JP2008052570A - System for managing operation history - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an operation history management system for performing an efficient search even when there are many operation histories of which file operations are traced, for clearly displaying the result of the search, and for easily obtaining use status. <P>SOLUTION: An operation history database 106 stores operation histories in a list format. Whenever a trace processing request processing part 102 receives trace processing to be sequentially transmitted from an administrator's computer 11, it searches for the operation history database 106, and transmits the result of the search as a reply. The administrator's computer 11 receives the result of the search, and updates only the difference of an operation history tree to display, by using an operation history tree being displayed in an operation history tree display part 112 and the received result of the search, with an operation history tree processing part 113. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an information security management system in a computer system, and more particularly to an operation history management system for retrieving an operation history (log) and displaying it.

  In recent years, file operation tracing has been emphasized. This is a series of operation history for files on the computer system used mainly by managed persons (hereinafter referred to as “employees”) among employees of companies, etc., as security managers (hereinafter referred to as “managers”). ") To track and search. The reason why this file operation trace is regarded as important is the leakage of confidential information due to the spread of computer systems and high-speed networks and the progress of computerization of information and the easy and frequent copying and movement of information. This is because it is becoming a big social problem so that it becomes everyday.

  Under such a social environment, as a part of file operation tracing, a system for recording an operation history while appropriately limiting operations on a computer system used by an employee has been rapidly spread. By introducing this system, in-house security managers can perform security control that is effective in preventing employees from taking out confidential information (hereinafter referred to as “files”) illegally.

  Further, not only the user's take-out operation history but also the history of the application used are recorded, and the cause investigation can be quickly and reliably confirmed by referring to the history when a leakage incident occurs. Furthermore, by thoroughly informing employees that the file operation trace is possible, a mental deterrent effect against fraud can also be expected.

  In this system for the purpose of tracing file operations as described above, the operation history of the computer user, that is, the operation history of when and who performed what operation on which computer is collected and managed. enable.

  FIG. 8 is a schematic configuration diagram of a conventional operation history management system. As shown in FIG. 8, the server computer 80 for managing the operation history, the administrator computer 81 used by the administrator to refer to the operation history stored in the server computer 80, and the administrator The computer is composed of client computers 82a and 82b used by a general user.

  These computers 80, 81, 82 a and 82 b are connected to each other by a network 83. On the other hand, the client computers 82a and 82b connected to the server computer 80 via the network 83 include operation history information acquisition units 822a and 822b that acquire operation information performed by the respective users, and the acquired operation history information is periodically transmitted to the server. The operation history information transmitting units 821a and 821b are configured to transmit to the computer.

  The administrator computer 81 connected to the server computer 80 via the network 83 includes an input unit 812 that receives input from an administrator who is a user, and a transmission / reception unit that transmits and receives search conditions and search results input to the server computer 80. 813 and an operation history display unit 811 for displaying a search result.

  The server computer 80 includes an operation history information receiving unit 804 that receives operation history information transmitted by the client computers 82a and 82b, a DB update unit 803 that stores and manages the received operation history information in an operation history DB (database) 805, The search processing unit 802 receives a search request from the administrator computer, performs a search process in response to the search request, and transmits a search result.

  The operation history DB 805 managed by the server computer 80 stores operation history information collected from the client computers 82a and 82b in a table format. In the operation history management system configured as shown in FIG. 8, history information of operations performed on the client computers 82a and 82b is transmitted to the server computer 80, stored in the operation history DB 805, and managed in a searchable manner.

  On the other hand, the administrator who manages the operation history of the employee can view the operation history information stored in the server computer 80 by using the administrator computer 81 operated by the administrator.

  In the conventional operation history management system shown in FIG. 8 and the operation information collection system as shown in Patent Document 1, individual history information related to operations performed by the user on the client computer systems 82a and 82b is stored in the operation history DB 805. A list of operation histories is recorded in. This operation history includes a lot of information indicating a history of operating a file belonging to the computer system. The administrator must refer to the operation history of the file to prevent unauthorized file access by employees, and must detect and prevent signs of the unauthorized activity.

Here, the following operations are examples of operations on the files from which the operation history information is collected by the client computers 82a and 82b.
1. 1. Copy files including directories 2. Move files including directories Change file name 4. Create or delete a file File open / close processing (open / write file, etc.)
6). File conversion processing (encryption, etc.)
7). Copy / move (take out) to an external storage medium (USB memory, etc.)
8). Copy / move (carry-in) from external storage media (USB memory, etc.)
9. Operation by bringing a file into an external storage medium (USB memory, etc.) Note that, for example, Patent Document 1 also shows a similar technique.
Patent Publication 2005-44226

  However, in the conventional operation history management system shown in FIG. 8, since operation history information is stored in the operation history DB 805 in the form of a list, it is easy to perform a list operation performed on a certain file. Can't figure out. That is, although the search in the operation order is easy, it is not yet organized by file, and it is difficult to search by file and display the search result.

  Specifically, by designating a condition for “file name” from the operation history DB 805, it is possible to display and grasp an operation history performed on the file of “file name”. However, when the file name is changed or the file operation is performed after being copied as a separate file, the above search conditions do not meet. For this reason, an administrator who uses the conventional operation history management system shown in FIG. 8 must perform a search including the change history of those file names, and the actual search work involves a heavy burden.

  In order to solve such problems and grasp the history of file operations, there is a system that has a file operation trace function and manages operation history information. In this file operation trace function, a list of operation history flows such as copy / rename / take-out operations from a specific file is converted into a tree structure (hereinafter referred to as “operation history tree”) and displayed. The “operation history tree” may be referred to as a “file operation tree (FIG. 4)” in the same meaning.

  By converting the information in the list format related to the file operation into the operation history tree format, it becomes easy to trace and grasp (hereinafter, also simply referred to as “trace”) the list of the flow of the file operation. However, when the file operation trace function of converting such a file operation list into a tree structure and displaying it is employed in the current product, the following drawbacks have been confirmed.

1. If there is a huge amount of file operation history (information) starting from a certain file (operation source file), it takes a lot of time to construct an operation history tree from the set of file operation histories and display them. Will be spent.

2. Similarly, when a tree with a large number of nodes (sections) (when many sibling nodes exist in the same hierarchy or when the height of the tree is large) is displayed at a time, the limited display of the administrator computer It is difficult to grasp the entire operation flow only by browsing the contents displayed in the area.

3. In order to display the operation history tree, it is necessary to install dedicated software, which causes an installation load. That is, an operation history tree cannot be displayed on a PC other than a personal computer (hereinafter abbreviated as “PC”) in which the dedicated software is installed. Therefore, the operation of displaying the operation history tree is limited to the installed PC.

4). When displaying the operation history as a tree, the history of a certain file operation is considered as a node (section), and only the previous and subsequent file operation histories are connected by edges (sides) and are adjacent to each other. In addition to the most recent file operation history, it is not possible to view all of the related operation history to be grasped. For example, it is difficult to simultaneously view all operation histories that are separated from a certain file operation by a considerable time. In addition, the collected operation history cannot always be effectively used. In particular, it is difficult to obtain a highly reliable search result when it is necessary to accurately specify the date and time when the problematic file operation was performed.

  In view of the above situation, the present invention enables efficient search and display of search results even if there are many operation histories for tracing file operations, and makes it easy for an administrator to use a file by an employee. The object is to provide an operation history management system that can be grasped.

  In order to solve the above-mentioned problem, the invention according to claim 1 is an operation history management system capable of file operation tracing in which an administrator tracks and searches an operation history of a managed person for a file on a computer system, A client computer used by the managed person, a server computer that collects operation history information related to an operation performed by the managed person on the client computer, stores it in an operation history database, and manages it in a searchable manner; and the server computer In an operation history management system comprising: an administrator computer capable of browsing the operation history information managed by the administrator; the client computer includes an operation history information acquisition unit that acquires the operation history information; The server records the operation history information acquired by the operation history information acquisition unit. An operation history information transmitting unit for transmitting to a computer, and the server computer receives the operation history information acquired by the client computer that can exist in plural and stores the operation history information in an operation history database; A DB update unit that stores the operation history information in the operation history database to enable centralized management, a search processing unit that searches for the operation history information that conforms to the request for the file operation trace, and receives the request A search processing transmission / reception unit that transmits a search result of the search processing unit in response to the request, wherein the administrator computer transmits the request of an arbitrarily specified condition to the server computer that manages the operation history information And a search information transmission / reception unit for receiving the search result in response to the request. It is a system.

  According to the invention of claim 1, operation history information related to operations performed on a client computer used by a managed person is collected by a server computer, stored in an operation history database, and managed in a freely searchable manner. The administrator can view the operation history information managed by the server computer using the administrator computer.

  According to a second aspect of the present invention, the administrator computer includes an operation history tree display unit that displays the operation history in a tree structure, and an operation history that is displayed on the administrator computer by the operation history tree display unit. Sequential search processing means capable of displaying a new operation history tree by communicating and searching only the difference between information and operation history information in response to interactive and sequential requests from the administrator. The operation history management system according to claim 1, further comprising:

  According to the second aspect of the invention, only the difference between the operation history information being displayed on the administrator computer and the operation history information in response to an interactive and sequential request from the administrator is communicated to the server computer. And a new operation history tree can be displayed by searching.

  As an effect, the operation history database stores operation histories in a list format. The trace processing request processing unit receives the trace processing transmitted interactively and sequentially from the administrator computer, searches the operation history database each time, and transmits the search result as a response. The administrator computer receives the search result, and the operation history tree processing unit updates only the difference of the operation history tree using the operation history tree displayed in the operation history tree display unit and the received search result. indicate.

  That is, since only the difference between the operation history information being displayed and the new operation history information is processed, the processing load is small and a quick response is possible.

  In the invention according to claim 3, the operation history tree display unit displays the operation history in a path so that the operation history can be listed along the operation flow up to the operation history designated by the administrator. 3. The operation history management system according to claim 2, wherein a series of operations from the first root node to the last root node are displayed when the administrator selects the last operation history node. 4.

  According to the third aspect of the present invention, an operation history is displayed on the operation history tree display unit as a path so that operations from the first root node to the last root node are displayed in series by the operation of the administrator. Then, it is possible to grasp the list along the operation flow designated by the administrator.

  This operation history path display function makes it possible to display a huge operation history tree that cannot be displayed entirely in the operation history list display area (when there are a large number of sibling nodes, descendant nodes, and ancestor nodes in the tree). Even if is constructed and displayed, the manager can instantaneously and clearly discriminate the flow of the operation history by the path display excellent in visibility.

  The invention according to claim 4 is the operation history management system according to claim 3, wherein the path display can be displayed in different colors so as to emphasize the operation history node group and / or the side.

  According to the invention which concerns on Claim 4, it is excellent in the instant list grasping property, and is clearer.

  The invention according to claim 5 is the operation history management system according to any one of claims 1 to 4, further comprising a Web server and / or a Web browser.

  According to the fifth aspect of the present invention, the input unit and the display / search information transmitting / receiving unit of the administrator computer can also be handled by the Internet connection function of a normal Web browser. Therefore, it is not necessary to add information connection and information browsing functions to the administrator computer other than the existing Web browser.

  The invention according to claim 6 is the operation in which file information is moved between the external storage medium and the connected computer when the external storage medium connected to the computer has an operation history acquisition function. 6. The operation history management system according to claim 1, wherein file operation tracing is performed using history information.

  According to the invention of claim 6, if the file information is moved between the external storage medium connected to the computer by the operation history acquisition function of the external storage medium connected to the operating computer, It is possible to trace file operations using the operation history information.

  According to the present invention, a flow of a series of file operations performed on a client computer can be displayed in a tree structure. Further, the operation history tree displayed on the administrator computer can be clearly displayed by the operation of the administrator up to the operation history following the displayed operation history or the related operation history. In particular, even if there are many operation histories to trace file operations, the search is efficiently performed and the display of the search results is clear and easy to understand, and the administrator can easily understand the status of employees using the files. it can. Therefore, it is extremely effective for security management in a computer system. More specific and detailed effects are as follows.

1. Even when there is a large amount of file operation history starting from the operation source file, the operation history tree can be constructed and displayed in a short time.

2. Even when a tree having an enormous number of nodes (sections) is displayed at a time, it is possible to easily grasp the flow of operations simply by browsing the display section with a limited display area of the administrator computer.

3. No dedicated software is required to display the operation history tree. Therefore, the operation history tree can be displayed using any arbitrary work PC without being restricted by whether or not dedicated software is provided.

4). It is possible to accurately specify the date and time when the desired file operation was performed.
5. Useless information processing is eliminated and user convenience is improved. For example, since limited computer resources can be used effectively, it becomes difficult for the PC to freeze.
6). An application for tracing file operations using the operation history information by the operation history acquisition function of the external storage medium is also possible.

  FIG. 1 is a block diagram showing an operation history management system (hereinafter referred to as “the present system”) according to an embodiment of the present invention (hereinafter referred to as “the present embodiment”). The system includes a server computer 10 that manages operation history, an administrator computer 11 that refers to the operation history stored in the server computer 10, and a client computer 12a that is mainly used by general employees. 12b and 12c, and an external storage medium 14 that can be used by connecting to these computers.

  The computers 10, 11, 12 a and 12 b including the server computer and the client computer are connected to each other by a network 13. The client computers 12a and 12b connected to the server computer 10 via the network 13 periodically acquire the operation history information acquisition units 122a and 122b that acquire operation information performed by the respective users, and the acquired operation history information periodically. The operation history information transmitting units 121a and 121b are configured to transmit to.

  The external storage medium 14 that can be connected to the client computers 12a, 12b, and 12c includes an operation history information acquisition unit 141 that records a user's operation on an electronic file stored therein as history information. The operation history acquired by the operation history information acquisition unit 141 is temporarily stored in the external storage medium 14, and then connected to the client computers 12a and 12b including the operation history information transmission units 121a and 121b. Are transmitted to the server computer 10. For example, the external storage medium 14 corresponds to a USB memory with an access control function.

  The operation history information can be acquired by the operation history acquisition units 122a and 122b of the client computers 12a and 12b or the operation history acquisition unit 141 of the external storage medium 14. As the operation history information, in addition to the computer name and IP address, operation date and time, login account name, and information for identifying the operated user, the medium identification ID when the external storage medium 14 is used, regarding the client computers 12a and 12b. Etc. can be included.

  The administrator computer 11 connected to the server computer 10 via the network 13 includes an operation history list display unit 111 that displays a list of operation history information received from the server computer 10 and the received operation history information in a tree structure. An operation history tree display unit 112 to be displayed, an operation history tree processing unit 113 that performs processing such as construction of the tree, an input unit 114 that receives operations from an administrator who operates an administrator computer, and a server computer 10 includes a display / search information transmission / reception unit 115 that performs communication with the network 10.

  The server computer 10 includes an operation history information receiving unit 105 that receives operation history information transmitted by the client computers 12a and 12b, and a DB update unit 104 that stores and manages the received operation history information in an operation history DB (operation history database) 106. The search request from the administrator computer 11, the trace request processing unit 102 for processing the trace request, the search processing transmission / reception unit 101 for transmitting the search result, and the DB according to the contents of the received search request. It is comprised from the search process part 103 which searches.

  In the system configured as shown in FIG. 1, operation history information indicating operations performed on the client computers 12 a and 12 b is transmitted to the server computer and stored and managed in the operation history DB 106. The administrator can view the operation history information stored in the server computer 10 from the administrator computer 11.

  FIG. 2 is a conceptual diagram of operation history storage in the operation history DB. The operation history DB 106 (FIG. 1) stores operation history information collected from the client computers 12a and 12b in a list form as shown in FIG. In FIG. 2, as an example of storing operation history information, the date and time 201, the user name 202, the computer name 203, the operation 204, the pre-operation file name 205, and the post-operation file name 206 when the operation history is acquired on the client computers 12a and 12b. Other information 207 is stored.

  Here, returning to FIG. 1, the description will be continued. In the operation history list display unit 111, as a result of the operation using the input unit 114, operation histories that match the search conditions in the data in the operation history DB 106 are displayed in a list format.

  In the operation history tree display unit 112, an operation history adapted to the file trace operation in the data in the operation history DB 106 is processed by the operation history tree processing unit 113 as a result of the operation performed using the input unit 114. After that, it is displayed in a tree format. The “tree” here is defined to indicate a graph connected without including a cycle. “Node” is a node in the tree, “Edge” is an edge in the tree, and “Root node” in the file operation tree is the node displayed at the top when the file operation history tree is displayed. And

FIG. 3 is an explanatory diagram showing a simplified display of file operation history groups on the operation history tree display section.
(A) An example of copying files mainly,
(B) An example of changing the file name mainly,
(C) This is an example in which files are mainly viewed and corrected.

  FIG. 3 simply shows a case where all the file operation histories shown in FIG. 2 are displayed in a tree form. Each operation history in FIG. 2 is obtained from three tree structures (FIGS. 3a, 3b, and 3c). It can be seen that it is displayed as a composed forest.

  For example, in FIG. 3B, first, a file name “text2.doc” is newly created (309 node), the name is changed to the file name “text20.doc” (310 node), and “text21.doc” is changed to “text21.doc”. A flow of a series of file operations of copied (311 nodes) is shown. The operation histories correspond to the second, sixth, and seventh lines in FIG.

  In the example of FIG. 3C, after the file name “text3.doc” is newly created (312 nodes), the file is opened (313 nodes), written (314 nodes), closed (315 nodes), etc. After the access operation, the external storage medium 14 is taken out (316 node), and the external storage medium 14 is opened (317 nodes), written (318 nodes), closed (319 nodes), etc. It can be seen that after the operation is performed, a carry-in operation (320 nodes) to the original computer is performed. The operation histories correspond to the fourth line and the 13th to 20th lines in FIG.

  In FIG. 3, as described above, the tree structure is simplified and displayed as an easy-to-view tree structure that allows easy understanding. That is, the operation history tree display in FIGS. 3A and 3B is an example in which only the file operation history is displayed. The operation history tree in FIG. 3C is an example in which a file operation history and an access history are displayed.

  The administrator operates the input unit 114 interactively while browsing the list of file operation history shown in FIG. 2 and the tree structure in which the operation history tree shown in FIG. For the file operation history that is being displayed, follow-up search (trace) of the subsequent operation (hereinafter referred to as “forward trace”), or operation that traces (traces) the previous operation (hereinafter referred to as “trace”) , “Backtrace”).

  The file operation trace according to the present invention includes two types (FIG. 5) of “forward trace processing” and “back trace processing”. Software that constitutes a sequential search processing means in which an administrator monitors and checks these processing results with the administrator computer 11 while interactively means means a “sequential search processing means” according to claim 2. To do. Details will be described later with reference to FIGS.

  FIG. 4 is a flowchart showing an operation procedure for tracing a file operation history by this system. Hereinafter, the operation procedure will be described with reference to FIG. 4 while also referring to FIG. The administrator uses the administrator computer 11 and operates the operation history list display unit 111 and the input unit 114 to perform a normal search on the condition of “file name” or the like.

  From the search result list, an operation history as a starting point of “file operation trace” is specified (process 401), and a file operation tree is displayed by the operation history tree display unit 112 (process 402). Hereinafter, the term “processing” will be omitted as appropriate. In FIG. 4, “file operation tree” is shown in the same meaning as “operation history tree”, but it is clearly indicated that the name is also included in the technical idea of the present invention.

  From the operation history nodes in the file operation tree indicating the operation history displayed by the operation history tree display unit 112, an operation history node targeted for file operation tracing is selected (403). Next, either forward trace or back trace is selected as the file operation trace type (404), and the operation history tree processing unit 113 is instructed to start file operation trace processing (405).

  By browsing the operation history group reconstructed and displayed in the operation history tree display unit 112 as a result of the trace processing, the file operations and operation flows performed on the client computers 12a and 12b are traced. Thereafter, when the trace operation is further performed, the process returns to the trace target selection process (403) and the trace operation is continued. The processing performed by the operation history tree processing unit 113 in the file operation trace processing (405) is classified according to the type of file operation trace selected by the administrator in (Process 404).

FIG. 5 is a flowchart showing the trace processing procedure of the file operation history in the administrator computer, which is (a) forward trace processing and (b) back trace processing.
In the case of the forward trace processing shown in FIG. 5A, information on the operation history node to be traced selected (403) by the user (administrator) is acquired (501), and the trace request is displayed / searched information transmitting / receiving unit 115 Is transmitted to the server computer 10 via (step 502).

  Thereafter, a response from the server computer 10 is received (503), and the received data of the operation history node is inserted and displayed as a child node of the operation history node selected in (Process 403) shown in FIG. 4 (504). . As an example of the forward trace process, if the administrator designates the operation history node 303 and executes the forward trace at the stage where the child node of the operation history node 303 shown in FIG. The operation history node 305 is displayed as a child node of the operation history node 303.

  In the case of the back trace process shown in FIG. 5B, unlike the case of the forward trace, the root node (root; the node displayed at the top) of the operation history tree displayed by the operation history tree display unit 112 is displayed. Acquire (511), and send a trace request from the administrator to the server computer 10 via the display / search information transmitting / receiving unit 115 (512).

  After receiving a response to the trace request from the server computer 10 (513), the operation history information in the received data is further regarded as the selected operation history node, and forward trace processing is performed (514). Thereafter, the received data acquired in (Processes 513 and 514) is combined, inserted and processed (added to the tree), and the root node in the operation history tree is replaced and displayed (515).

  As an example of the backtrace process, when the operation history node 303 in FIG. 3A is the root node of the operation history tree displayed by the operation history tree display unit 112, when the administrator executes the backtrace, the result As a result, operation history nodes 301, 302, and 303 are newly acquired.

  The operation history tree processing unit 113 newly sets an operation history node 301 as a root node and a child node of the node 301 from the newly acquired operation history node and the operation history tree currently displayed with the node 303 as a root node. As a result, an operation history tree having nodes 302, 303, and 304 is constructed, and the operation history tree is displayed. In this case, the operation history node displayed as a child node of the 303 node before the trace operation is displayed as a child node of the 303 node as it is after the backtrace.

  By performing such processing, the operation history information displayed on the administrator computer 11 is utilized, and a new operation history tree is obtained by information retrieval / information communication only with a difference from the displayed operation history tree. Can be displayed.

  Further, when the operation history tree is initially displayed, not all nodes are arranged and displayed. That is, an administrator executes an interactive and sequential processing method while performing monitor check using the administrator computer 11. By doing so, useless information processing for searching and / or displaying the operation history that is not originally required by the administrator is eliminated, so that the usability of the user is improved. For example, since limited computer resources can be used effectively, an effect of making the PC difficult to freeze can be obtained.

  Further, the display means of the operation history list display unit 111 and the operation history tree display unit 112 can be expressed by HTML rendering processing, and the tree construction processing of the operation history tree processing unit 113 is realized by a client side script such as javascript. Is possible.

  Further, the other input unit 114 and the display / search information transmission / reception unit 115 can be supported by the Internet connection function of a normal Web browser. Therefore, it is not necessary to add an information connection and information browsing function to the administrator computer other than the Web browser initially introduced in many current computer systems.

  FIG. 6 is a flowchart showing a response processing procedure to the trace request for the file operation history in the server computer. As shown in FIG. 6, in the server computer 10, the search processing transmission / reception unit 101 receives the trace request transmitted from the administrator computer 11 (601), and the trace request processing unit 102 performs corresponding processing (602, 603, 604). The result is transmitted as a response to the request to the administrator computer via the search processing transmission / reception unit (101) (605).

  The processing of the trace request processing unit 102 is divided depending on the type of received trace request (602). The process (603) when the forward trace is specified is as follows. Based on the “file name after operation” information in the operation history (403) designated by the administrator, for example, the following search condition is generated.

The trace request processing unit 102 executes search processing via the search processing unit 103. The search conditions at that time are as follows.
1. The client computer information such as the computer name in the operation history must match.
2. The date and time information in the operation history is later than the specified operation history.
3. A file name with the same name as the “file name after operation” in the operation history must exist in the “file name before operation”.

  Further, the processing (604) when the back trace is designated is as follows. For example, the following conditions are generated based on the “file name after operation” information in the operation history node that is the root in the operation history tree displayed in the operation history tree display unit 112.

1. The client computer information such as the computer name in the operation history is the same.
2. The date and time information in the operation history is before the specified operation history and is the newest history.
3. A file name with the same name as the “file name before operation” in the operation history exists in “file name after operation”.

  The trace request processing unit 102 executes search processing via the search processing unit 103 based on these search conditions. However, in the case of backtrace, unlike the case of forward trace, the matching file operation history is unique.

  Here, the processing performed by the trace request processing unit 102 in the server computer 10 in response to the trace request from the administrator computer 11 is the corresponding operation history designated by the user (administrator) on the administrator computer 11. Is a single process that generates a search condition sentence (search expression), performs a search, and transmits a search result after shaping.

  Similarly, the process performed by the administrator computer 11 is only a process of transmitting a trace request to the server computer 10, merging (joining) the received result with the currently displayed tree, and reflecting the result on the display.

  When a file operation history is displayed as a tree in the operation history tree display unit 112 using the administrator computer 11, an operation history is selected by selecting a node in the operation history tree using the input unit 114. The tree processing unit 113 can display “operation history path” in the operation history list display unit 111.

  In the operation history path display, the operations performed from the operation indicated by the root node of the operation history tree currently displayed in the operation history tree display unit 111 to the operation indicated by the operation history selected by the input unit 114 are displayed. Displays a series of flows in a tree structure.

  FIG. 7 is a display example relating to the operation history, (a) an operation history path display example on the operation history tree display unit, and (b) a display example on the operation history list display unit. For example, when the operation history node 702 in the operation history tree shown in FIG. 7A is selected and “operation history path display” is performed, the operations performed from the root node 701 to the root node 702 are performed. A list is displayed as shown in FIG.

  At this time, the operation history tree group 703 and sides can also be clearly displayed in different colors so that the file operation can be visually recognized and recognized instantaneously.

  This operation history path display function makes it possible to display a huge operation history tree that cannot be displayed entirely in the operation history list display area (when there are a large number of sibling nodes, descendant nodes, and ancestor nodes in the tree). Even if is constructed and displayed, the administrator can visually determine the flow of the operation history by using the path display of the operation history.

  Further, the process required for displaying the path of the operation history is equivalent to the process of tracing the tree from the selected node (node) to the root (root node). Generally, the calculation amount 0 ( log (n)) and can be processed at higher speed.

  Furthermore, since this process can be performed using only the stored information when displaying the operation history tree on the administrator computer 11 side, communication with the server computer 10 is not necessarily required. .

  In addition, the operation history tree display unit 112 and the operation history list display unit 111 are subjected to image conversion processing that is reflected on an icon or the like according to the type of operation (for example, a red warning image that strongly warns the user about a take-out operation). If done, the effect of instant visual recognition can be further enhanced.

  When the file operation history tree is displayed on the operation history tree display unit 112 using the administrator computer 11, an operation is performed by selecting a node in the operation history tree using the input unit 114. A list of “related operation histories” can also be displayed on the history list display unit 111.

  Further, the definition of “related operation history” can be designated in advance by the administrator using the input unit 114 as a search condition. Examples of designation include “operation history that satisfies the following conditions within one hour before and after the selected operation history”, “operation history of the same user recorded as the selected operation history”, and “selected It is conceivable that a search condition such as “the operation history of the same computer recorded in the operation history” is designated by a search expression or the like.

  As described above, if the administrator designates a search condition and searches for an arbitrary operation history node displayed in the operation history tree display unit 112, a list of "related operation histories" is obtained using the operation history node as a clue. And can be clearly seen. Therefore, the client computer that has performed the operation corresponding to the “related operation history” and the user are identified, and the administrator can understand the situation regarding the use more deeply.

It is a block block diagram which shows this system which concerns on this embodiment. It is a conceptual diagram of operation history storage in the operation history DB. It is explanatory drawing which simplifiedly displayed the file operation history group to the operation history tree display part, (a) The example which copied the file mainly, (b) The example which changed the file name mainly, (c) The file mainly This is an example of browsing and correction. It is a flowchart which shows the operation procedure which traces a file operation history by this system. It is a flowchart which shows the trace processing procedure of the file operation history in the computer for administrators, (a) Forward trace process, (b) Back trace process. It is a flowchart which shows the response process sequence to the trace request of the file operation history in a server computer. It is a display example regarding the operation history, (a) an operation history path display example on the operation history tree display section, and (b) a display example on the operation history list display section. It is a schematic block diagram of the conventional operation history management system.

Explanation of symbols

10 server computer 11 administrator computer 12a, 12b, 12c client computer 13 network 14 external storage medium 106 operation history database

Claims (6)

An operation history management system capable of file operation tracing in which an administrator tracks and searches an operation history of a managed person for a file on a computer system,
A client computer used by the managed person;
A server computer that collects operation history information related to an operation performed by the managed person on the client computer, stores it in an operation history database, and manages it in a searchable manner;
In an operation history management system comprising: an administrator computer capable of browsing the operation history information managed by the server computer by the administrator;
The client computer is
An operation history information acquisition unit for acquiring the operation history information;
An operation history information transmission unit that transmits the operation history information acquired by the operation history information acquisition unit to the server computer,
The server computer
An operation history information receiving unit that receives the operation history information acquired by the client computer that can exist in a plurality and stores it in the operation history database;
A DB update unit that stores the operation history information in the operation history database and enables centralized management;
A search processing unit that searches for the operation history information that matches the request for the file operation trace;
A search processing transmission / reception unit that receives the request and transmits a search result of the search processing unit according to the request,
The administrator computer is
An operation history management system comprising: a search information transmission / reception unit that transmits the request of an arbitrarily specified condition to the server computer that manages the operation history information and receives the search result according to the request. The administrator computer includes
An operation history tree display section for displaying the operation history in a tree structure;
Only the difference between the operation history information being displayed on the administrator computer by the operation history tree display unit and the operation history information in response to interactive and sequential requests from the administrator is communicated to the server computer. The operation history management system according to claim 1, further comprising sequential search processing means capable of displaying a new operation history tree by searching. The operation history tree display unit displays the operation history in a path so that the operation history can be listed along the operation flow up to the operation history designated by the administrator.
3. The operation history management according to claim 2, wherein the path display displays a series of operations from the first root node to the last root node by the administrator selecting the last operation history node. system.   4. The operation history management system according to claim 3, wherein the path display is made possible by color-coded display so as to emphasize an operation history node group and / or a side.   The operation history management system according to claim 1, further comprising a Web server and / or a Web browser. If the external storage medium connected to the computer has an operation history acquisition function,
6. The file operation trace is performed using the operation history information in which file information is moved between the external storage medium and the connected computer. Operation history management system.

Images