JP2008191981A - Network management system and program for it - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To obtain an operation state of a communication terminal and accurately obtain the detail of the operation by displaying a monitor screen of a communication terminal on a monitor of a management server. <P>SOLUTION: This network management system comprises a monitor screen output unit X for acquiring a monitor screen M of a communication terminal B and displaying it on a management monitor 2 on the management server A side, an operation log output unit Y for acquiring an operation log of the communication terminal B and displaying it on the management monitor 2, and an extraction display section U for displaying, on the management monitor 2, the operation log of a processing object when the processing object included in the monitor screen of the communication terminal B displayed on the management monitor 2 is selected with a cursor. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention acquires a monitor screen of a communication terminal connected to a communication network, acquires a monitor screen output unit to be displayed on a management monitor on the management server side of the communication network, and a user operation log in the communication terminal. The present invention relates to a network management system including an operation log output unit to be displayed on a management monitor on the network management server side, and a program therefor.

  As a network management system configured as described above, a remote control server and a client terminal are connected via a communication network, the remote control server accepts access request information from the client terminal, and is displayed on the monitor at the client terminal. The remote control server displays the received image data on the monitor, and the captured image recording means of the remote control server operates the client terminal screen as a captured image at predetermined intervals. There is one recorded in a log, and after this recording, the reproduction means of the remote control server reproduces the captured image recorded in the operation log (for example, see Patent Document 1).

  In this patent document 1, when image data transmitted from a plurality of client terminals is displayed on a monitor of a remote control server, the image data of each screen is reduced so that the plurality of image data can be viewed in a list. The display form is set.

JP-A-2006-108947 (paragraph numbers [0065] to [0077], [0095], [0096], FIGS. 1 to 5)

  In a network such as a LAN built in a limited facility such as a company or school, a large number of communication terminals (client PCs) are connected to the network, and the network is as important as a file server. There are many cases where a server that stores various information is connected. Considering the operation by the user who operates the communication terminal, it is assumed that the knowledge of the network is insufficient, the important file is deleted or the contents of the file are changed due to an erroneous operation caused by carelessness.

  In addition, even within a company, the existence of a person who accesses a file server for the purpose of obtaining highly confidential information cannot be denied. Even if information is shared in the file server, personal information, Management that restricts browsing, copying (copying), printing, and the like has been conventionally performed for highly confidential items such as those that should be kept secret in the past.

  In order to manage operations on the communication terminal connected to the network in this way, for example, inappropriate operation on the communication terminal is performed by using the Administrator account technology in the Windows OS or the root account technology in the UNIX OS. It is also possible to eliminate it. On the other hand, for example, in a network such as an in-house LAN, in order to collect and grasp the work status in each communication terminal or to discover an inappropriate operation in advance, as described in Patent Document 1 There is also a desire to monitor and monitor the communication terminal by displaying the screen of the communication terminal on the server side.

  As a specific management form, it is convenient to display the monitor screen of the client PC in real time, or to record this screen information and display it in a playback form. However, to monitor the operation status by displaying the monitor screen of the client PC on the monitor of the management server, for example, when a plurality of monitor screens are displayed on the monitor of the management server, the individual monitor screens of the client PC are small. There is room for improvement in terms of difficulty in grasping the operation status.

  An object of the present invention is to accurately grasp the status of operation on a communication terminal from the monitor screen of the communication terminal displayed on the monitor on the management server side.

The present invention is characterized in that a monitor screen of a communication terminal connected to a communication network is acquired, a monitor screen output unit to be displayed on a management monitor on the management server side of the communication network, and a user operation log in the communication terminal are acquired. In a network management system comprising an operation log output unit for displaying on a management monitor on the management server side of a communication network,
By comparing the display position of the processing target included in the monitor screen displayed on the management monitor by the monitor screen output unit and the designated position by the pointing device in the management monitor, the display position and the designated position are compared. And a determination unit that determines that the condition matches with the selection of the processing target,
The operation log output unit includes an extraction display unit that extracts and displays an operation log related to a processing target determined to be selected by the determination unit.

  According to this configuration, the monitor screen output unit acquires the monitor screen of the communication terminal and displays it on the management monitor on the management server side. In this display state, the specified position of a pointing device such as a mouse is included in the monitor screen. When the determination unit determines that the target display position matches, the extraction display unit extracts and displays the operation log of the processing target thus designated on the management monitor on the management server side. That is, although icons and holders are displayed on the monitor screen of the desktop of the communication terminal displayed on the management monitor, the icons and holders use the GUI (Graphical User Interface) function on the management server side. It is something that cannot be done. However, according to the present invention, by specifying an icon, a folder, a window being executed, etc. displayed as a processing target on the desktop screen of the monitor screen with a cursor or the like, an operation log that takes advantage of the GUI function can be used. Can be extracted and displayed, and the progress of the operation and details of the operation can be accurately grasped from the contents of the operation log. As a result, the operation status can be accurately grasped from the monitor screen while effectively utilizing the GUI functions.

In the present invention, the monitor screen output unit acquires a monitor screen displayed on the monitor of the communication terminal at every predetermined timing, and attaches terminal identification information for identifying the communication terminal to the acquired monitor screen. A screen acquisition unit;
The monitor screen acquired by this monitor screen acquisition part may be acquired via the said communication network, and you may provide the monitor screen display part displayed based on the said terminal identification information with respect to the said management monitor.

  According to this configuration, the monitor screen displayed on the monitor of the communication terminal is acquired at a predetermined timing by the monitor screen acquisition unit, and terminal identification information for identifying the communication terminal is attached. Next, in the management server, the monitor screen display unit acquires the monitor screen acquired by the monitor screen acquisition unit via the communication network, and displays it on the management monitor based on the terminal identification information.

The present invention comprises a recording means for recording a plurality of the monitor screens acquired over time by the monitor screen acquisition unit,
The monitor screen display unit continuously displays the plurality of monitor screens recorded in the recording unit over time on the management monitor,
The extraction display unit may display an operation log of the selected processing target when the determination unit determines that the processing target included in the monitor screen displayed on the management monitor is selected. .

  According to this configuration, the monitor screen displayed on the monitor of the communication terminal is acquired over time and stored in the storage unit. When the monitor screen displayed in this way is displayed as a moving image on the management monitor by the monitor screen display unit, and the processing target included in the monitor screen displayed on the management monitor is selected, The extraction display means displays the selected operation target operation log, and the user's operation at the timing when the monitor screen is displayed can be easily grasped.

In the present invention, the processing target includes an icon, a folder displayed on the desktop of the monitor screen, a window of an application being executed,
The communication terminal includes a locate information acquisition unit that acquires locate information indicating a display position of the processing target on the desktop,
The determination unit obtains conversion locating information indicating the display position of the processing target on the management monitor by performing coordinate conversion on the locating information based on the display position and display size of the monitor screen on the management monitor. In addition to information conversion means, it may also include position comparison means for comparing a designated position by the pointing device with a position corresponding to the conversion locate information.

  According to this configuration, when the position of the processing target displayed on the desktop of the monitor screen displayed on the communication terminal is acquired by the locate information acquisition unit, and this monitor screen is reduced and displayed on the management monitor, The information conversion means performs coordinate conversion of the locate information based on the display position and display size. Since the position comparison means compares the location information after this coordinate conversion and the specified position by the pointing device, when the processing target in the monitor screen is specified by the pointing device, regardless of the display size or display position of the monitor screen Realizes the process of displaying the operation log.

In the present invention, the operation log output unit acquires the operation log to which the processing identification information for identifying the processing target is attached in the communication terminal, and transmits the operation log to the management server via the communication network. An operation log display unit that receives an operation log from the communication terminal in the management server and displays the operation log on the management monitor,
The extraction display unit displays only the operation log received by the operation log display unit, to which information for identifying the processing target determined to be in the selected state by the determination unit is displayed. May be.

  According to this configuration, the operation log acquisition unit acquires the operation log with the processing identification information for identifying the processing target, and transmits the operation log to the management server via the communication network. The operation log is displayed in the operation log display unit. Can be received and displayed on the management monitor. In the management server, the extraction display unit can extract the operation log to which the processing identification information corresponding to the processing target determined by the determination unit is added, and display the operation log on the management monitor.

A feature of the present invention is that a monitor screen of a communication terminal connected to a communication network is acquired, a monitor screen output function displayed on a management monitor on the management server side of the communication network, and a user operation log in the communication terminal are acquired. In a network management program for causing a computer to execute an operation log output function to be displayed on a management monitor on the management server side of a communication network,
By comparing the display position of the processing target included in the monitor screen displayed on the management monitor by the monitor screen output function and the designated position by the pointing device in the management monitor, the display position and the designated position are compared. The computer is caused to execute a determination function for determining that the condition matches with the selection of the processing target,
The operation log output function is to cause the computer to execute an extraction display function for extracting and displaying an operation log related to a processing target determined to be selected by the determination function.

  According to this configuration, the monitor screen of the communication terminal is acquired by the monitor screen output function and displayed on the management monitor. In this display state, when it is determined by the determination function that the specified position by the pointing device such as a mouse matches the display position of the operation target included in the monitor screen, the processing target specified in this way The operation log is extracted by the extraction display function and displayed on the management monitor. In other words, although icons and holders are displayed on the monitor screen of the communication terminal desktop displayed on the management monitor, these icons and holders have their GUI (Graphical User Interface) functions on the management server side. It cannot be used. However, according to the present invention, when an icon, a folder, a window being executed, or the like displayed as a processing target on the desktop screen of the monitor screen is designated with a cursor or the like, the operation log is operated in an operation form utilizing the GUI function. Is displayed, and the progress of the operation and the details of the operation can be accurately grasped from the contents of the operation log. As a result, the operation status can be accurately grasped from the monitor screen of the client PC while effectively utilizing the GUI function on the management server side.

A feature of the present invention is that a monitor screen output unit for acquiring a monitor screen of a communication terminal connected to a communication network and displaying it on a management monitor and a user operation log in the communication terminal are acquired and displayed on the management monitor In a network management server equipped with an operation log output unit
By comparing the display position of the processing target included in the monitor screen displayed on the management monitor by the monitor screen output unit and the designated position by the pointing device in the management monitor, the display position and the designated position are compared. And a determination unit that determines that the condition matches with the selection of the processing target,
The operation log output unit includes an extraction display unit that extracts and displays an operation log related to a processing target determined to be selected by the determination unit.

  According to this configuration, the monitor screen output unit acquires the monitor screen of the communication terminal and displays it on the management monitor. In this display state, the specified position of the pointing device such as a mouse is the display position of the processing target included in the monitor screen. When the determination unit determines that the information matches, the extraction display unit extracts the operation log to be processed thus designated on the management monitor and displays it. That is, although icons and holders are displayed on the monitor screen of the communication terminal desktop displayed on the management monitor, these icons and holders cannot use the GUI (Graphical User Interface) function. is there. However, according to the present invention, by specifying an icon, a folder, a window being executed, etc. displayed as a processing target on the desktop screen of the monitor screen with a cursor or the like, an operation log that takes advantage of the GUI function can be used. Can be extracted and displayed, and the progress of the operation and details of the operation can be accurately grasped from the contents of the operation log. As a result, the operation status can be accurately grasped from the monitor screen while effectively utilizing the GUI functions.

A feature of the present invention is an operation log output program for causing a computer to execute an operation log output function for displaying a user operation log on a terminal on a management monitor.
The operation log output function is an operation log related to a selected processing target when a processing target displayed on the management monitor is selected in a situation where a monitor screen of the terminal is displayed on the management monitor. The extraction display function for extracting and displaying on the management monitor is executed by the computer.

  According to this configuration, in a situation where the monitor screen of the terminal is displayed on the management monitor, for example, when an icon or a folder is selected as a processing target displayed on the monitor screen, an operation that has already been acquired Among the logs, the extraction display function extracts an operation log related to the selected processing target and displays it on the management monitor. As a result, the operation log corresponding to the processing target displayed on the management monitor is extracted and displayed so that the status of the terminal operation can be accurately grasped.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
〔System configuration〕
As shown in FIGS. 1 to 3, a management server A that is a computer for a communication network constructed by a communication path L, a plurality of communication terminals B (client PCs) that are computers, a file server C, and a printer D And the communication network is connected to the Internet N via the gateway server E or the like.

  The management server A and a plurality of communication terminals B connected by the communication network constitute a network management system of the present invention.

  The communication path L is constructed as a LAN (Local Area Network) using technology such as Ethernet in a limited facility such as a company or a school, and a cable La for physically transmitting a signal, and the cable La And a repeater Lb composed of a LAN switch, a hub or the like that relays the signal to the target communication terminal B, management server A, or the like based on the information of the signal sent in the network. In this embodiment, the communication network is limited to the LAN. However, the communication network may include a WAN (Wide Area Network) or the Internet. To construct the LAN described above, a token ring (Token Ring) may be used. Alternatively, a technique such as CDDI (Copper Distributed Data Interface) may be used.

  The management server A includes a computer main body 1, a management monitor 2, a keyboard 3 and a mouse 4. The communication terminal B is constituted by a laptop or notebook personal computer in which a keyboard 6, a track pad 7 and a monitor 8 are integrally formed on a computer main body 5. Similar to the management server A, the communication terminal B may be a computer having a computer main body, a monitor, a keyboard, and the like.

  In the management server A, the cursor key of the keyboard 3 and the mouse 4 function as a pointing device. Similarly, the cursor key of the keyboard 6 of the communication terminal B and the track pad 7 function as a pointing device. However, the pointing device is not limited to these, such as using a trackball as the pointing device, or forming a touch panel on the display surface of the management monitors 2 and 8 and using the touch panel.

  The file server C incorporates a storage medium such as a large-capacity hard disk or is connected to the outside, and stores data to be shared on the communication network. The printer D is composed of a laser printer or an inkjet printer, and prints out information sent from the communication terminal B or the like.

  The network management system of the present invention acquires screen information (hereinafter referred to as monitor screen M) displayed on the monitors 8 of a plurality of communication terminals B connected to the communication network, and transmits them to the management server A via the communication network. The monitor screen output unit X (an example of the monitor screen output function) to be displayed on the management monitor 2 on the management server A side and user operation logs in the plurality of communication terminals B are acquired, and the management server is obtained via the communication network. And an operation log output unit Y (an example of an operation log output function) that is transmitted to A and displayed on the monitor 8 of the management server A, and is further displayed on the management monitor 2 on the management server A side by the monitor screen output unit X. The processing target included in the monitor screen M (see FIGS. 14 and 15) is designated by the cursor, and the determination unit S (determination unit) If the example of) is determined includes an extraction display unit U to be displayed on the management monitor 2 of the management server A extracts the operation log associated with processing object (an example of the extraction display function).

[Management server]
As shown in FIG. 3, the management server A includes a video output unit 11 that outputs information to the management monitor 2 and an input interface 12 that receives information from the keyboard 3 and mouse 4. And the semiconductor memory 13, the operating system 14, the PC information acquisition unit 15, the remote control unit 16, the alert output unit 17, the monitor screen display unit P, and the screen recording unit. Q, a locate information setting unit R, a determination unit S, an operation log display unit T, an extraction display unit U, a hard disk HD (an example of a recording unit), and a communication interface W are connected.

  Although the hard disk HD built in the management server A is taken as an example of the storage means, the hard disk HD connected to the outside of the management server A may be used as the storage means, and the management server A and the communication network may be used. And a data server having a large capacity hard disk HD built in.

  The semiconductor memory 13 is composed of a semiconductor element such as a RAM type or an EEPROM type. The operating system 14 manages the semiconductor memory 13 and develops software necessary for control in the semiconductor memory 13 (RAM) to execute the software. Further, the keyboard 3 and the mouse 4 functions as an interface that obtains the operation information 4 and gives it to the process being executed.

  The PC information acquisition unit 15, the remote control unit 16, the alert output unit 17, the monitor screen display unit P, the screen recording unit Q, the locate information setting unit R, the determination unit S, the operation log display unit T, and the extraction display unit U are A process of displaying operation statuses of the plurality of communication terminals B connected to the communication network on the management monitor 2 is realized.

  These PC information acquisition unit 15, remote control unit 16, alert output unit 17, monitor screen display unit P, screen recording unit Q, locate information setting unit R, determination unit S, operation log display unit T, and extraction display unit U are software. Although it is configured by hardware (program), it may be configured by hardware instead of software, or by combination with hardware.

  The PC information acquisition unit 15 not only acquires the name of the person (user) who operates the communication terminal B (hereinafter referred to as a user name) and the terminal name, but also assigns a MAC address unique to the communication terminal B. A process of acquiring physical data such as the IP address, computer CPU clock value, memory capacity, installed application name, registry data, etc. via the communication network is executed. The communication terminal B is configured to log in when the user inputs an ID, a password, or the like at the time of activation, and the PC information acquisition unit 15 specifies the user name from the password.

  The remote control unit 16 implements control from the management server A via the communication network such as log ON / OFF, power ON / OFF, and message display in the communication terminal B. The alert output unit 17 outputs alert information to the management monitor 2 when it is determined that an operation such as connection to a specified information file, execution of a specified application, registry change, application installation, or hardware addition has occurred. I do.

  The monitor screen display unit P displays the monitor screen M displayed on the monitors 8 of the plurality of communication terminals B on the management screen of the management server A as shown in FIG. 11, and the playback screen shown in FIG. On the other hand, the process which displays the monitor screen M along time progress similarly to a moving image is implement | achieved. The screen recording unit Q realizes a process of recording the monitor screen M displayed on the monitors 8 of the plurality of communication terminals B on the hard disk HD over time. The locate information setting unit R acquires the target location information displayed on the monitor screen M.

  The determination unit S selects a GUI expression using a cursor CU (see FIGS. 14 and 15) for a processing target such as an icon, a folder, or a window of an application being processed displayed on the desktop of the monitor screen M. Judged as non-selected. The operation log display unit T displays an operation log indicating the start / stop status of the monitors 8 of the plurality of communication terminals B, application execution, information file operation, print output, e-mail transmission, connection to the Internet, and the like. The management server A realizes processing to be displayed on the log display screen. The extraction display unit U performs a process of extracting an operation log corresponding to the processing target selected by the determination unit S and displaying the operation log on the management monitor 2.

  Since the processing by the monitor screen display unit P, screen recording unit Q, locate information setting unit R, determination unit S, operation log display unit T, and extraction display unit U is closely related to the processing in the communication terminal B, communication This will be described later together with the processing in terminal B.

[Communication terminal]
As shown in FIG. 3, in the communication terminal B, a video output unit 21 for outputting information to the monitor 8 and an input interface 22 for inputting information from the keyboard 6 and the track pad 7 include a data bus of the CPU. And the semiconductor memory 23, the operating system 24, a plurality of applications AP, a monitor screen acquisition unit F, an operation log acquisition unit G, a locate information acquisition unit H, and a hard disk. The HD and the communication interface W are connected.

  Similar to the management server A, the semiconductor memory 23 is constituted by a semiconductor element such as a RAM type or an EEPROM type. In addition, the operating system 24 manages the semiconductor memory 23 and develops software such as an application AP in the semiconductor memory 23 (RAM) to execute the software. The interface that obtains operation information of the pad 7 and gives it to the processing being executed and the application AP are a plurality of word processors, spreadsheet software, and drawing software such as CAD that are executed in the communication terminal B. Means an application.

  These monitor screen acquisition unit F, operation log acquisition unit G, and locate information acquisition unit H are assumed to be software, but may be configured by hardware or combined with hardware. .

  The monitor screen acquisition unit F acquires information on the screen displayed on the monitor 8 of the communication terminal B as a monitor screen M over time, compresses the information, and identifies the communication terminal B. A process of transmitting information to the management server A is performed. The operation log acquisition unit G includes execution (operation) of the communication terminal B, application execution, file operation, access to a share holder, output to a printer, connection to the Internet, mail transmission, use of an external storage medium, etc. A process of acquiring a log as an operation log and transmitting it to the management server A is performed. The locate information acquisition unit H acquires the display positions of icons, folders, windows of applications being executed, etc. displayed on the desktop of the monitor 8 (monitor screen M) of the communication terminal B, The terminal identification information to be identified is attached and transmitted to the management server A.

  These processes by the monitor screen acquisition unit F, operation log acquisition unit G, and locate information acquisition unit H are closely related to the processes in the management server A, and will be described later together with the processes in the management server A.

  In particular, the monitor screen output unit X is configured by the monitor screen acquisition unit F and the monitor screen display unit P, and the operation is acquired by the operation log acquisition unit G, the operation log display unit T, and the extraction display unit U. A log output unit Y is configured.

[Details of communication terminal configuration]
<Monitor screen acquisition unit F>
The monitor screen acquisition unit F and the locate information acquisition unit H are configured as shown in FIG. That is, the monitor screen acquisition unit F includes a first timing setting unit 31 that sets an acquisition timing of the monitor screen M based on timing information, event information, and the like, and an image displayed on the monitor 8 of the communication terminal B as a video output unit. 21, the screen capture 32 acquired from the screen 21, the compression processing means 33 that compresses the monitor screen M acquired by the screen capture 32, the date and time information of the acquisition date and time and the communication terminal B for the compressed monitor screen M First information providing means 34 for providing identification information, and first transmission means 35 for sending the monitor screen M to which information is provided in this way to the communication network are provided.

  The timing information is information that is output at each preset timing based on the clock provided in the communication terminal B. By setting the timing interval short, the monitor screen M is continuously displayed in the same manner as a moving image. Can be obtained. The event information is output to determine the operation of opening a folder, accessing a file, executing an application, etc. in the communication terminal B, and acquiring the monitor screen M based on the determination of the operation. Refers to information.

  The screen capture 32 executes processing for acquiring information on the entire screen (entire desktop surface) of the monitor 8 as the monitor screen M at each timing set by the first timing setting means 31. The monitor screen M includes gradation information indicating the densities of the three primary colors R (red), G (green), and B (blue) for each pixel constituting the monitor screen M.

  The compression processing means 33 is a process for compressing the monitor screen M in order to reduce the information amount of the monitor screen M acquired by the screen capture 32. Specifically, a process of reducing the amount of information by processing such as dividing the image of the monitor screen M and quantizing based on discrete cosine transform, such as the JPEG format (a format established by the Joint Photographic Experts Group) Point to. The processing for reducing the information amount is not limited to the JPEG format, but may be a GIF (Graphics Interchange Format) format, a PNG (Portable Network Graphics) format, or the like.

  The first information providing means 34 is unique information given in advance to the communication terminal B as date and time information of the acquisition date and time acquired from the calendar unit or the like of the communication terminal B and terminal identification information for specifying the communication terminal B. And the name of the user who operates this communication terminal B is acquired, and these are written in the header of the file on the monitor screen M. The first transmission means 35 performs processing to generate a packet from the monitor screen M passed from the compression processing means 33, the IP address of the management server A, the protocol, and the like and send it to the communication network.

<Locate information acquisition unit H>
The locate information acquisition unit H is a second timing setting means 41 for setting the acquisition timing of locate information based on the timing information, event information, etc., and a locate for acquiring the target location information displayed on the monitor 8 The information acquisition means 42, the locate information table 43 that stores the locate information acquired by the locate information acquisition means 42, the date and time information of the acquisition date and time, and the terminal identification information that identifies the communication terminal B are assigned to the locate information. Second information adding means 44 and second transmitting means 45 for sending the locate information to which information has been assigned in this way to the communication network are provided. The locate information acquisition unit H acquires all the processing target locate information displayed on the monitor 8 without associating it with the operation log, and generates (updates) the locate information table 43. This locate information May be set so as to be associated with the operation log acquired by the operation log acquisition unit G. As described above, in the processing mode for associating with the operation log, it is not necessary to store all the processing target locate information, and the processing for acquiring only the operated processing target locate information is realized.

  Since the timing information, event information, and the like given to the second timing setting means 41 are the same as those given to the first timing setting means 31, the timing at which the locate information obtaining unit H obtains the locate information is Synchronizes with the monitor screen acquisition unit F.

  The locate information acquisition means 42 stores locate information indicating the display position of a processing target such as an icon, a folder, a window of an application being executed, or the like displayed on the monitor 8 in the operating system 24. The process of obtaining from the located locate information area is performed. The locate information table 43 stores the acquired locate information as a table.

  The date and time information of the acquisition date and time given to the second information giving means 44 and the terminal identification information for specifying the communication terminal B are the same as those given to the first information giving means 34 described above. It is written in the header of the information file. The second transmitting unit 45 generates a packet based on the locate information delivered from the second information providing unit 44, and performs a process of generating a packet and sending it to the communication network.

  In this processing system, the processing form is set so that the location information and the monitor screen M are processed as different files and sent to the communication network. The location information and the monitor screen M are set as one file. In this way, the processing form may be set.

<Operation log acquisition unit G>
As shown in FIG. 5, the operation log acquisition unit G includes processing information acquisition means 51 that acquires the event information, processing target information, and active information for determining whether an application is active. The text data converting means 52 for converting the information acquired by the processing information acquiring means 51 into a character string meaning an operation log, and the date and time information of the acquisition date and time for the operation log from the text data converting means 52 A third information providing unit 53 that assigns terminal identification information that identifies the terminal B, and a third transmission unit 54 that sends the operation log to which the information has been assigned to the communication network are provided. The third transmission unit 54 performs a process of generating a packet and sending it to the communication network in the same manner as the first transmission unit 35.

[Details of Management Server configuration]
<Monitor screen display part P>
As shown in FIG. 6, the monitor screen display unit P includes a monitor screen receiving unit 61 that receives a monitor screen M transmitted through the communication network, and a decompression processing unit 62 that decompresses the received monitor screen M in a compressed state. The information access means 63 for recording the monitor screen M from the expansion processing means 62 on the hard disk HD or the semiconductor memory 13, and the monitor screen M recorded on the hard disk HD or the semiconductor memory 13 via the information access means 63. Output control means 64 for controlling the output to the management monitor 2, and output form setting means 65 for setting the output form of the output control means 64.

  The monitor screen receiving unit 61 receives the packet, obtains a monitor screen M in a compressed state, and performs processing to be given to the expansion processing unit 62. The expansion processing means 62 performs a process of expanding the compressed monitor screen M into a bitmap-format monitor screen M and giving it to the information access means 63.

  The information access means 63 shows a specific processing form of the screen recording unit Q, and the information access means 63 outputs the monitor screen M in the bitmap format given from the expansion processing means 62 as output control means. 64, a process for recording the bitmap-format monitor screen M on the hard disk HD or the semiconductor memory 13, and a monitor screen M read from the hard disk HD or the semiconductor memory 13 to the output control means 64. Process to give.

  The output control means 64 performs output (display) to the management monitor 2 based on the display position information set by the output form setting means 65 and the display size information. The output form setting means 65 acquires display position information and display size information that are automatically set when a plurality of monitor screens M are displayed on the management screen 100 as shown in FIG. Arbitrarily set display position information and display size information are acquired and given to the output control means 64. The output form setting means 65 has been set so that the management screen 100 is displayed on the management monitor 2 on the management server A side. Instead of this process, for example, a management terminal connected to the communication network is connected. In the network management system provided, the management screen 100 is displayed on the monitor of the management terminal (an example of a server-side management monitor), and a plurality of monitor screens M are displayed on the management screen 100. May be set.

  In this monitor screen display part P, the monitor screen M before performing the expansion process is recorded in the hard disk HD or the semiconductor memory 13 and the processing mode is set so that the expansion is performed when the output control means 64 outputs it. The timing of development, such as setting the processing form, may be any timing prior to display on the management monitor 2. Further, when the monitor screen M is displayed on the management screen 100, the operation status is displayed in real time by updating the monitor screen M at set intervals.

<Locate information setting unit R / determination unit S>
As shown in FIG. 6, the locate information setting unit R includes a locate information receiving means 71 for receiving locate information sent through the communication network, an information converting means 72 for performing coordinate conversion of the received locate information, and this information. A locating information table 73 for expanding and storing the locating information converted by the converting means 72 in an area corresponding to the management monitor 2 is provided.

  Further, the determination unit S includes the composite locate information table 73, position comparison means 74 for comparing the processing target with respect to the composite locate information table 73 and the designated position, and the position comparison means 74 from the mouse 4. And a designated position acquisition unit 75 that provides information based on the designation information to the position comparison unit.

  The locate information receiving unit 71 provides the information converting unit 72 with the locate information acquired by receiving the packet. The information conversion means 72 is arranged at a position to be displayed on the screen of the management monitor 2 based on the display position information and the display size information given from the output form setting means 65 of the monitor screen display section P. A process of recording in the synthetic locate information table 73 is performed. In the combined locate information table 73, in the situation where a plurality of monitor screens M are displayed on the management screen 100 in the management monitor 2 as shown in FIG. 13, the location information of the processing target included in each monitor screen M is recorded. Is done.

  The designated position acquisition means 75 performs a process of obtaining the position of the cursor on the screen of the management monitor 2 and giving it to the position comparison means 74, and this position comparison means 74 is a cursor position given from the designated position acquisition means 75. A comparison is made between the position and the processing target included in the monitor screen M of the communication terminal B recorded in the composite locate information table 73 and the designated position by the cursor. In contrast, if the operation log designation information is not matched, the operation log designation information is output. If the information does not match, it is determined that the operation log designation information is not selected, and no information is output (negative information may be output).

  The combined locating information table 73 records locating information to be processed included in a plurality of monitor screens M, but it is not necessary to correspond to the plurality of monitor screens M. When one of them is enlarged and displayed on the full screen of the management monitor 2, only the location information to be processed on one monitor screen M is recorded.

<Operation log display part T / Extraction display part U>
As shown in FIG. 7, the operation log display unit T includes an operation log receiving unit 81 that receives an operation log transmitted through the communication network, and an information access that records the received operation log in the hard disk HD or the semiconductor memory 13. A means 82, an output control means 83 for controlling the output of the operation log recorded in the hard disk HD or the semiconductor memory 13 to the management monitor 2 via the information access means 82, and an output based on the operation log designation information. Operation log collection means 84 for collecting power operation logs.

  Further, the extraction display unit U includes operation log extraction means 85 in addition to the configuration of the operation log display unit T.

  The operation log receiving unit 81 receives the packet, acquires an operation log, and performs processing to be given to the information access unit 82. The information access means 82 is a process for directly giving the given operation log to the output control means 83, a process for recording this operation log in the hard disk HD or the semiconductor memory 13, and an operation read from the hard disk HD or the semiconductor memory 13. A process of giving a log to the output control means 83 is performed.

  The output control unit 83 performs control to output the operation log designated by the operation log collection unit 84 or the operation log extraction unit 85 to the management monitor 2. The operation log collection unit 84 provides the output control unit 83 with operation log designation information based on the operation log designation information set by the administrator in the management server A or the operation log designation information output from the determination unit S. .

  The operation log extraction unit 85 performs a process of acquiring the extraction condition information and giving it to the output control unit 83.

[Management process]
As a basic process in the management server A, the management process can be shown as in the flowchart of FIG. That is, the communication terminal B connected to the communication network is specified, and the operation information of each communication terminal B is acquired (# 01 step).

  Next, the monitor screen M is recorded, and an operation log is recorded (steps # 02 and # 03). In this process, the monitor screen M and operation logs transmitted from a plurality of communication terminals B are recorded in the hard disk HD or the semiconductor memory 13.

  Next, the management screen 100 shown in FIG. 13 is displayed (# 100 step). When the screen playback button 101 is operated on this management screen 100, the monitor screen playback display is performed (# 04, # 200 steps). When the log browsing button 102 is operated on the management screen 100, an operation log list is displayed (steps # 05 and # 300). When the PC information button 103 is operated on the management screen 100, The PC information is displayed (steps # 06 and # 07). When the remote control button 104 is operated on the management screen 100, the remote control screen is displayed and the remote control is executed (# 08). , # 09 step). These controls are continued until reset (step # 10).

〔Management screen〕
On the management screen 100, the screen playback button 101, log viewing button 102, PC information button 103, remote control button 104, alert setting button 105, etc. are displayed in the upper position in the form of icons. A monitor screen display area 110, a message display section 111, and a terminal list display section 112 are formed. In FIG. 13, a plurality of monitor screens M are displayed in a form surrounded by a frame 120 with respect to the monitor screen display area 110, and an information display unit 121 is formed below the frame 120.

  The processing of steps # 100, # 200, and # 300 will be described later. In step # 07 described above, the PC information acquisition unit 15 overlaps the management screen 100 (overlapping state) with the PC information screen ( (Not shown) and the physical data of the communication terminal B, the name of the installed application, and the like are displayed on the PC information screen. As an example of a specific operation mode, the PC information button 103 is pressed while the monitor screen M of the communication terminal B displayed in the monitor screen display area 110 or the terminal list display unit 112 is selected with a cursor. By selecting and operating, the processing mode is set such that the information of the selected communication terminal B is acquired by the PC information acquisition unit 15 via the communication network and displayed on the PC information screen.

  In step # 09, when the remote control button 104 is operated, the remote control unit 16 displays a remote control screen (not shown) in an overlapping state (overlapping state) on the management screen 100. By setting specific processing of remote control on this remote control screen, remote control of the target communication terminal B is realized.

  As an example of a specific operation mode, the remote control button 104 is pressed while the monitor screen M of the communication terminal B displayed in the monitor screen display area 110 or the terminal list display unit 112 is selected with a cursor. By selecting and operating the selected communication terminal B, the communication network by the remote control unit 16 can be controlled by operating icons or executing commands on the remote control screen. Remote control of the communication terminal B is realized via this.

[Management screen display routine]
The management screen display (# 100 step) processing can be shown as a subroutine as shown in FIG. That is, the display information of the display position and the display size of the monitor screen M with respect to the monitor screen display area 110 is acquired, and the monitor screen M is displayed on the monitor screen display area 110 according to this display information (# 101, # 102). Step).

  In this way, when the monitor screen M is displayed in the monitor screen display area 110, information for specifying the communication terminal is displayed on the message display unit 111 below the frame 120 of the monitor screen M. As described above, the process of displaying the monitor screen M is a process in which the monitor screen acquisition unit F of the communication terminal B acquires the monitor screen M of the monitor 8 of the communication terminal B and transmits it to the communication network. The monitor screen display part P of the management server A displays the monitor screen M in the monitor screen display area 110.

  When a plurality of monitor screens M are displayed on the monitor screen display area 110, the output form setting means 65 displays the display information (display position information and display position information) of each monitor screen M as shown in step # 101. Display size information) is set, and according to these settings, the output form setting means 65 displays a plurality of monitor screens M in a form arranged at the set position as shown in # 102. In this way, when a plurality of monitor screens M are displayed, each monitor screen M is updated and displayed for each set interval.

  It is also possible to arbitrarily select one of the plurality of monitor screens M displayed in the monitor screen display area 110 and display it in an enlarged manner. When the enlarged display is performed in this way, the display When the information is changed and the monitor screen M is enlarged and displayed, the enlarged monitor screen M is updated and displayed every set interval.

  Next, based on the display information (display position information and display size information), the information conversion means 72 sets the synthetic locate information table 73 (step # 103). In this process, in addition to the locate information indicating the display position of the processing target such as the icon and the holder included in the desktop displayed on the management monitor 2 on the management server A side, the icons included in the management screen 100 Locating information indicating a display position, and locating information indicating a display position of a processing target such as an icon, a folder, and a window of an application being executed included in the monitor screen M displayed in the monitor screen display area 110. It becomes a table of structure.

  As described above, when one of the plurality of monitor screens M displayed in the monitor screen display area 110 is arbitrarily selected and enlarged, the processing target included in the enlarged monitor screen M is displayed. The locate information is changed.

  Next, when the determination unit S determines that designation is performed by performing designation / non-designation with a cursor, an operation log is extracted and displayed (steps # 104, # 105, and # 400).

  As an example of specific processing, an example in which the cursor CU is operated on an enlarged monitor screen M as shown in FIG. 14 will be described. The monitor screen M includes an icon IC, a folder FL, and processing execution as processing targets. The application AP is displayed, and by making the cursor CU coincide with any one of these and performing an operation of clicking, the position where the cursor CU exists at the timing of the click and the synthetic locating information table 73 are set. When the location information of the processing target is compared and matched by the position comparison means 74 (if selected: the cursor position is included in the position (area) where the processing target exists), as shown in FIG. The operation log corresponding to the processing target is extracted and displayed on the operation log extraction screen 130.

  The specific contents of the operation log displayed on the operation log extraction screen 130 are the computer information and the time when the processing was performed, such as that displayed in the operation log display area 155 of the operation log display screen 150 in FIG. , Including information including the time of processing.

  In step # 103, the locating information acquired by the locating information acquiring unit H is acquired by the locating information setting unit R and recorded in the combined locating information table 73. In steps # 104 and # 105, the determination unit S compares the position of the cursor CU with the position to be processed recorded in the composite locate information table 73. Information is output.

  The processing of operation log extraction display (step # 400) can be shown as a subroutine as shown in FIG.

  That is, the operation log designation information output from the position comparison means 74 is acquired, the operation log corresponding to this operation log designation information is extracted and displayed on the operation log extraction screen 130 (steps # 401 to # 403). This process is realized by the process of the extraction display unit U.

  The operation log designation information includes information for specifying the designated processing target and information indicating the designated timing. In step # 402, the operation log designation information up to this timing is determined based on the designated timing. By extracting information including progress information, the details of the operation up to the designated timing can be properly grasped.

  More specifically, for example, for an operation log extracted by specifying a folder displayed on the monitor screen M, the date and time when the folder was created is set as the start point of the operation log. Information such as the creation and update time of the file included in the file, the installation date and time of the application included in the folder, and the date and time when the application was executed is displayed as an operation log in the order of the date and time.

[Monitor screen display routine]
The monitor screen reproduction display (step # 200) process can be shown as a subroutine as shown in FIG.

  That is, information for specifying the communication terminal B is acquired, and the reproduction screen 140 shown in FIG. 15 is displayed, and information on the reproduction start and reproduction end is acquired on the reproduction screen 140 (steps # 201 to # 203).

  The process of identifying the communication terminal B as in step # 201 is performed before the operation of the screen playback button 101 by the communication terminal B displayed in the monitor screen display area 110 or the terminal list display unit 112. Although it is conceivable to select the monitor screen M with a cursor, when the screen playback button 101 is operated, a dialog box (not shown) is displayed and information identifying the communication terminal B is input from the keyboard 6 or the like. It is also possible.

  The playback screen 140 includes a calendar section 141, a playback start time input section 142, a playback end time input section 143, an OK button 144, a playback area 145, a plurality of playback control buttons 146, and a playback slider 147. I have.

  When the reproduction display of the monitor screen M is performed on the reproduction screen 140, the reproduction date (the date on which the monitor screen M is recorded) is selected by the cursor in the calendar unit 141, and the reproduction is started from the keyboard or the like in the reproduction start time input unit 142. After inputting the start time and inputting the playback end time from the keyboard or the like in the playback end time input unit 143, an operation of selecting and clicking the OK button 144 with the cursor is performed.

  After this operation is performed, the monitor screen M of the specified communication terminal B is continuously displayed in the playback mode set for the playback area 145 (step # 204).

  In this process, only the monitor screen M specified as described above is extracted from the monitor screen M recorded on the hard disk HD, and the playback start time and the playback end are extracted from the monitor screen M thus extracted. What is included in the time is further extracted and displayed in the reproduction area 145 in the recorded order. This playback mode is given as initial information. By selecting and operating the plurality of playback control buttons 146, the playback speed (the number of frames per unit time) can be adjusted, and playback can be stopped. It is also possible to set to a state (still state). Further, it is possible to jump the playback timing by operating the playback slider 147.

  Next, based on the display information (display position information and display size information), the information conversion means 72 sets the synthetic locate information table 73 (step # 205). In this process, in addition to the locate information indicating the display position of the processing target such as the icon and holder included in the desktop displayed on the management monitor 2 on the management server A side, the calendar unit 141 included in the reproduction screen 140 is displayed. Locating information indicating the display position of the playback start time input unit 142, etc., and processing of icons, folders, windows of applications being executed, etc. included in the monitor screen M displayed in the playback area 145 of the playback screen 140 This is a table having a structure including locate information indicating the display position of the object.

  Next, when the determination unit S determines that designation is made by designating / non-designating with the cursor, the process of extracting and displaying the operation log is executed (steps # 206, # 207, # 400). .

  As an example of specific processing, in the situation where the cursor CU is operated on the monitor screen M displayed in the reproduction area 145, the icon IC, the folder FL, and the application AP being executed are displayed on the monitor screen M as processing targets. By performing an operation of making the cursor CU coincide with any one of these and performing a click operation, the position where the cursor CU exists at the timing of this click and the location information of the processing target set in the locate information table are obtained. If they are compared and matched (if selected, the cursor position is included in the position (area) where the processing target exists), as shown in the figure, an operation log corresponding to the processing target is extracted, and the operation log It is displayed on the extraction screen 130.

  In step # 305, the locate information setting unit R acquires the locate information acquired by the locate information acquiring unit H and records it in the combined locate information table 73. In steps # 306 and # 307, the determination unit S compares the position of the cursor CU with the position to be processed recorded in the combined locate information table 73. Information is output. Further, the content information display process in step # 400 is executed as described above.

[Operation log browsing routine]
The operation log browsing display (# 300 step) processing can be shown as a subroutine as shown in FIG.

  That is, when the log browsing button 102 is operated, the operation log display screen 150 shown in FIG. 16 is displayed, and information on the log to be displayed on the operation log display screen 150, display conditions, and the like are acquired (# 301). , # 302 step).

  The operation log display screen 150 includes a plurality of log type buttons 151, a target period input unit 152, a user information input unit 153, a keyword input unit 154, and an operation log display area 155.

  The log type button 151 includes a plurality of buttons such as start / stop indicating terminal start / stop information, user operation indicating user operation, application execution status, file access indicating file access information, and the like. By selecting the plurality of log type buttons 151 with the cursor CU, the operation log selected in the operation log display area 155 can be browsed. The operation log display area 155 includes information including computer information, processing time, processing time, login name, active / inactive status of processing target, execution command, and the like. Yes.

  The conditions for specifying the operation log to be displayed in this way are not limited to the log browsing button 102 described above. For example, information for specifying an application in an active state, an operation in which an error has occurred, and a risk. It may include an accompanying operation.

  The operation log displayed in the operation log display area 155 includes the computer name of the target communication terminal B, the date and time when the process was performed, the number of seconds when the process was performed, the login name, the type such as active or activated , Information such as a command when executed, an application name, and the like are included.

  The target period input unit 152 inputs a period for displaying the operation log, the user information input unit 153 inputs user information to be viewed in the operation log, and the keyword input unit 154 sets the target as a browsing target. Enter the operation log name. Information input in this way is acquired as display information.

  Instead of the operation of inputting information for specifying the communication terminal B, the communication terminal B displayed in the monitor screen display area 110 or the terminal list display unit 112 before operating the log browsing button 102 is displayed. The monitor screen M may be selected with a cursor.

  Next, operation logs corresponding to the display conditions are collected, and the collected operation logs are displayed in a list in the operation log display area 155. This process realizes a process in which the operation log collection unit 84 of the operation log display unit T controls the output control unit 83 according to the display condition information.

  Next, it is determined whether or not an operation log is selected by the cursor CU. If selected, a monitor screen M corresponding to the selected operation log is extracted, and a moving image is displayed on a newly displayed screen (not shown). And is continued until this process ends (steps # 305 to # 307). In this way, when displaying as a moving image, it is assumed that the playback screen 140 is used to perform playback display. However, the processing form is set so that the moving image is played back without using the playback screen 140. May be.

In this operation log browsing display (step # 300), when no user condition is input, operation logs of all communication terminals B (all users) recorded in the hard disk HD are collected and an operation log display area is displayed. 155. Furthermore, by selecting one of a plurality of operation logs displayed in a list, the monitor screen M corresponding to the selected operation log is displayed like a moving image, so that the user when this operation log is collected is displayed. When the details of the operation form can be grasped and the processing related to the operation log is visually grasped, the monitor screen M can be made to be a moving image.

[Concept of the present invention]
Thus, in the present invention, the monitor screen M displayed on the monitors 8 of the plurality of communication terminals B is displayed on the monitor screen display area 110 of the management screen 100 displayed on the management monitor 2 on the management server A side. Thus, the system is configured so that operations performed in the communication terminal B can be visually grasped and managed in real time.

  The monitor screen M displayed on the management screen 100 of the management monitor 2 displays an icon IC, a folder FL, an application AP being processed, and the like. However, since these are acquired as image information, a GUI (Graphical The function of (User Interface) cannot be used. However, according to the present invention, the monitor screen M acquired as image information, the operation log, and the location information such as the icon IC, the folder FL, and the application AP being executed displayed on the monitor screen M are displayed. And the processing mode is set so as to determine the position of the cursor CU with respect to the monitor screen M displayed on the management monitor 2 based on the locate information. When you want to know the operation status of FL, processing application, etc., you can display the operation log corresponding to the processing target while using the GUI function effectively by matching the cursor CU It is made possible.

  As described above, the operation status of the processing target such as the icon IC, the folder FL, and the application AP being executed can be visually confirmed via the operation log. Even if it is desired to grasp the operation log, the operation log corresponding to the application is extracted and displayed only by operating the cursor. As a result, the management server A can be considered to be a risky operation or an illegal operation. Can be properly grasped and managed.

  The processing for operating the content information display screen 130 in this way is not limited to the monitor screen M displayed in real time on the monitor screen display area 110 of the management screen 100 as described above. The same operation can be performed when the monitor screen M in which the eight monitor screens M are recorded as time passes is displayed on the reproduction screen 140.

[Another embodiment]
The present invention may be configured as follows in addition to the embodiment described above.

(A) When a plurality of processing targets included in the monitor screen M are designated by the cursor CU, the operation log extraction screens 130 corresponding to the designated plurality of processing targets are displayed, and each operation log extraction screen is displayed. The operation log is displayed in parallel to 130.
By displaying a plurality of operation logs in parallel as described above, for example, when two documents are edited in parallel, it is possible to appropriately grasp the progress of editing each document data.

(B) Change the display color of the processing target specified by the cursor CU to the processing target included in the monitor screen M, and change the display color of the frame of the operation log extraction screen 130 that displays the operation log corresponding to this processing target, Match the hue to be processed after the change.
By setting the processing form in this way, the relationship between the processing target and the operation log can be easily grasped visually.

(C) When displaying the operation log, the risk of each operation log is determined. If the operation log is a high-risk operation, the display color of the operation log is changed or the operation is at risk. Set the display form to display the message to be revealed.
By setting the display form in this way, the presence or absence of risk can be easily grasped.

Diagram showing an overview of a communication network Block diagram showing basic configuration of network management system Block diagram showing the configuration of the management server and communication terminal Block diagram showing configurations of monitor screen acquisition unit and locate information acquisition unit Block diagram showing the configuration of the operation log acquisition unit Block diagram showing the configuration of the monitor screen display unit, locate information setting unit, etc. Block diagram showing the configuration of the operation log display and extraction display Management process flowchart Management screen display routine flowchart Monitor screen playback display routine flowchart Flow chart of operation log browsing display routine Operation log extraction display routine flowchart Figure showing the management screen Diagram showing the enlarged monitor screen and operation log extraction screen Diagram showing playback screen and operation log extraction screen Operation log display screen flowchart

Explanation of symbols

2 Management monitor 4 Pointing device (mouse)
8 Monitor (Communication terminal monitor)
72 Information conversion means 74 Position comparison means A Management server B Communication terminal F Monitor screen acquisition part G Operation log acquisition part H Locate information acquisition part M Monitor screen P Monitor screen display part S Determination part T Operation log display part U Extraction display part X Monitor screen output unit Y Operation log output unit HD Recording means (hard disk)

The present invention is characterized in that a monitor screen of a communication terminal connected to a communication network is acquired, a monitor screen output unit to be displayed on a management monitor on the management server side of the communication network, and a user operation log in the communication terminal are acquired. In a network management system comprising an operation log output unit for displaying on a management monitor on the management server side of a communication network,
The monitor screen output unit acquires location information indicating a position on the processing target screen displayed on the monitor screen in association with the acquired monitor screen, and the management server side via the communication network A locate information acquisition unit for transmitting to the communication terminal, an operation log acquisition unit for acquiring an operation log corresponding to the processing target in the communication terminal, and transmitting the operation log to the management server via the communication network,
When the monitor screen before Symbol monitor screen in the management monitored by the output unit is displayed, locating information setting unit for the locate information obtained from the communication network to set corresponding to the displayed monitor screen, and, the By comparing the location information set by the location information setting unit with the designated position by the pointing device in the management monitor, the situation where the display position of the processing object matches the designated position is selected as the processing object. The management server side is provided with a determination unit that determines that
If the to be in a selected state by the previous SL determination unit is determined, it includes an extraction display unit to be displayed on the management monitor from the acquired operation log from the communication network by extracting operation log associated with the processing target There is in point.

According to this configuration, the monitor screen output unit acquires the monitor screen of the communication terminal and displays it on the management monitor on the management server side. In this display state, the specified position of a pointing device such as a mouse is included in the monitor screen. When the determination unit determines that the target display position matches the location information based on the locate information, the extraction display unit extracts the operation log of the processing target specified in this way to the management monitor on the management server side. To display. In other words, although the icons and folders such the desktop monitor screen of the communication terminal displayed on the management monitor is displayed, the icons and folders such, in the management server, using the function of the GUI (Graphical User Interface) It is something that cannot be done. However, according to the present invention, by specifying an icon, a folder, a window being executed, etc. displayed as a processing target on the desktop screen of the monitor screen with a cursor or the like, an operation log that takes advantage of the GUI function can be used. Can be extracted and displayed, and the progress of the operation and details of the operation can be accurately grasped from the contents of the operation log. As a result, the operation status can be accurately grasped from the monitor screen while effectively utilizing the GUI functions.

In the present invention, the monitor screen output unit acquires information on the screen displayed on the monitor of the communication terminal as a monitor screen, and transmits the information to the management server side via the communication network; and A monitor screen display unit for displaying the monitor screen acquired from the communication network on the management monitor;
The locate information setting unit, when the monitor screen is displayed on the management monitor by the monitor screen display unit, the display position information of the monitor screen in the management monitor and the display size of the monitor screen in the management monitor Based on the information, a synthetic locate information table corresponding to the arrangement of the processing target on the management monitor displayed on the monitor screen may be set .

According to this configuration, when the monitor screen is displayed on the management monitor, the operation log corresponding to the monitor screen is stored in the composite locate table based on the display position of the monitor screen and the display size of the monitor screen. The position designated by the pointing device can be determined based on the composite locate table.

The present invention comprises a recording means for recording a plurality of the monitor screens acquired over time by the monitor screen acquisition unit,
The monitor screen display unit continuously displays the plurality of monitor screens recorded in the recording unit over time on the management monitor,
The extraction display unit is a processing target selected from an operation log acquired from the communication network when the determination unit determines that a processing target included in the monitor screen displayed on the management monitor is selected. An operation log related to can be displayed.

According to this configuration, the monitor screen displayed on the monitor of the communication terminal is acquired over time and stored in the storage unit. When the monitor screen displayed in this way is displayed as a moving image on the management monitor by the monitor screen display unit, and the processing target included in the monitor screen displayed on the management monitor is selected, The extraction display means displays the operation log related to the processing target selected from the operation log acquired from the communication network, and the user's operation at the timing when the monitor screen is displayed can be easily grasped.

In the present invention, the processing target includes an icon, a folder displayed on the desktop of the monitor screen, a window of an application being executed,
Before SL determination unit, by the locating information to coordinate transformation based on the display position and display size of the monitor screen in the management monitor acquires conversion locate information indicating the display position of the processing target in the management monitor And a position comparison unit that compares a specified position by the pointing device with a position corresponding to the conversion locating information.

According to this configuration, the information converting means when the monitor screen is reduced and displayed to the management monitor, coordinate transformation a locate information on the basis of the display size and the display position. Since the position comparison means compares the location information after this coordinate conversion and the specified position by the pointing device, when the processing target in the monitor screen is specified by the pointing device, regardless of the display size or display position of the monitor screen Realizes the process of displaying the operation log.

In the present invention, the operation log acquisition unit acquires the operation log to which processing identification information for identifying the processing target is attached in the communication terminal, and transmits the operation log to the management server via the communication network .
The extraction display unit may display only the operation log acquired from the communication network, to which information for identifying the processing target determined by the determination unit to be selected is attached. good.

According to this configuration, the processing identification information for identifying the processing target is an operation log operation log acquisition unit acquires the attached, will be sent to the management server via a communication network. In the management server, the extraction display unit can extract the operation log to which the processing identification information corresponding to the processing target determined by the determination unit is added, and display the operation log on the management monitor.

The present invention is characterized in that a monitor screen of a communication terminal connected to a communication network is acquired, a monitor screen output unit to be displayed on a management monitor on the management server side of the communication network, and a user operation log in the communication terminal are acquired. In a network management program in a communication network comprising an operation log output unit for displaying on a management monitor on the management server side of the communication network ,
The monitor screen output unit acquires location information indicating a position on the processing target screen displayed on the monitor screen in association with the acquired monitor screen, and the management server side via the communication network A locate information acquisition unit for transmitting to the communication terminal, an operation log acquisition unit for acquiring an operation log corresponding to the processing target in the communication terminal, and transmitting the operation log to the management server via the communication network,
When the monitor screen before Symbol monitor screen in the management monitored by the output unit is displayed, locating information setting unit for the locate information obtained from the communication network to set corresponding to the displayed monitor screen, and, the By comparing the location information set by the location information setting unit with the designated position by the pointing device in the management monitor, the situation where the display position of the processing object matches the designated position is selected as the processing object. The management server side computer is caused to execute a determination function for determining
Lies in executing the extracted display function to be in a selected state by the previous SL judging function extracts and displays operation logs relating to the processing object is determined in the management server side computer.

According to this configuration, the monitor screen of the communication terminal is acquired by the monitor screen output unit and displayed on the management monitor. In this display state, if it is determined by the determination function based on the locate information that the specified position by the pointing device such as a mouse matches the display position of the operation target included in the monitor screen, it is acquired from the communication network. Among the operation logs, the extraction display function extracts an operation log related to the processing target specified in this way and displays it on the management monitor. In other words, although icons and folders are displayed on the monitor screen of the communication terminal desktop displayed on the management monitor, these icons and folders have their GUI (Graphical User Interface) functions on the management server side. It cannot be used. However, according to the present invention, when an icon, a folder, a window being executed, or the like displayed as a processing target on the desktop screen of the monitor screen is designated with a cursor or the like, the operation log is operated in an operation form utilizing the GUI function. Is displayed, and the progress of the operation and the details of the operation can be accurately grasped from the contents of the operation log. As a result, the operation status can be accurately grasped from the monitor screen of the client PC while effectively utilizing the GUI function on the management server side.

A feature of the present invention is that a monitor screen output unit for acquiring a monitor screen of a communication terminal connected to a communication network and displaying it on a management monitor and a user operation log in the communication terminal are acquired and displayed on the management monitor In a network management server equipped with an operation log output unit
In association with the acquired monitor screen, the communication terminal acquires location information indicating the position on the processing target screen displayed on the monitor screen, and transmits it to the management server via the communication network. A locate information acquisition unit, and an operation log acquisition unit that acquires an operation log corresponding to the processing target in the communication terminal and transmits the operation log to the management server via the communication network,
When the monitor screen before Symbol monitor screen in the management monitored by the output unit is displayed, locating information setting unit for the locate information obtained from the communication network to set corresponding to the displayed monitor screen, and, the By comparing the location information set by the location information setting unit with the designated position by the pointing device in the management monitor, the situation where the display position of the processing object matches the designated position is selected as the processing object. A determination unit for determining
If the to be in a selected state by the previous SL determination unit is determined, it includes an extraction display unit to be displayed on the management monitor from the acquired operation log from the communication network by extracting operation log associated with the processing target There is in point.

According to this configuration, the monitor screen output unit acquires the monitor screen of the communication terminal and displays it on the management monitor. In this display state, the specified position of the pointing device such as a mouse is the display position of the processing target included in the monitor screen. If the determination unit determines that it matches with the location information, the extraction display unit manages the operation log related to the processing target specified in this way from the operation logs acquired from the communication network. Extract and display on the monitor. In other words, although the icons and folders such the desktop monitor screen of the communication terminal displayed on the management monitor is displayed, the icons and folders such are those that can not be used the function of the GUI (Graphical User Interface) is there. However, according to the present invention, by specifying an icon, a folder, a window being executed, etc. displayed as a processing target on the desktop screen of the monitor screen with a cursor or the like, an operation log that takes advantage of the GUI function can be used. Can be extracted and displayed, and the progress of the operation and details of the operation can be accurately grasped from the contents of the operation log. As a result, the operation status can be accurately grasped from the monitor screen while effectively utilizing the GUI functions.

A feature of the present invention is an operation log output program for causing a computer to execute an operation log output function for displaying a user operation log on a communication terminal on a management monitor of a management server .
A monitor screen acquisition unit that acquires information on a screen displayed on the monitor of the communication terminal as a monitor screen and transmits the information to the management server via the communication network, and the acquired monitor screen A location information acquisition unit that acquires location information indicating a position on a processing target screen displayed on the monitor screen and transmits the location information to the management server via the communication network; and An operation log acquisition unit that acquires an operation log corresponding to the processing target and transmits the operation log to the management server via the communication network;
The operation log output function, the acquired monitor screen from a communication network is displayed before Symbol management monitoring of the communication terminal, in a situation where locate information acquired from the communication network is set corresponding to the monitor screen, When the processing target displayed on the management monitor is selected by designation with a pointing device, an operation log related to the selected processing target is extracted from the operation log acquired from the communication network, and the management monitor is extracted. The management server side computer is caused to execute the extraction display function to be displayed on the management server side .

According to this configuration, when the monitor screen of the communication terminal is displayed on the management monitor of the management server, for example, when an icon or a folder is selected as a processing target displayed on the monitor screen with a pointing device. In the operation log already acquired from the communication network , the extraction display function extracts an operation log related to the selected processing target and displays it on the management monitor. As a result, the operation log corresponding to the processing target displayed on the management monitor is extracted and displayed so that the status of the terminal operation can be accurately grasped.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
〔System configuration〕
As shown in FIGS. 1 to 3, a management server A comprising a computer to the communication network constructed by the communication path L, a plurality of communication terminals B comprising a computer (client PC), and the file server C, the printer This communication network is connected to the Internet N via the gateway server E and the like.

The monitor screen acquisition unit F acquires information on the screen displayed on the monitor 8 of the communication terminal B as a monitor screen M over time, compresses the information, and identifies the communication terminal B. A process of transmitting information to the management server A is performed. The operation log acquisition unit G includes execution (operation) of the communication terminal B, application execution, file operation, access to a shared folder , output to a printer, connection to the Internet, mail transmission, use of an external storage medium, etc. A process of acquiring a log as an operation log and transmitting it to the management server A is performed. The locate information acquisition unit H acquires the display positions of icons, folders, windows of applications being executed, etc. displayed on the desktop of the monitor 8 (monitor screen M) of the communication terminal B, The terminal identification information to be identified is attached and transmitted to the management server A.

Next, based on the display information (display position information and display size information), the information conversion means 72 sets the synthetic locate information table 73 (step # 103). In this process, in addition to the locate information indicating the display position of the processing target such as the icon and folder included in the desktop displayed on the management monitor 2 on the management server A side, the icons included in the management screen 100 Locating information indicating a display position, and locating information indicating a display position of a processing target such as an icon, a folder, and a window of an application being executed included in the monitor screen M displayed in the monitor screen display area 110. It becomes a table of structure.

Next, based on the display information (display position information and display size information), the information conversion means 72 sets the synthetic locate information table 73 (step # 205). In this process, in addition to the locate information indicating the display position of the processing target such as the icon and folder included in the desktop displayed on the management monitor 2 on the management server A side, the calendar unit 141 included in the reproduction screen 140 is displayed. Locating information indicating the display position of the playback start time input unit 142, etc., and processing of icons, folders, windows of applications being executed, etc. included in the monitor screen M displayed in the playback area 145 of the playback screen 140 This is a table having a structure including locate information indicating the display position of the object.

In step # 305, the locate information setting unit R acquires the locate information acquired by the locate information acquiring unit H and records it in the combined locate information table 73. In steps # 306 and # 307, the determination unit S compares the position of the cursor CU with the position to be processed recorded in the combined locate information table 73. Information is output. Furthermore, the processing of # 400 steps are performed as described above.

Processing of this is not limited to a monitor screen M displaying in real time to the monitor display area 110 of the management screen 100 as described above, the time elapsed monitor screen M of the plurality of communication terminals B of the monitor 8 The same can be done when the monitor screen M recorded according to the above is displayed on the playback screen 140.

  The present invention acquires a monitor screen of a communication terminal connected to a communication network, acquires a monitor screen output unit to be displayed on a management monitor on the management server side of the communication network, and a user operation log in the communication terminal. The present invention relates to a network management system including an operation log output unit to be displayed on a management monitor on the network management server side, and a program therefor.

  As a network management system configured as described above, a remote control server and a client terminal are connected via a communication network, the remote control server accepts access request information from the client terminal, and is displayed on the monitor at the client terminal. The remote control server displays the received image data on the monitor, and the captured image recording means of the remote control server operates the client terminal screen as a captured image at predetermined intervals. There is one recorded in a log, and after this recording, the reproduction means of the remote control server reproduces the captured image recorded in the operation log (for example, see Patent Document 1).

  In this patent document 1, when image data transmitted from a plurality of client terminals is displayed on a monitor of a remote control server, the image data of each screen is reduced so that the plurality of image data can be viewed in a list. The display form is set.

JP-A-2006-108947 (paragraph numbers [0065] to [0077], [0095], [0096], FIGS. 1 to 5)

  In a network such as a LAN built in a limited facility such as a company or school, a large number of communication terminals (client PCs) are connected to the network, and the network is as important as a file server. There are many cases where a server that stores various information is connected. Considering the operation by the user who operates the communication terminal, it is assumed that the knowledge of the network is insufficient, the important file is deleted or the contents of the file are changed due to an erroneous operation caused by carelessness.

  In addition, even within a company, the existence of a person who accesses a file server for the purpose of obtaining highly confidential information cannot be denied. Even if information is shared in the file server, personal information, Management that restricts browsing, copying (copying), printing, and the like has been conventionally performed for highly confidential items such as those that should be kept secret in the past.

  In order to manage operations on the communication terminal connected to the network in this way, for example, inappropriate operation on the communication terminal is performed by using the Administrator account technology in the Windows OS or the root account technology in the UNIX OS. It is also possible to eliminate it. On the other hand, for example, in a network such as an in-house LAN, in order to collect and grasp the work status in each communication terminal or to discover an inappropriate operation in advance, as described in Patent Document 1 There is also a desire to monitor and monitor the communication terminal by displaying the screen of the communication terminal on the server side.

  As a specific management form, it is convenient to display the monitor screen of the client PC in real time, or to record this screen information and display it in a playback form. However, to monitor the operation status by displaying the monitor screen of the client PC on the monitor of the management server, for example, when a plurality of monitor screens are displayed on the monitor of the management server, the individual monitor screens of the client PC are small. There is room for improvement in terms of difficulty in grasping the operation status.

  An object of the present invention is to accurately grasp the status of operation on a communication terminal from the monitor screen of the communication terminal displayed on the monitor on the management server side.

Feature of the present invention, records a monitor screen acquisition unit that acquires along the monitor screen of a communication terminal connecting to a communication network over time, a plurality of the acquired monitor screen, the management server side of the communications network A monitor screen display unit for continuously displaying the plurality of recorded monitor screens as time elapses, and a user operation log in the communication terminal is acquired, and the management monitor on the management server side of the communication network is acquired. In the network management system provided with the operation log output unit to be displayed in the location, the location indicating the position on the processing target screen displayed on the monitor screen in association with the monitor screen acquired by the monitor screen acquisition unit A locate information acquisition unit for acquiring information and transmitting the information to the management server via the communication network; Acquires operation log corresponding to the processing target at the terminal via the communication network and an operation log acquisition unit that transmits to the management server, the monitor screen is displayed on the management monitored by the monitor screen display unit A locate information setting unit for setting the locate information associated with the monitor screen acquired from the communication network corresponding to the displayed monitor screen, and set by the locate information setting unit. The management unit is configured to determine a situation where the display position of the processing target matches the specified position by selecting the processing target by comparing the location information with the specified position by the pointing device on the management monitor. Provided on the server side, and when the determination unit determines that it is in the selected state, the communication network It lies in the operation log acquired from the work to extract the operation logs relating to the processing target has an extraction display unit to be displayed on the management monitor.

According to this configuration, the monitor screen acquisition unit acquires the monitor screen of the communication terminal , the monitor screen display unit displays it on the management monitor on the management server side, and the designated position of the pointing device such as a mouse in this display state is When the determination unit determines that the display position of the processing target included in the screen matches the location information associated with the monitor screen, the operation log of the processing target specified in this way is displayed. The extraction display unit extracts and displays it on the management monitor on the management server side. That is, although icons and folders are displayed on the monitor screen of the communication terminal desktop displayed on the management monitor, the icons and folders use the GUI (Graphical User Interface) function on the management server side. It is something that cannot be done. However, according to the present invention, by specifying an icon, a folder, a window being executed, etc. displayed as a processing target on the desktop screen of the monitor screen with a cursor or the like, an operation log that takes advantage of the GUI function can be used. Can be extracted and displayed, and the progress of the operation and details of the operation can be accurately grasped from the contents of the operation log. As a result, the operation status can be accurately grasped from the monitor screen while effectively utilizing the GUI functions.

Further, according to this configuration, the monitor screen displayed on the monitor of the communication terminal is acquired and stored over time. When the monitor screen displayed in this way is displayed as a moving image on the management monitor by the monitor screen display unit, and the processing target included in the monitor screen displayed on the management monitor is selected, The extraction display means displays the operation log related to the processing target selected from the operation log acquired from the communication network, and the user's operation at the timing when the monitor screen is displayed can be easily grasped.

In the present invention, the operation log acquisition unit acquires the operation log to which processing identification information for identifying the processing target is attached in the communication terminal, and transmits the operation log to the management server via the communication network.
The extraction display unit may display only the operation log acquired from the communication network, to which information for identifying the processing target determined by the determination unit to be selected is attached. good.

  According to this configuration, the operation log acquisition unit acquires the operation log to which the process identification information for identifying the processing target is attached, and transmits the operation log to the management server via the communication network. In the management server, the extraction display unit can extract the operation log to which the processing identification information corresponding to the processing target determined by the determination unit is added, and display the operation log on the management monitor.

A feature of the present invention is that a monitor screen acquisition function for acquiring a monitor screen of a communication terminal connected to a communication network over time, a plurality of the acquired monitor screens are recorded, and a management server side of the communication network A monitor screen display function for continuously displaying the plurality of recorded monitor screens over time in the management monitor , and a user operation log in the communication terminal are acquired and used as a management monitor on the management server side of the communication network. a network management program for executing a function for displaying on a computer, in association with the monitor screen that has been acquired by the monitor screen acquisition function, a position on the screen to be processed is displayed on the monitor screen Locating information to be acquired and transmitted to the management server via the communication network And broadcast acquisition function acquires operation log corresponding to the processing target in the communication terminal, an operation log acquisition function of transmitting to the management server through the communication network, the management monitored by the monitor screen displaying function When the monitor screen is displayed, a locate information setting function for setting locate information associated with the monitor screen acquired from the communication network corresponding to the displayed monitor screen, and the locate information setting function A determination that the processing target display position matches the specified position by selecting the processing target selection by comparing the location information set in step 2 with the specified position by the pointing device in the management monitor The function is executed by the computer on the management server side and selected by the determination function. If there it is determined, that to realize the extracted display function extracts the operation log associated with the processing target from the operation log acquired from the communication network to display on the management monitor to the management server side computer It is in.

According to this configuration, the monitor screen of the communication terminal is acquired by the monitor screen acquisition function and displayed on the management monitor by the monitor screen display function . In this display state, the determination function determines that the specified position by the pointing device such as a mouse matches the display position of the operation target included in the monitor screen based on the locate information associated with the monitor screen . In this case, from the operation logs acquired from the communication network, the extraction display function extracts an operation log related to the processing target specified in this way and displays it on the management monitor. In other words, although icons and folders are displayed on the monitor screen of the communication terminal desktop displayed on the management monitor, these icons and folders have their GUI (Graphical User Interface) functions on the management server side. It cannot be used. However, according to the present invention, when an icon, a folder, a window being executed, or the like displayed as a processing target on the desktop screen of the monitor screen is designated with a cursor or the like, the operation log is operated in an operation form utilizing the GUI function. Is displayed, and the progress of the operation and the details of the operation can be accurately grasped from the contents of the operation log. As a result, the operation status can be accurately grasped from the monitor screen of the client PC while effectively utilizing the GUI function on the management server side.
Further, according to this configuration, the monitor screen displayed on the monitor of the communication terminal is acquired and stored over time. When the monitor screen display function displays the monitor screen stored in this way as a moving image on the management monitor, and the processing target included in the monitor screen displayed on the management monitor is selected, The extraction display function displays the operation log related to the processing target selected from the operation log acquired from the communication network, and the user's operation at the timing when the monitor screen is displayed can be easily grasped.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
〔System configuration〕
As shown in FIGS. 1 to 3, a management server A composed of a computer, a plurality of communication terminals B (client PCs) composed of computers, a file server C, and a printer for a communication network constructed by a communication path L This communication network is connected to the Internet N via the gateway server E and the like.

  The management server A and a plurality of communication terminals B connected by the communication network constitute a network management system of the present invention.

The communication path L is an Ethernet (Ethernet) in a limited facility such as a company or a school.
) Or the like using a technology such as LAN (Local Area Network) and physically transmitting a signal, and a communication terminal B, a management server A, and the like targeted based on information on the signal transmitted by the cable La And a repeater Lb composed of a LAN switch or a hub for relaying signals. In this embodiment, the communication network is limited to the LAN. However, the communication network may include a WAN (Wide Area Network) or the Internet. To construct the LAN described above, a token ring (Token Ring) may be used. Alternatively, a technique such as CDDI (Copper Distributed Data Interface) may be used.

  The management server A includes a computer main body 1, a management monitor 2, a keyboard 3 and a mouse 4. The communication terminal B is constituted by a laptop or notebook personal computer in which a keyboard 6, a track pad 7 and a monitor 8 are integrally formed on a computer main body 5. Similar to the management server A, the communication terminal B may be a computer having a computer main body, a monitor, a keyboard, and the like.

  In the management server A, the cursor key of the keyboard 3 and the mouse 4 function as a pointing device. Similarly, the cursor key of the keyboard 6 of the communication terminal B and the track pad 7 function as a pointing device. However, the pointing device is not limited to these, such as using a trackball as the pointing device, or forming a touch panel on the display surface of the management monitors 2 and 8 and using the touch panel.

  The file server C incorporates a storage medium such as a large-capacity hard disk or is connected to the outside, and stores data to be shared on the communication network. The printer D is composed of a laser printer or an inkjet printer, and prints out information sent from the communication terminal B or the like.

  The network management system of the present invention acquires screen information (hereinafter referred to as monitor screen M) displayed on the monitors 8 of a plurality of communication terminals B connected to the communication network, and transmits them to the management server A via the communication network. The monitor screen output unit X (an example of the monitor screen output function) to be displayed on the management monitor 2 on the management server A side and user operation logs in the plurality of communication terminals B are acquired, and the management server is obtained via the communication network. And an operation log output unit Y (an example of an operation log output function) that is transmitted to A and displayed on the monitor 8 of the management server A, and is further displayed on the management monitor 2 on the management server A side by the monitor screen output unit X. The processing target included in the monitor screen M (see FIGS. 14 and 15) is designated by the cursor, and the determination unit S (determination unit) If the example of) is determined includes an extraction display unit U to be displayed on the management monitor 2 of the management server A extracts the operation log associated with processing object (an example of the extraction display function).

[Management server]
As shown in FIG. 3, the management server A includes a video output unit 11 that outputs information to the management monitor 2 and an input interface 12 that receives information from the keyboard 3 and mouse 4. And the semiconductor memory 13, the operating system 14, the PC information acquisition unit 15, the remote control unit 16, the alert output unit 17, the monitor screen display unit P, and the screen recording unit. Q, a locate information setting unit R, a determination unit S, an operation log display unit T, an extraction display unit U, a hard disk HD (an example of a recording unit), and a communication interface W are connected.

  Although the hard disk HD built in the management server A is taken as an example of the storage means, the hard disk HD connected to the outside of the management server A may be used as the storage means, and the management server A and the communication network may be used. And a data server having a large capacity hard disk HD built in.

  The semiconductor memory 13 is composed of a semiconductor element such as a RAM type or an EEPROM type. The operating system 14 manages the semiconductor memory 13 and develops software necessary for control in the semiconductor memory 13 (RAM) to execute the software. Further, the keyboard 3 and the mouse 4 functions as an interface that obtains the operation information 4 and gives it to the process being executed.

  The PC information acquisition unit 15, the remote control unit 16, the alert output unit 17, the monitor screen display unit P, the screen recording unit Q, the locate information setting unit R, the determination unit S, the operation log display unit T, and the extraction display unit U are A process of displaying operation statuses of the plurality of communication terminals B connected to the communication network on the management monitor 2 is realized.

  These PC information acquisition unit 15, remote control unit 16, alert output unit 17, monitor screen display unit P, screen recording unit Q, locate information setting unit R, determination unit S, operation log display unit T, and extraction display unit U are software. Although it is configured by hardware (program), it may be configured by hardware instead of software, or by combination with hardware.

  The PC information acquisition unit 15 not only acquires the name of the person (user) who operates the communication terminal B (hereinafter referred to as a user name) and the terminal name, but also assigns a MAC address unique to the communication terminal B. A process of acquiring physical data such as the IP address, computer CPU clock value, memory capacity, installed application name, registry data, etc. via the communication network is executed. The communication terminal B is configured to log in when the user inputs an ID, a password, or the like at the time of activation, and the PC information acquisition unit 15 specifies the user name from the password.

  The remote control unit 16 implements control from the management server A via the communication network such as log ON / OFF, power ON / OFF, and message display in the communication terminal B. The alert output unit 17 outputs alert information to the management monitor 2 when it is determined that an operation such as connection to a specified information file, execution of a specified application, registry change, application installation, or hardware addition has occurred. I do.

  The monitor screen display unit P displays the monitor screen M displayed on the monitors 8 of the plurality of communication terminals B on the management screen of the management server A as shown in FIG. 11, and the playback screen shown in FIG. On the other hand, the process which displays the monitor screen M along time progress similarly to a moving image is implement | achieved. The screen recording unit Q realizes a process of recording the monitor screen M displayed on the monitors 8 of the plurality of communication terminals B on the hard disk HD over time. The locate information setting unit R acquires the target location information displayed on the monitor screen M.

  The determination unit S selects a GUI expression using a cursor CU (see FIGS. 14 and 15) for a processing target such as an icon, a folder, or a window of an application being processed displayed on the desktop of the monitor screen M. Judged as non-selected. The operation log display unit T displays an operation log indicating the start / stop status of the monitors 8 of the plurality of communication terminals B, application execution, information file operation, print output, e-mail transmission, connection to the Internet, and the like. The management server A realizes processing to be displayed on the log display screen. The extraction display unit U performs a process of extracting an operation log corresponding to the processing target selected by the determination unit S and displaying the operation log on the management monitor 2.

  Since the processing by the monitor screen display unit P, screen recording unit Q, locate information setting unit R, determination unit S, operation log display unit T, and extraction display unit U is closely related to the processing in the communication terminal B, communication This will be described later together with the processing in terminal B.

[Communication terminal]
As shown in FIG. 3, in the communication terminal B, a video output unit 21 for outputting information to the monitor 8 and an input interface 22 for inputting information from the keyboard 6 and the track pad 7 include a data bus of the CPU. And the semiconductor memory 23, the operating system 24, a plurality of applications AP, a monitor screen acquisition unit F, an operation log acquisition unit G, a locate information acquisition unit H, and a hard disk. The HD and the communication interface W are connected.

  Similar to the management server A, the semiconductor memory 23 is constituted by a semiconductor element such as a RAM type or an EEPROM type. In addition, the operating system 24 manages the semiconductor memory 23 and develops software such as an application AP in the semiconductor memory 23 (RAM) to execute the software. The interface that obtains operation information of the pad 7 and gives it to the processing being executed and the application AP are a plurality of word processors, spreadsheet software, and drawing software such as CAD that are executed in the communication terminal B. Means an application.

  These monitor screen acquisition unit F, operation log acquisition unit G, and locate information acquisition unit H are assumed to be software, but may be configured by hardware or combined with hardware. .

  The monitor screen acquisition unit F acquires information on the screen displayed on the monitor 8 of the communication terminal B as a monitor screen M over time, compresses the information, and identifies the communication terminal B. A process of transmitting information to the management server A is performed. The operation log acquisition unit G includes execution (operation) of the communication terminal B, application execution, file operation, access to a shared folder, output to a printer, connection to the Internet, mail transmission, use of an external storage medium, etc. A process of acquiring a log as an operation log and transmitting it to the management server A is performed. The locate information acquisition unit H acquires the display positions of icons, folders, windows of applications being executed, etc. displayed on the desktop of the monitor 8 (monitor screen M) of the communication terminal B, The terminal identification information to be identified is attached and transmitted to the management server A.

  These processes by the monitor screen acquisition unit F, operation log acquisition unit G, and locate information acquisition unit H are closely related to the processes in the management server A, and will be described later together with the processes in the management server A.

  In particular, the monitor screen output unit X is configured by the monitor screen acquisition unit F and the monitor screen display unit P, and the operation is acquired by the operation log acquisition unit G, the operation log display unit T, and the extraction display unit U. A log output unit Y is configured.

[Details of communication terminal configuration]
<Monitor screen acquisition unit F>
The monitor screen acquisition unit F and the locate information acquisition unit H are configured as shown in FIG. That is, the monitor screen acquisition unit F includes a first timing setting unit 31 that sets an acquisition timing of the monitor screen M based on timing information, event information, and the like, and an image displayed on the monitor 8 of the communication terminal B as a video output unit. 21, the screen capture 32 acquired from the screen 21, the compression processing means 33 that compresses the monitor screen M acquired by the screen capture 32, the date and time information of the acquisition date and time and the communication terminal B for the compressed monitor screen M First information providing means 34 for providing identification information, and first transmission means 35 for sending the monitor screen M to which information is provided in this way to the communication network are provided.

  The timing information is information that is output at each preset timing based on the clock provided in the communication terminal B. By setting the timing interval short, the monitor screen M is continuously displayed in the same manner as a moving image. Can be obtained. The event information is output to determine the operation of opening a folder, accessing a file, executing an application, etc. in the communication terminal B, and acquiring the monitor screen M based on the determination of the operation. Refers to information.

  The screen capture 32 executes processing for acquiring information on the entire screen (entire desktop surface) of the monitor 8 as the monitor screen M at each timing set by the first timing setting means 31. The monitor screen M includes gradation information indicating the densities of the three primary colors R (red), G (green), and B (blue) for each pixel constituting the monitor screen M.

  The compression processing means 33 is a process for compressing the monitor screen M in order to reduce the information amount of the monitor screen M acquired by the screen capture 32. Specifically, a process of reducing the amount of information by processing such as dividing the image of the monitor screen M and quantizing based on discrete cosine transform, such as the JPEG format (a format established by the Joint Photographic Experts Group) Point to. The processing for reducing the information amount is not limited to the JPEG format, but may be a GIF (Graphics Interchange Format) format, a PNG (Portable Network Graphics) format, or the like.

The first information providing means 34 is unique information given in advance to the communication terminal B as date and time information of the acquisition date and time acquired from the calendar unit or the like of the communication terminal B and terminal identification information for specifying the communication terminal B. And the name of the user who operates this communication terminal B are acquired, and these are displayed on the monitor screen M.
To write to the header of the file. The first transmission means 35 performs processing to generate a packet from the monitor screen M passed from the compression processing means 33, the IP address of the management server A, the protocol, and the like and send it to the communication network.

<Locate information acquisition unit H>
The locate information acquisition unit H is a second timing setting means 41 for setting the acquisition timing of locate information based on the timing information, event information, etc., and a locate for acquiring the target location information displayed on the monitor 8 The information acquisition means 42, the locate information table 43 that stores the locate information acquired by the locate information acquisition means 42, the date and time information of the acquisition date and time, and the terminal identification information that identifies the communication terminal B are assigned to the locate information. Second information adding means 44 and second transmitting means 45 for sending the locate information to which information has been assigned in this way to the communication network are provided. The locate information acquisition unit H acquires all the processing target locate information displayed on the monitor 8 without associating it with the operation log, and generates (updates) the locate information table 43. This locate information May be set so as to be associated with the operation log acquired by the operation log acquisition unit G. As described above, in the processing mode for associating with the operation log, it is not necessary to store all the processing target locate information, and the processing for acquiring only the operated processing target locate information is realized.

  Since the timing information, event information, and the like given to the second timing setting means 41 are the same as those given to the first timing setting means 31, the timing at which the locate information obtaining unit H obtains the locate information is Synchronizes with the monitor screen acquisition unit F.

  The locate information acquisition means 42 stores locate information indicating the display position of a processing target such as an icon, a folder, a window of an application being executed, or the like displayed on the monitor 8 in the operating system 24. The process of obtaining from the located locate information area is performed. The locate information table 43 stores the acquired locate information as a table.

  The date and time information of the acquisition date and time given to the second information giving means 44 and the terminal identification information for specifying the communication terminal B are the same as those given to the first information giving means 34 described above. It is written in the header of the information file. The second transmitting unit 45 generates a packet based on the locate information delivered from the second information providing unit 44, and performs a process of generating a packet and sending it to the communication network.

  In this processing system, the processing form is set so that the location information and the monitor screen M are processed as different files and sent to the communication network. The location information and the monitor screen M are set as one file. In this way, the processing form may be set.

<Operation log acquisition unit G>
As shown in FIG. 5, the operation log acquisition unit G includes processing information acquisition means 51 that acquires the event information, processing target information, and active information for determining whether an application is active. The text data converting means 52 for converting the information acquired by the processing information acquiring means 51 into a character string meaning an operation log, and the date and time information of the acquisition date and time for the operation log from the text data converting means 52 A third information providing unit 53 that assigns terminal identification information that identifies the terminal B, and a third transmission unit 54 that sends the operation log to which the information has been assigned to the communication network are provided. The third transmission unit 54 performs a process of generating a packet and sending it to the communication network in the same manner as the first transmission unit 35.

[Details of Management Server configuration]
<Monitor screen display part P>
As shown in FIG. 6, the monitor screen display unit P includes a monitor screen receiving unit 61 that receives a monitor screen M transmitted through the communication network, and a decompression processing unit 62 that decompresses the received monitor screen M in a compressed state. The information access means 63 for recording the monitor screen M from the expansion processing means 62 on the hard disk HD or the semiconductor memory 13, and the monitor screen M recorded on the hard disk HD or the semiconductor memory 13 via the information access means 63. Output control means 64 for controlling the output to the management monitor 2, and output form setting means 65 for setting the output form of the output control means 64.

  The monitor screen receiving unit 61 receives the packet, obtains a monitor screen M in a compressed state, and performs processing to be given to the expansion processing unit 62. The expansion processing means 62 performs a process of expanding the compressed monitor screen M into a bitmap-format monitor screen M and giving it to the information access means 63.

  The information access means 63 shows a specific processing form of the screen recording unit Q, and the information access means 63 outputs the monitor screen M in the bitmap format given from the expansion processing means 62 as output control means. 64, a process for recording the bitmap-format monitor screen M on the hard disk HD or the semiconductor memory 13, and a monitor screen M read from the hard disk HD or the semiconductor memory 13 to the output control means 64. Process to give.

  The output control means 64 performs output (display) to the management monitor 2 based on the display position information set by the output form setting means 65 and the display size information. The output form setting means 65 acquires display position information and display size information that are automatically set when a plurality of monitor screens M are displayed on the management screen 100 as shown in FIG. Arbitrarily set display position information and display size information are acquired and given to the output control means 64. The output form setting means 65 has been set so that the management screen 100 is displayed on the management monitor 2 on the management server A side. Instead of this process, for example, a management terminal connected to the communication network is connected. In the network management system provided, the management screen 100 is displayed on the monitor of the management terminal (an example of a server-side management monitor), and a plurality of monitor screens M are displayed on the management screen 100. May be set.

  In this monitor screen display part P, the monitor screen M before performing the expansion process is recorded in the hard disk HD or the semiconductor memory 13 and the processing mode is set so that the expansion is performed when the output control means 64 outputs it. The timing of development, such as setting the processing form, may be any timing prior to display on the management monitor 2. Further, when the monitor screen M is displayed on the management screen 100, the operation status is displayed in real time by updating the monitor screen M at set intervals.

<Locate information setting unit R / determination unit S>
As shown in FIG. 6, the locate information setting unit R includes a locate information receiving means 71 for receiving locate information sent through the communication network, an information converting means 72 for performing coordinate conversion of the received locate information, and this information. A locating information table 73 for expanding and storing the locating information converted by the converting means 72 in an area corresponding to the management monitor 2 is provided.

  Further, the determination unit S includes the composite locate information table 73, position comparison means 74 for comparing the processing target with respect to the composite locate information table 73 and the designated position, and the position comparison means 74 from the mouse 4. And a designated position acquisition unit 75 that provides information based on the designation information to the position comparison unit.

  The locate information receiving unit 71 provides the information converting unit 72 with the locate information acquired by receiving the packet. The information conversion means 72 is arranged at a position to be displayed on the screen of the management monitor 2 based on the display position information and the display size information given from the output form setting means 65 of the monitor screen display section P. A process of recording in the synthetic locate information table 73 is performed. In the combined locate information table 73, in the situation where a plurality of monitor screens M are displayed on the management screen 100 in the management monitor 2 as shown in FIG. 13, the location information of the processing target included in each monitor screen M is recorded. Is done.

  The designated position acquisition means 75 performs a process of obtaining the position of the cursor on the screen of the management monitor 2 and giving it to the position comparison means 74, and this position comparison means 74 is a cursor position given from the designated position acquisition means 75. A comparison is made between the position and the processing target included in the monitor screen M of the communication terminal B recorded in the composite locate information table 73 and the designated position by the cursor. In contrast, if the operation log designation information is not matched, the operation log designation information is output. If the information does not match, it is determined that the operation log designation information is not selected, and no information is output (negative information may be output).

  The combined locating information table 73 records locating information to be processed included in a plurality of monitor screens M, but it is not necessary to correspond to the plurality of monitor screens M. When one of them is enlarged and displayed on the full screen of the management monitor 2, only the location information to be processed on one monitor screen M is recorded.

<Operation log display part T / Extraction display part U>
As shown in FIG. 7, the operation log display unit T includes an operation log receiving unit 81 that receives an operation log transmitted through the communication network, and an information access that records the received operation log in the hard disk HD or the semiconductor memory 13. A means 82, an output control means 83 for controlling the output of the operation log recorded in the hard disk HD or the semiconductor memory 13 to the management monitor 2 via the information access means 82, and an output based on the operation log designation information. Operation log collection means 84 for collecting power operation logs.

  Further, the extraction display unit U includes operation log extraction means 85 in addition to the configuration of the operation log display unit T.

  The operation log receiving unit 81 receives the packet, acquires an operation log, and performs processing to be given to the information access unit 82. The information access means 82 is a process for directly giving the given operation log to the output control means 83, a process for recording this operation log in the hard disk HD or the semiconductor memory 13, and an operation read from the hard disk HD or the semiconductor memory 13. A process of giving a log to the output control means 83 is performed.

  The output control unit 83 performs control to output the operation log designated by the operation log collection unit 84 or the operation log extraction unit 85 to the management monitor 2. The operation log collection unit 84 provides the output control unit 83 with operation log designation information based on the operation log designation information set by the administrator in the management server A or the operation log designation information output from the determination unit S. .

  The operation log extraction unit 85 performs a process of acquiring the extraction condition information and giving it to the output control unit 83.

[Management process]
As a basic process in the management server A, the management process can be shown as in the flowchart of FIG. That is, the communication terminal B connected to the communication network is specified, and the operation information of each communication terminal B is acquired (# 01 step).

  Next, the monitor screen M is recorded, and an operation log is recorded (steps # 02 and # 03). In this process, the monitor screen M and operation logs transmitted from a plurality of communication terminals B are recorded in the hard disk HD or the semiconductor memory 13.

  Next, the management screen 100 shown in FIG. 13 is displayed (# 100 step). When the screen playback button 101 is operated on this management screen 100, the monitor screen playback display is performed (# 04, # 200 steps). When the log browsing button 102 is operated on the management screen 100, an operation log list is displayed (steps # 05 and # 300). When the PC information button 103 is operated on the management screen 100, The PC information is displayed (steps # 06 and # 07). When the remote control button 104 is operated on the management screen 100, the remote control screen is displayed and the remote control is executed (# 08). , # 09 step). These controls are continued until reset (step # 10).

〔Management screen〕
On the management screen 100, the screen playback button 101, log viewing button 102, PC information button 103, remote control button 104, alert setting button 105, etc. are displayed in the upper position in the form of icons. A monitor screen display area 110, a message display section 111, and a terminal list display section 112 are formed. In FIG. 13, a plurality of monitor screens M are displayed in a form surrounded by a frame 120 with respect to the monitor screen display area 110, and an information display unit 121 is formed below the frame 120.

  The processing of steps # 100, # 200, and # 300 will be described later. In step # 07 described above, the PC information acquisition unit 15 overlaps the management screen 100 (overlapping state) with the PC information screen ( (Not shown) and the physical data of the communication terminal B, the name of the installed application, and the like are displayed on the PC information screen. As an example of a specific operation mode, the PC information button 103 is pressed while the monitor screen M of the communication terminal B displayed in the monitor screen display area 110 or the terminal list display unit 112 is selected with a cursor. By selecting and operating, the processing mode is set such that the information of the selected communication terminal B is acquired by the PC information acquisition unit 15 via the communication network and displayed on the PC information screen.

  In step # 09, when the remote control button 104 is operated, the remote control unit 16 displays a remote control screen (not shown) in an overlapping state (overlapping state) on the management screen 100. By setting specific processing of remote control on this remote control screen, remote control of the target communication terminal B is realized.

  As an example of a specific operation mode, the remote control button 104 is pressed while the monitor screen M of the communication terminal B displayed in the monitor screen display area 110 or the terminal list display unit 112 is selected with a cursor. By selecting and operating the selected communication terminal B, the communication network by the remote control unit 16 can be controlled by operating icons or executing commands on the remote control screen. Remote control of the communication terminal B is realized via this.

[Management screen display routine]
The management screen display (# 100 step) processing can be shown as a subroutine as shown in FIG. That is, the display information of the display position and the display size of the monitor screen M with respect to the monitor screen display area 110 is acquired, and the monitor screen M is displayed on the monitor screen display area 110 according to this display information (# 101, # 102). Step).

  In this way, when the monitor screen M is displayed in the monitor screen display area 110, information for specifying the communication terminal is displayed on the message display unit 111 below the frame 120 of the monitor screen M. As described above, the process of displaying the monitor screen M is a process in which the monitor screen acquisition unit F of the communication terminal B acquires the monitor screen M of the monitor 8 of the communication terminal B and transmits it to the communication network. The monitor screen display part P of the management server A displays the monitor screen M in the monitor screen display area 110.

  When a plurality of monitor screens M are displayed on the monitor screen display area 110, the output form setting means 65 displays the display information (display position information and display position information) of each monitor screen M as shown in step # 101. Display size information) is set, and according to these settings, the output form setting means 65 displays a plurality of monitor screens M in a form arranged at the set position as shown in # 102. In this way, when a plurality of monitor screens M are displayed, each monitor screen M is updated and displayed for each set interval.

  It is also possible to arbitrarily select one of the plurality of monitor screens M displayed in the monitor screen display area 110 and display it in an enlarged manner. When the enlarged display is performed in this way, the display When the information is changed and the monitor screen M is enlarged and displayed, the enlarged monitor screen M is updated and displayed every set interval.

  Next, based on the display information (display position information and display size information), the information conversion means 72 sets the synthetic locate information table 73 (step # 103). In this process, in addition to the locate information indicating the display position of the processing target such as the icon and the folder included in the desktop displayed on the management monitor 2 on the management server A side, the icons included in the management screen 100 are displayed. Locating information indicating a display position, and locating information indicating a display position of a processing target such as an icon, a folder, and a window of an application being executed included in the monitor screen M displayed in the monitor screen display area 110. It becomes a table of structure.

  As described above, when one of the plurality of monitor screens M displayed in the monitor screen display area 110 is arbitrarily selected and enlarged, the processing target included in the enlarged monitor screen M is displayed. The locate information is changed.

  Next, when the determination unit S determines that designation is performed by performing designation / non-designation with a cursor, an operation log is extracted and displayed (steps # 104, # 105, and # 400).

  As an example of specific processing, an example in which the cursor CU is operated on an enlarged monitor screen M as shown in FIG. 14 will be described. The monitor screen M includes an icon IC, a folder FL, and processing execution as processing targets. The application AP is displayed, and by making the cursor CU coincide with any one of these and performing an operation of clicking, the position where the cursor CU exists at the timing of the click and the synthetic locating information table 73 are set. When the location information of the processing target is compared and matched by the position comparison means 74 (if selected: the cursor position is included in the position (area) where the processing target exists), as shown in FIG. The operation log corresponding to the processing target is extracted and displayed on the operation log extraction screen 130.

  The specific contents of the operation log displayed on the operation log extraction screen 130 are the computer information and the time when the processing was performed, such as that displayed in the operation log display area 155 of the operation log display screen 150 in FIG. , Including information including the time of processing.

In step # 103, the locating information acquired by the locating information acquiring unit H is acquired by the locating information setting unit R and recorded in the combined locating information table 73. In steps # 104 and # 105, the determination unit S compares the position of the cursor CU with the position to be processed recorded in the composite locate information table 73. Information is output.

  The processing of operation log extraction display (step # 400) can be shown as a subroutine as shown in FIG.

  That is, the operation log designation information output from the position comparison means 74 is acquired, the operation log corresponding to this operation log designation information is extracted and displayed on the operation log extraction screen 130 (steps # 401 to # 403). This process is realized by the process of the extraction display unit U.

  The operation log designation information includes information for specifying the designated processing target and information indicating the designated timing. In step # 402, the operation log designation information up to this timing is determined based on the designated timing. By extracting information including progress information, the details of the operation up to the designated timing can be properly grasped.

  More specifically, for example, for an operation log extracted by specifying a folder displayed on the monitor screen M, the date and time when the folder was created is set as the start point of the operation log. Information such as the creation and update time of the file included in the file, the installation date and time of the application included in the folder, and the date and time when the application was executed is displayed as an operation log in the order of the date and time.

[Monitor screen display routine]
The monitor screen reproduction display (step # 200) process can be shown as a subroutine as shown in FIG.

  That is, information for specifying the communication terminal B is acquired, and the reproduction screen 140 shown in FIG. 15 is displayed, and information on the reproduction start and reproduction end is acquired on the reproduction screen 140 (steps # 201 to # 203).

  The process of identifying the communication terminal B as in step # 201 is performed before the operation of the screen playback button 101 by the communication terminal B displayed in the monitor screen display area 110 or the terminal list display unit 112. Although it is conceivable to select the monitor screen M with a cursor, when the screen playback button 101 is operated, a dialog box (not shown) is displayed and information identifying the communication terminal B is input from the keyboard 6 or the like. It is also possible.

  The playback screen 140 includes a calendar section 141, a playback start time input section 142, a playback end time input section 143, an OK button 144, a playback area 145, a plurality of playback control buttons 146, and a playback slider 147. I have.

  When the reproduction display of the monitor screen M is performed on the reproduction screen 140, the reproduction date (the date on which the monitor screen M is recorded) is selected by the cursor in the calendar unit 141, and the reproduction is started from the keyboard or the like in the reproduction start time input unit 142. After inputting the start time and inputting the playback end time from the keyboard or the like in the playback end time input unit 143, an operation of selecting and clicking the OK button 144 with the cursor is performed.

  After this operation is performed, the monitor screen M of the specified communication terminal B is continuously displayed in the playback mode set for the playback area 145 (step # 204).

  In this process, only the monitor screen M specified as described above is extracted from the monitor screen M recorded on the hard disk HD, and the playback start time and the playback end are extracted from the monitor screen M thus extracted. What is included in the time is further extracted and displayed in the reproduction area 145 in the recorded order. This playback mode is given as initial information. By selecting and operating the plurality of playback control buttons 146, the playback speed (the number of frames per unit time) can be adjusted, and playback can be stopped. It is also possible to set to a state (still state). Further, it is possible to jump the playback timing by operating the playback slider 147.

  Next, based on the display information (display position information and display size information), the information conversion means 72 sets the synthetic locate information table 73 (step # 205). In this process, in addition to the locate information indicating the display position of the processing target such as the icon and folder included in the desktop displayed on the management monitor 2 on the management server A side, the calendar unit 141 included in the reproduction screen 140 is displayed. Locating information indicating the display position of the playback start time input unit 142, etc., and processing of icons, folders, windows of applications being executed, etc. included in the monitor screen M displayed in the playback area 145 of the playback screen 140 This is a table having a structure including locate information indicating the display position of the object.

  Next, when the determination unit S determines that designation is made by designating / non-designating with the cursor, the process of extracting and displaying the operation log is executed (steps # 206, # 207, # 400). .

  As an example of specific processing, in the situation where the cursor CU is operated on the monitor screen M displayed in the reproduction area 145, the icon IC, the folder FL, and the application AP being executed are displayed on the monitor screen M as processing targets. By performing an operation of making the cursor CU coincide with any one of these and performing a click operation, the position where the cursor CU exists at the timing of this click and the location information of the processing target set in the locate information table are obtained. If they are compared and matched (if selected, the cursor position is included in the position (area) where the processing target exists), as shown in the figure, an operation log corresponding to the processing target is extracted, and the operation log It is displayed on the extraction screen 130.

  In step # 305, the locate information setting unit R acquires the locate information acquired by the locate information acquiring unit H and records it in the combined locate information table 73. In steps # 306 and # 307, the determination unit S compares the position of the cursor CU with the position to be processed recorded in the combined locate information table 73. Information is output. Further, the process of step # 400 is executed as described above.

[Operation log browsing routine]
The operation log browsing display (# 300 step) processing can be shown as a subroutine as shown in FIG.

  That is, when the log browsing button 102 is operated, the operation log display screen 150 shown in FIG. 16 is displayed, and information on the log to be displayed on the operation log display screen 150, display conditions, and the like are acquired (# 301). , # 302 step).

  The operation log display screen 150 includes a plurality of log type buttons 151, a target period input unit 152, a user information input unit 153, a keyword input unit 154, and an operation log display area 155.

  The log type button 151 includes a plurality of buttons such as start / stop indicating terminal start / stop information, user operation indicating user operation, application execution status, file access indicating file access information, and the like. By selecting the plurality of log type buttons 151 with the cursor CU, the operation log selected in the operation log display area 155 can be browsed. The operation log display area 155 includes information including computer information, processing time, processing time, login name, active / inactive status of processing target, execution command, and the like. Yes.

  The conditions for specifying the operation log to be displayed in this way are not limited to the log browsing button 102 described above. For example, information for specifying an application in an active state, an operation in which an error has occurred, and a risk. It may include an accompanying operation.

  The operation log displayed in the operation log display area 155 includes the computer name of the target communication terminal B, the date and time when the process was performed, the number of seconds when the process was performed, the login name, the type such as active or activated , Information such as a command when executed, an application name, and the like are included.

  The target period input unit 152 inputs a period for displaying the operation log, the user information input unit 153 inputs user information to be viewed in the operation log, and the keyword input unit 154 sets the target as a browsing target. Enter the operation log name. Information input in this way is acquired as display information.

  Instead of the operation of inputting information for specifying the communication terminal B, the communication terminal B displayed in the monitor screen display area 110 or the terminal list display unit 112 before operating the log browsing button 102 is displayed. The monitor screen M may be selected with a cursor.

  Next, operation logs corresponding to the display conditions are collected, and the collected operation logs are displayed in a list in the operation log display area 155. This process realizes a process in which the operation log collection unit 84 of the operation log display unit T controls the output control unit 83 according to the display condition information.

  Next, it is determined whether or not an operation log is selected by the cursor CU. If selected, a monitor screen M corresponding to the selected operation log is extracted, and a moving image is displayed on a newly displayed screen (not shown). And is continued until this process ends (steps # 305 to # 307). In this way, when displaying as a moving image, it is assumed that the playback screen 140 is used to perform playback display. However, the processing form is set so that the moving image is played back without using the playback screen 140. May be.

  In this operation log browsing display (step # 300), when no user condition is input, operation logs of all communication terminals B (all users) recorded on the hard disk HD are collected and an operation log display area is displayed. 155. Furthermore, by selecting one of a plurality of operation logs displayed in a list, the monitor screen M corresponding to the selected operation log is displayed like a moving image, so that the user when the operation log is collected is displayed. If it is possible to grasp the details of the operation form and visually grasp the processing related to the operation log, the monitor screen M can be made to be a moving image.

[Concept of the present invention]
Thus, in the present invention, the monitor screen M displayed on the monitors 8 of the plurality of communication terminals B is displayed on the monitor screen display area 110 of the management screen 100 displayed on the management monitor 2 on the management server A side. Thus, the system is configured so that operations performed in the communication terminal B can be visually grasped and managed in real time.

  The monitor screen M displayed on the management screen 100 of the management monitor 2 displays an icon IC, a folder FL, an application AP being processed, and the like. However, since these are acquired as image information, a GUI (Graphical The function of (User Interface) cannot be used. However, according to the present invention, the monitor screen M acquired as image information, the operation log, and the location information such as the icon IC, the folder FL, and the application AP being executed displayed on the monitor screen M are displayed. And the processing mode is set so as to determine the position of the cursor CU with respect to the monitor screen M displayed on the management monitor 2 based on the locate information. When you want to know the operation status of FL, processing application, etc., you can display the operation log corresponding to the processing target while using the GUI function effectively by matching the cursor CU It is made possible.

  As described above, the operation status of the processing target such as the icon IC, the folder FL, and the application AP being executed can be visually confirmed via the operation log. Even if it is desired to grasp the operation log, the operation log corresponding to the application is extracted and displayed only by operating the cursor. As a result, the management server A can be considered to be a risky operation or an illegal operation. Can be properly grasped and managed.

  This process is not limited to the monitor screen M displayed in real time on the monitor screen display area 110 of the management screen 100 as described above, and the monitor screens M of the monitors 8 of the plurality of communication terminals B are recorded over time. The same operation can be performed when the monitor screen M is displayed on the playback screen 140.

[Another embodiment]
The present invention may be configured as follows in addition to the embodiment described above.

(A) When a plurality of processing targets included in the monitor screen M are designated by the cursor CU, the operation log extraction screens 130 corresponding to the designated plurality of processing targets are displayed, and each operation log extraction screen is displayed. The operation log is displayed in parallel to 130.
By displaying a plurality of operation logs in parallel as described above, for example, when two documents are edited in parallel, it is possible to appropriately grasp the progress of editing each document data.

(B) Change the display color of the processing target specified by the cursor CU to the processing target included in the monitor screen M, and change the display color of the frame of the operation log extraction screen 130 that displays the operation log corresponding to this processing target, Match the hue to be processed after the change.
By setting the processing form in this way, the relationship between the processing target and the operation log can be easily grasped visually.

(C) When displaying the operation log, the risk of each operation log is determined. If the operation log is a high-risk operation, the display color of the operation log is changed or the operation is at risk. Set the display form to display the message to be revealed.
By setting the display form in this way, the presence or absence of risk can be easily grasped.

Diagram showing an overview of a communication network Block diagram showing basic configuration of network management system Block diagram showing the configuration of the management server and communication terminal Block diagram showing configurations of monitor screen acquisition unit and locate information acquisition unit Block diagram showing the configuration of the operation log acquisition unit Block diagram showing the configuration of the monitor screen display unit, locate information setting unit, etc. Block diagram showing the configuration of the operation log display and extraction display Management process flowchart Management screen display routine flowchart Monitor screen playback display routine flowchart Flow chart of operation log browsing display routine Operation log extraction display routine flowchart Figure showing the management screen Diagram showing the enlarged monitor screen and operation log extraction screen Diagram showing playback screen and operation log extraction screen Operation log display screen flowchart

Explanation of symbols

2 Management monitor 4 Pointing device (mouse)
8 Monitor (Communication terminal monitor)
72 Information conversion means 74 Position comparison means A Management server B Communication terminal F Monitor screen acquisition part G Operation log acquisition part H Locate information acquisition part M Monitor screen P Monitor screen display part S Determination part T Operation log display part U Extraction display part X Monitor screen output unit Y Operation log output unit HD Recording means (hard disk)

Claims (8)

A monitor screen output unit for acquiring a monitor screen of a communication terminal connected to the communication network and displaying it on a management monitor on the management server side of the communication network, and acquiring a user operation log in the communication terminal, and a communication network management server Network management system comprising an operation log output unit to be displayed on the management monitor on the side,
By comparing the display position of the processing target included in the monitor screen displayed on the management monitor by the monitor screen output unit and the designated position by the pointing device in the management monitor, the display position and the designated position are compared. And a determination unit that determines that the condition matches with the selection of the processing target,
The operation log output unit is a network management system including an extraction display unit that extracts and displays an operation log related to a processing target determined to be in a selected state by the determination unit. The monitor screen output unit acquires a monitor screen displayed on the monitor of the communication terminal at every predetermined timing, and attaches terminal identification information for identifying the communication terminal to the acquired monitor screen; ,
The monitor screen acquired by this monitor screen acquisition part is acquired via the said communication network, The monitor screen display part displayed based on the said terminal identification information with respect to the said management monitor is provided. Network management system. A recording means for recording a plurality of the monitor screens acquired over time in the monitor screen acquisition unit,
The monitor screen display unit continuously displays the plurality of monitor screens recorded in the recording unit over time on the management monitor,
The extraction display unit displays an operation log of the selected processing target when the determination unit determines that the processing target included in the monitor screen displayed on the management monitor is selected. The network management system described. The processing target includes an icon, a folder, and a window of an application being executed that are displayed on the desktop of the monitor screen,
The communication terminal includes a locate information acquisition unit that acquires locate information indicating a display position of the processing target on the desktop,
The determination unit obtains conversion locating information indicating the display position of the processing target on the management monitor by performing coordinate conversion on the locating information based on the display position and display size of the monitor screen on the management monitor. The network management according to any one of claims 1 to 3, further comprising a position comparison unit that includes an information conversion unit and compares a position specified by the pointing device with a position corresponding to the conversion locate information. system. The operation log output unit acquires the operation log with processing identification information for identifying the processing target in the communication terminal, and transmits the operation log to the management server via the communication network; and An operation log display unit that receives an operation log from the communication terminal in the management server and displays the operation log on the management monitor,
The extraction display unit displays only the operation log received by the operation log display unit, to which information for identifying the processing target determined to be in the selected state by the determination unit is displayed. The network management system as described in any one of Claims 1-4. A monitor screen output function for acquiring a monitor screen of a communication terminal connected to the communication network and displaying it on a management monitor on the management server side of the communication network, and a user operation log in the communication terminal are acquired, and a management server for the communication network Network management program for causing a computer to execute an operation log output function to be displayed on the management monitor on the side,
By comparing the display position of the processing target included in the monitor screen displayed on the management monitor by the monitor screen output function and the designated position by the pointing device in the management monitor, the display position and the designated position are compared. The computer is caused to execute a determination function for determining that the condition matches with the selection of the processing target,
The operation log output function is a network management program for causing a computer to execute an extraction display function for extracting and displaying an operation log related to a processing target determined to be selected by the determination function. A monitor screen output unit for acquiring a monitor screen of a communication terminal connected to a communication network and displaying it on a management monitor; an operation log output unit for acquiring a user operation log in the communication terminal and displaying it on the management monitor; A network management server comprising:
By comparing the display position of the processing target included in the monitor screen displayed on the management monitor by the monitor screen output unit and the designated position by the pointing device in the management monitor, the display position and the designated position are compared. And a determination unit that determines that the condition matches with the selection of the processing target,
The operation log output unit is a network management server including an extraction display unit that extracts and displays an operation log related to a processing target determined to be in a selected state by the determination unit. An operation log output program for causing a computer to execute an operation log output function for displaying a user operation log on a terminal on a management monitor,
The operation log output function is an operation log related to a selected processing target when a processing target displayed on the management monitor is selected in a situation where a monitor screen of the terminal is displayed on the management monitor. An operation log output program for causing a computer to execute an extraction display function for extracting and displaying the information on the management monitor.

Images