receives log data transmitted from the server computer. Save to WORM in real time.
The buffer unit 42 temporarily stores log data transmitted from the server computer, and sequentially transmits the log data to any one of the plurality of medium drives 44 and 45 through the signal switching unit 43. This is to compensate for the difference in data transmission speed between the computer and the log data storage means 40.

  The signal switching unit 43 selectively transmits log data sequentially transmitted from the buffer unit 42 under the control of the control unit 41 to any one of the plurality of medium drives 44 and 45. , 45 respectively record the log data transmitted through the signal switching unit 43 in the WORM.

FIG. 6 is an operation flowchart of the log data storage method of FIG.
When power is turned on to the server computer, each component of the server computer including the main processor 11A is initialized. The initialized main processor 11A searches the auxiliary storage device 13 (S10), and determines whether there is a log file containing log data in the auxiliary storage device 13 (S20). If the log file already generated in the auxiliary storage device 13 is not searched in step S20, the main processor 11A generates a log file for writing log data to the auxiliary storage device 13 (S30), and then measures the time T. and (S40), sets the log file stored in the current auxiliary storage device 13 Old log file _{F 0} (S45).

The main processor 11A sequentially writes the log data collected by the monitored computer system connected to the communication network connection unit 14 through the communication network N into the log file stored in the auxiliary storage device 13 (S50). The main processor 11A sets the log file currently stored in the auxiliary storage device 13 as a new log file (F _n ) (s55). The main processor 11A compares the contents of the log data of the old log file (F ₀ ) set in step 45 with the contents of the log data of the new log file (F _n ) set in step S55. It is determined whether there is a change in the contents (S60). As a result, if there is no change in contents between the old log file (F ₀ ) and the new log file (F _n ), the time (T) measured up to the present time Check to the (S70), which (as an example, about 5 seconds) predetermined set time _(T s) is compared with (S80).

If the time (T) measured up to the present time in step S80 has not passed the set time (T _S ), the main processor 11A proceeds to step S100 described later, but the measured time (T) is set to the set time (T). If T _s ) has elapsed, the time measured up to now is reset (S90), and it is checked whether the administrator intends to turn off the server computer (S100). If is not selected to be off, the process returns to step S40 for measuring time (T).
If there is a change in contents between the old log file (F ₀ ) and the new log file (F _n ) in step S60, the main processor 11A checks the time (T) measured until now (S110). This is compared with the set time (Ts) (S120). If the time (T) measured up to the present time has not passed the set time (T _s ) in step S120, the main processor 11A proceeds to step S100. On the other hand, if the measured time (T) has passed the set time (Ts), the main processor 11A generates a log file (F _m ) to be stored in the WORM through the log data storage means 40 (S130).

Next, the main processor 11A transmits the log file (F _m ) generated in step S130 to the log data storage unit 40 through the log data storage unit connection unit 15, and from this storage unit connection unit 15 to the log data storage unit 40. The log file (F _m ) transmitted to is sequentially written in the WORM by the log data storage means 40 (S140).
If the server computer is selected to be off, a log file (F _m ) to be stored in the WORM is generated (S150). Next, the main processor 11A transmits the log file (F _m ) to the log data storage means 40 and is written (S160).

Japanese Patent No. 3673159

As mentioned above, there are some unconventional outsourcers who take out information stored in a personal information database that should not be accessed or put programs that cause problems with corporate security information. Installs the log data storage device so that it can be rewritten and deleted only once by writing to the log data, thus preventing unauthorized connection from changing or deleting the log data. Is possible.
However, in the above-described device (see Patent Document 1), a log file is taken for a single server or terminal device connected to the network, and the log file is written in real-time to a WORM that cannot be falsified or altered. In this case, the integrity of the log file was ensured, and the unauthorized analysis was discovered by the log analysis, and the misuse / abuse of the internal user and the system abnormality were discovered. That is, the log file cannot be written to the storage medium in real time for a plurality of servers and terminal devices connected to the network.
Further, when the log data storage device is arranged, only the rewriting and deletion of the log data are prevented, and it is impossible to record what command the operator has input. That is, it is impossible to completely grasp the user operation in the terminal connection of the system using only the log data storage device.

(the purpose)
It is an object of the present invention to be able to write log files in a plurality of servers and terminal devices in terminal connection in real time to a storage medium, and further record user usage history by recording all keystrokes as log files. Is to provide a work content recording system and method, and a program therefor.

The work content recording system according to the present invention is provided for each of a plurality of servers or terminal devices connected to a network, creates a list of log files to be saved, and stores the listed log files to be saved in real time. Next, a target server agent unit that starts transfer to the connected log data storage means, log data storage means for writing the transferred log file to WORM, activation status of the log data storage means and log file information A management console for monitoring in real time and creating a report and report of the saved log file, restoring the backed-up WORM, copying the backed-up WORM, or retrieving the restored log file; (First embodiment).
In addition, the target server agent section distinguishes a plurality of terminal connections by distinguishing the origin of each command from the key input data generated at the terminal, and logs the information when the command is input from the terminal device. Built-in terminal input / output record means for generating a file, encrypting the command part and recording it in a log file, and connecting the log data storage means and the management console part to the target server agent part (Second embodiment).
The work content recording system executes command classification, risk assignment, real-time monitoring, and search operations in order to manage and analyze information system work content. That is, a log of a user's key input is collected in real time through the network, analyzed, and an alarm is notified to the administrator.
The log generated from the terminal input / output record means is stored through the log data storage means, and an extremely reliable work recording method that cannot be deleted by the administrator is constructed.

According to the present invention, since recording is performed via a network, a single server can cover a plurality of servers and user terminals (first embodiment). In addition, since the key input of the operator of each terminal is collected and stored as log data, as a result of the work performed by the user of the terminal connected to which network, what command is input to the computer and which computer is Whether the operation is performed or the like is left as log data and stored (second embodiment).
In addition, since the input commands and actions are recorded in real time without human intervention, extremely high reliability can be secured as evidence data to be submitted to the court.
In addition, log analysis, which is conventionally performed manually, is automatically performed, so that cost merit can be achieved.
In addition, the work contents can be confirmed faithfully.
In addition, the fact can be confirmed even when a service failure occurs due to a mistake input in the system maintenance work.
Moreover, since the operator's key input can be collected and the actual work amount can be analyzed, it is possible to evaluate and judge the appropriateness of the support price presented by the subcontractor.
In addition, since the work of the subcontractor can be completely grasped, it can be used as one of the internal controls of the company.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
(First Example)
FIG. 1A is an overall configuration diagram of a work content recording system according to a first embodiment of the present invention.
The work content recording system according to the first embodiment includes a target server agent unit (typical server agent) 1A, a log data storage unit (logsaver enterprise) 2, and a management console unit (management console) 3. The target server agent unit 1A, the log data storage unit 2, and the management console unit 3 are all configured by a computer system including a normal processor, a memory, and an input / output device.

  The target server agent unit (typical server agent) 1A is provided with a log saver net 12 for transferring a log file to the next stage in real time. The log data storage means (Logsaver Enterprise) 2 has a net agent (NetAgent) that stores the log file transferred from the target server agent unit (typical server agent) 1A in the hard disk (LogDisk (HDD)) 22 in real time. 21, a net log saver 24 that records and stores the integrity log in real time in WORM, and an LS analysis 23 that analyzes the log file in real time. Log files to be transferred are classified and saved by item in real time. The management console unit (Management Console) 3 receives the information transferred from the net agent (NetAgent) 21, monitors the log backup status, monitors the server status, searches the log analysis contents in real time, and stores it. A log viewer (NetViewer) 31 for confirming the log file, a log restorer (LogRestorer) 32 for receiving the information transferred from the net log saver (NetLogsaver) 24 and restoring the log file recorded in the WORM; LS-analysis 33 for analyzing the log file restored from the medium, and log medium copy function (Log CD / DVD C) for executing the WORM copy function for double storage py) 34 and is provided.

(Function and effect of the first embodiment)
The most important advantage of the first embodiment is that it is possible to cover a plurality of servers and user terminals by a single device because records are taken via the network.
In addition, it has the following functions.
1) Real-time log backup function: Logs are recorded in WORM in real time.
2) Real-time log analysis function: Analyzes according to events are possible immediately after log generation.
3) Alert function: Notifies the administrator when a set event is detected.
4) Compressed recording: Logs with an average of 3 GB on a CD-R and 30-50 GB or more on a DVD-R can be recorded.
5) Large-capacity log recording: Can handle up to 5 MB / sec.
6) Ensuring confidentiality and reliability: Reading with a general-purpose drive is impossible due to the original packet writing method. Further, it is impossible to falsify and erase by recording in WORM (high reliability).
7) Continuous recording with a multi-drive configuration: By installing a plurality of drives, it is possible to continuously record in another drive after writing is completed in one drive.
8) Compatible with major server OS: UNIX (registered trademark), Linux, Windows (registered trademark) Server 2000, Windows (registered trademark) Server 2003, etc. 9) Log data storage means stores log data in WORM, When the storage capacity of the medium is exceeded, the log data is stored by switching to another medium or switching to another medium by setting the switching in the middle of the storage capacity.

The effects expected from the first embodiment are as follows.
a) Reduction of administrator's work load: Real-time automatic backup is taken, so that once it is started, it does not take time to replace the disk full. In addition, real-time log analysis can reduce the burden of monitoring work. Further, when the writing of the log file to the CD-R or DVD-R is completed, the label printer automatically outputs a sticker label in which ID, RAY NO, recording start time, and end time are described for disc management. . As a result, it is possible to form a management form as to what data is recorded in which WORM.
b) Ensuring highly reliable logs by real-time recording: It is possible to make countermeasures based on meaningful analysis results.
c) Advantages of taking work records that cannot be tampered with: Cost management: It is possible to determine a fee that is commensurate with the content of work to be paid to the subcontractor. It is possible to suppress criminal acts (unauthorized access, etc.) based on the consciousness of being constantly watched (improve internal control). It is possible to determine whether it is a misoperation or an intentional failure. It is possible to elucidate the cause of a failure and shorten the recovery work time.
d) Advantages of DVD-R recording: Copying is possible with the exception of tampering and counterfeiting. It can be easily provided as evidence data at the time of dispute. It can be stored without worrying about the size of the storage area. In addition, since WORM data can be read out partially, such as in file units, without reading out all of the data, it is possible to quickly retrieve data on a specified date and view the intended information in a short time. it can.

(System flow of the first embodiment)
The target server agent unit 1A creates a list of log files to be saved for each server before starting the program. When the creation of the log list is completed, the target server agent unit 1A starts the log saver net 12. When the log saver net 12 is activated, transfer of the log files to be saved listed in the log list to the log data saving means 2 is started in real time. A program for confirming in real time whether the process of the log saver net 12 for transferring the log file in real time is normally activated is also activated.
Next, when the net agent 21 of the log data storage unit 2 is activated, the status of the log saver net 12 in the log management target server is checked, and the log file sent from the log saver net 12 to the log data storage unit 2 Make sure that is correctly received and saved. When the log saver net 12 of each server performs real-time transfer of the log file through the network, the net agent 21 stores the transferred log file in the hard disk of the log data storage unit 2 in real time.
The net log saver 24 of the log data storage unit 2 writes the transferred log file to a CD or DVD.

  In the management console unit 3, the net viewer 31 monitors the activation state of the log data storage unit 2 and information on the log file in real time, searches the stored log file, and creates a report. The log restore 32 is a program used when restoring a backed up WORM. When a re-analysis of an existing log file or an indispensable raw log file is necessary, the log file saved on the medium (CD-R or DVD-R) is restored. The log medium copy 34 copies the saved WORM to another new new WORM. That is, the backed up medium (CD-R or DVD-R) is copied on a one-to-one basis, and the backup disk can be duplicated while maintaining its integrity. Further, the LS analysis 33 searches for a log file restored from the WORM to the hard disk of the management PC.

(Second embodiment)
FIG. 1B is an overall configuration diagram of a work content recording system according to a second embodiment of the present invention.
1B, terminal input / output record means 11 is software that records all user keystrokes in terminal connection as log files. The terminal input / output record means (TIOR) 11 is built in a target server agent unit (Typical ServerNet) 1B provided for each target server.
The terminal input / output record means (TIOR) 11 is used for remote access to connect to the system using a telnet (telnet, etc.), or a breakdown of the contents of the terminal work performed by connecting with a console of the server (console). Save in real time. That is, since all the user keystrokes in the terminal connection are recorded as a log file, the user's work content can be completely grasped. Further, the log file recorded by the terminal input / output record means 11 is transferred to the next log data storage means (Logsaver Enterprise) 2 in real time by sending it to the log saver network 12 of the target server agent unit 1B. Is done. By recording the log file with the log data storage means 2, more secure use history management becomes possible.

A certain computer system (for example, UNIX (registered trademark) system) has a function of granting authority that a user can have for each account. However, when using an account having a low-level authority, the system can be freely used. If you use an account with a high level of authority, the user can freely move around the system without any restrictions. Because it is possible to escape, security is significantly reduced.
In the work content recording system according to the second embodiment, access to a computer from a remote location or inside, or access to a computer of an insider or subcontractor employee, and a breakdown of the work due to intentional or misoperation are stored in real time. And monitor.
Establish an in-house security system that enables administrators to understand the system service status and business details.
A direct or indirect prevention system can be established from the viewpoint of preventing accidents caused by the system structure.
It is possible to clarify the responsibilities of faults during system service, and to investigate the cause accurately and quickly and establish recovery measures.

(Function of the system of the second embodiment)
The function of the work content recording system according to the second embodiment is to log under the following conditions 1-1) to 1-3).
1) Save all key inputs of the user including the route input to the terminal in real time.
1-1) When remote connection using Telnet is performed.
1-2) When direct connection using Boot Console and X-Windows (registered trademark) is performed (excluding the mouse operation, executing the Terminal command window with Console and saving the input Key-Stroke) .
1-3) When remote connection using X-Windows (registered trademark) is performed (excluding the mouse operation, the Terminal command window is executed in Console and the input Key-Stroke is saved).

2) By distinguishing the source of each command using the user, IP, port number, and process ID, it is possible to distinguish many terminal connections using the same user account.
3) Information such as connection time, connection IP, ID, and input time at the time of command input from Terminal is generated in a log file. The command part is encrypted and stored.
4) When the process of the terminal input / output record means 11 is forcibly terminated (Kill command etc.), the system automatically disconnects the user's connection and adopts a structure that forcibly eliminates the user's system use. Yes.
5) Since the log search function of the terminal usage breakdown is provided, it is easy to confirm the user's work content.

6) Operates in a separate process independent of the kernel, guarantees the safety of the kernel, and at the same time has extensibility that does not affect the existing system when the process of the terminal input / output record means 11 is added.
7) The present invention can also be applied to systems having different terminal virtual device communication specifications (for example, UNIX (registered trademark) system). In addition, it has compatibility and flexibility to support various shells such as Linux, HP-UX, Solaris, and IBM-AIX.
8) Since the main software (daemon) of the terminal input / output record unit 11 generates a process of the terminal input / output record unit 11 for each terminal, the terminal input / output record unit 11 automatically executes the process when the user logs in or logs out. The log is generated or terminated, and the process management of the individual terminal input / output record means 11 by the administrator becomes unnecessary.

(Effects of the function of the second embodiment system)
Expectations and effects of the functions described above are as follows.
a) Monitor the work contents, identify the weak points during the work, and use them for preventive measures.
b) Analyzing the work contents, the supervisor can grasp the work contents of the service person.
c) It is possible to investigate the cause and recover from a system failure or failure due to an operation error.
d) By monitoring the work content, it will have direct and indirect effects on the review of management and supervision methods and the improvement of the managerial and system environment of the manager.
e) The work contents of the subcontractor can be grasped in detail. This helps to prevent fraud.

(System flow of the second embodiment)
The operation flow of the work content recording system will be described with reference to FIG.
A plurality of servers and terminal devices are connected to the log data storage unit 2 through a network, and a target server agent unit 1B shown in FIG. 1-B is provided in the target server or the target terminal device. The terminal input / output record means 11 incorporated in the target server agent unit 1B executes the key input and input of the user because the terminal executes with the input device or the output device when the user of the server or the terminal device connects to the terminal. Monitor the output that sometimes appears on the screen.

  The terminal input / output record means 11 outputs the terminal input thus obtained and the output content corresponding to the input to the log data storage means 2 via the log saver network 12. Moreover, before outputting to the log data storage means 2, it may output to an input log file and an output log file. In this case, information such as date, time, user ID, IP address, and TTY is added to another log directory and stored in an input log file, an output log file, or the like. The saved log file can be monitored in real time by the administrator through a log viewer program from a remote location. These log files can be collected by the log data storage means 6 and stored in real time in a WORM storage system.

The process of the terminal input / output record means 11 refers to the input / output contents of the user's shell process through the terminal.
When the user communicates with the shell process through the terminal, the user's key input and the output contents of the screen appearing on the screen are saved in the terminal, and the terminal manager of the terminal input / output record means 11 inputs the Input Control Thread and the Output Control Thread. Use to monitor input / output contents.
The obtained input / output contents are organized by the String Parser module and saved as Input and Output log files by the Command Saver module. Program problems and execution information that occur during service are stored separately as Process Logs for later reference by administrators and developers.

(Process flow of the second embodiment)
FIG. 2 is a flowchart showing a process flow of the terminal input / output record means according to the present invention.
Terminal input / output record means (abbreviated as “Tior”) 11 starts automatic process execution (101). For items that are inconvenient or prohibited from automatic execution, the process of terminal input / output record means (Tior) 11 is started. Is deleted (102), and the connection is forcibly terminated. The process of tier config is executed and waits for the user's key-stroke input (105). When a tier config file failure occurs (103), an error message is output (104), and an initial value (Default) is applied to wait for the user to input Key-Stroke (105).

If there is an input of Key-Stroke (106), the input (use) content is saved in a file (107). In this case, it is classified into date-based storage, encrypted storage, input content storage, and display content storage. If the file system becomes full, an error message is output (111) and the temporary directory is saved (112).
As shown in FIG. 1B, when directly connected to the log data storage unit 2, the tier process log storage information (108) is transmitted to the storage unit 2 by real-time transmission. When the file system becomes full, an error message is output (109) and the temporary directory is saved (110).

1) Login Processing Procedure FIG. 3 is a flowchart showing the login processing procedure of the terminal input / output record means 11.
First, a user account connection is made (201), and a login prompt is displayed (202). Here, ID and Password are input (etc / passwd). The ID and password are confirmed (203), and if they do not match, the process ends (204).
If they match, the user Shell is executed (205). S202, 203, and 205 are all executed by control from the kernel. Next, etc / profile (system-wide setting file) is read (206). In this case, a clip is automatically added to etc / profile. Next, the terminal input / output recorder (Tior) process is executed (207). Then, Login Shell is executed (208). Next, etc / profile is applied (209), and user profile (system setting file defined on the user side) is also applied (210). Then, it waits for user input (211).

(program)
1A and 1B, the process flow shown in FIG. 2, and the login processing procedure shown in FIG. 3 are all programmed into a program, and the program is recorded on a CD or a DVD. If stored in a medium, the present invention can be easily realized by mounting the recording medium on a computer in the work content recording system of the present invention, and installing and executing the program on the computer. . Further, the program can be generalized by downloading the program from the computer to another computer via a communication network.

1 is an overall configuration diagram of a work content recording system according to a first embodiment of the present invention. It is a whole block diagram of the work content recording system which concerns on 2nd Example of this invention. It is a flowchart which shows the flow of the process of the terminal input / output record means based on this invention. It is a flowchart which shows the procedure of the login process of the terminal input / output record means of this invention. It is a schematic block diagram of the server computer. It is a block block diagram of the log data preservation | save means used for this invention. 6 is an operation flowchart of log data storage means in FIG. 5.

Explanation of symbols

1A Target server agent part 1B Target server agent part (including terminal I / O record means)
2 Log data storage means 3 Management console 11 Terminal input / output record means 12 Log saver net 21 Net agent 22 Log disk (HDD)
23 LS analysis (log file analysis)
24 Net Log Saver 31 Net Viewer 32 Log Restore 33 LS Analysis 34 Log Media Copy 11A Main Processor 12A Memory 13 Auxiliary Storage Device 14 Communication Network Connection Unit 15 Log Data Storage Unit Connection Unit 40 Log Data Storage Unit 41 Control Unit 42 Buffer Unit 43 Switching unit 44 Media drive 45 Media drive

Claims (11)

In the work content recording system that acquires and saves the user's usage history for each server or terminal device connected to the network,
A target server agent unit that is provided in a plurality of servers or terminal devices, creates a list of log files to be saved, and starts transferring the listed log files to be saved in real time;
Log data storage means for writing the log file transferred via the network to WORM;
Monitor the activation status of the log data storage means and information of the log file in real time, search the saved log file and create a report, restore the backed-up WORM, copy the backed-up WORM, Alternatively, a work content recording system comprising: a management console unit for retrieving a restored log file. In the work content recording system according to claim 1,
In the target server agent unit, the key input data generated at the terminal is used to distinguish a plurality of terminal connections by distinguishing the source of each key input, and a log file is recorded with information at the time of key input from the terminal. A work content recording system comprising terminal input / output record means for generating and encrypting a key input portion and recording it in a log file. In the work content recording system according to claim 1,
The log data storage means stores the log data in the WORM and switches to another new WORM when the storage capacity of one medium is exceeded, or sets another switching in the middle of the storage capacity to set another new WORM. A work content recording system characterized in that the log data is saved by switching to In the work content recording system according to claim 1,
When the terminal input / output record means forcibly terminates its own process, the system disconnects the user terminal connected to the terminal and forcibly eliminates the user's use of the system. Content recording system. In the work content recording system according to claim 1,
The terminal input / output record means operates in a separate process independent of the kernel, and eliminates the influence on the existing system when adding its own process. In the work content recording system according to claim 1,
The management console unit provides a log search function for a breakdown of terminal usage, thereby enabling the user to check the work content. In the work content recording method of acquiring and storing the user's usage history for each server or terminal device connected to the network,
The target server agent part creates a list of log files to be saved for each server before starting the program,
When the creation of the log list is completed, transfer of the log files to be saved listed in the log list to the log data storage means in real time is started over the network,
The log data storage means confirms the status of the software of the log management target server agent and confirms whether the log file sent to the log data storage means is correctly received and stored,
Save the transferred log file to the hard disk of the log data storage means in real time,
Write the transferred log file to WORM,
The management console section monitors the log data storage means activation status and log file information in real time,
Search saved log files and create reports,
Re-analyze existing log files and restore log files saved in WORM when a complete raw log file is needed,
Copy the saved WORM to another new WORM,
A work content recording method, wherein a log file restored from the WORM to a hard disk of a management PC is searched. In a work content recording method for acquiring and storing a user's usage history for each server or terminal device connected to a computer system,
When the process of the terminal input / output record means is started, the process of the terminal input / output record means is executed and the input of the user keystroke is waited. If there is an input of the keystroke, the input content is saved by date. , The encrypted storage, the input content storage, and the display content storage are classified and stored, and the process log storage information of the terminal input / output record means is transmitted to the log data storage means by real-time transmission, and the log data storage means When the file system becomes full, the switching unit switches to another recording medium and stores the log data by writing it only once. The work content recording method according to claim 8,
Before starting the process of the terminal input / output record means, a user account is connected, a login prompt is displayed, an ID and a password are entered, and this is confirmed. In this case, the user confirmation process is executed, the etc profile is read, the terminal input / output recorder process is executed, the login confirmation process is executed, and then the etc profile is applied. In addition, a work content recording method characterized by waiting for user input by applying a user profile. In the work content recording program for acquiring and storing the user's usage history for each server or terminal device connected to the computer system,
A procedure to create a list of log files to be saved for each server before starting the program on the target server agent computer, and save the log files to be saved listed in the log list in real time The procedure to start transferring to means
Procedure for confirming the status of the software of the target server agent unit in the computer of the log data storage means, procedure for confirming whether the log file sent to the log data storage means is correctly received and stored, transfer The procedure for saving the log file that has been sent to the hard disk of the log data storage means in real time, the procedure for writing the transferred log file to the WORM,
Procedures for monitoring the log data storage means activation status and log file information in real time on the management console computer, searching for saved log files, creating reports, re-analyzing existing log files, , A procedure for restoring a log file stored in a WORM when an intact raw log file is required, a procedure for copying the saved WORM to another new WORM, and a log restored from the WORM to the hard disk of the management PC Work content recording program for executing each file search procedure. In the work content recording program that acquires and saves the user's usage history for each network connected to the computer system,
If there is a procedure for instructing the computer of the target server agent section to start the process, a procedure for executing the process of the terminal input / output record means, a procedure for waiting for a user keystroke input, or a keystroke input, , Save by date, encrypted save, save input contents, save display contents, save process log information of terminal input / output record means to log data save means by real time transmission In the log data storage means, when the file system is full, the switching unit switches to another recording medium, and the work contents for executing the procedure of storing the log data by writing it only once Recording program.

Images