JP2009238034A - Operation log retrieval system and operation log retrieval program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide technology for efficiently and easily retrieving an operation log showing an operation in a terminal. <P>SOLUTION: This operation log retrieval system is provided with:an operation log management part 21 for acquiring and managing an operation log showing an operation in a terminal C; a screen information generation part 22 for acquiring screen information including an operation screen; an image display part 23 for displaying the operation screen, and for generating display information; a detection part 24 for detecting an instructing operation on the displayed operation screen, and for acquiring instruction information including instruction positions based on the instructing operation; a retrieval condition generation part 25 for generating retrieval conditions including retrieval positions based on the screen information, display information and instruction information; and an operation log extraction part 26 for extracting the operation log corresponding to the generated retrieval conditions from the operation log management part 21. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a technique for monitoring an operation at a terminal, and more particularly, to an operation log search technique representing an operation at a terminal.

  2. Description of the Related Art Conventionally, in order to monitor terminal operations and the like, operation logs representing operations at the terminals are acquired from the terminals. Usually, the acquired operation logs are accumulated and searched by an administrator as necessary to confirm the contents.

  As a technique for monitoring the operation of the terminal, there is a technique that uses a screen displayed on the monitor of the terminal. For example, in the technique of Patent Document 1, a remote control server and a client terminal are connected via a communication network, the remote control server receives access request information from the client terminal, and the client terminal displays image data displayed on a monitor. Is transmitted to the remote control server, and the remote control server displays the received image data on the monitor, and the captured image recording means of the remote control server records the screen of the client terminal as a captured image at a predetermined interval. After the recording, the captured image recorded by the reproducing means of the remote control server is reproduced.

  In this patent document 1, when image data transmitted from a plurality of client terminals is displayed on a monitor of a remote control server, the image data of each screen is reduced so that the plurality of image data can be viewed in a list. The display form is set.

JP-A-2006-108947 (paragraph numbers [0065] to [0077], [0095], [0096], FIGS. 1 to 5)

  As described above, in the method of accumulating and searching for operation logs, the administrator can obtain the necessary operation logs by visual search from the operation log list or by creating a search formula each time and searching. There must be. Therefore, the process becomes complicated, and in order to perform an accurate search using a search formula, it is necessary to be skilled in creating a search formula. Further, with the technique of Patent Document 1, it is possible to intuitively grasp the operation at the terminal from the image data, but it is not possible to grasp the details of the detailed operation.

  The subject of this invention is providing the technique which searches the operation log showing operation in a terminal efficiently and easily in view of the said actual condition.

  In order to solve the above-described problem, an operation log search system according to the present invention includes an operation log management unit that stores an operation log including position information related to an operation on a terminal, and screen information including an operation image representing an operation on the terminal. An operation log search system comprising: a screen information acquisition unit for acquiring an image display unit for displaying the operation image on a screen and generating display information of the operation image displayed on the screen; A detection unit that detects an instruction operation based on a user operation on the operation image displayed by the image display unit, and acquires instruction information including an instruction position based on the instruction operation; the screen information; the display information; A search condition generation unit that generates a search condition including a search position specified based on the instruction information, and an operation log corresponding to the search condition from the operation log management unit Has a, and operation log extraction unit that out.

  In this configuration, the instruction position is acquired based on the instruction operation performed on the displayed operation image. A search condition is generated from the acquired designated position, and an operation log corresponding to the search condition is extracted. That is, while grasping the outline of the operation from the operation image, specifying the operation position on the operation image, and simply indicating the position, an operation log having position information related to the indicated position is extracted. Detailed operation details can be grasped. In particular, by performing an instruction operation on a display object such as a window or icon displayed in the operation image, an operation log related to the position of the display object can be extracted. Logs can be extracted.

  In one preferred embodiment of the operation log search system of the present invention, the search condition further includes a search period specified based on the instruction information. Thereby, it is possible to perform a search including not only the position but also the concept of time. In particular, a configuration in which a search position and a search period can be specified based on an instruction operation is preferable because a search condition can be easily specified.

  Furthermore, in one of the preferable embodiments of the operation log search system of the present invention, the related information is generated from the operation log extracted by the operation log extraction unit, and the operation related to the operation log is based on the related information. A related operation log extraction unit that extracts logs from the operation log management unit is provided. As a result, after extracting an operation log based on an instruction operation, when an operation log to be noticed such as an illegal operation is found, an operation log related to the operation log can be easily searched. Yes.

  The technical features of the operation log search system according to the present invention described above can be applied to a similar operation log search program. For example, an operation log that causes a computer to realize an operation log management function that stores an operation log including position information related to an operation on a terminal and a screen information acquisition function that acquires screen information including an operation image representing an operation on the terminal. A search program that displays the operation image on a screen and generates display information of the operation image displayed on the screen, and a user on the operation image displayed by the image display function A detection function for detecting an instruction operation based on the operation of the user and acquiring instruction information including an instruction position based on the instruction operation; and a search condition including a search position specified based on the screen information, the display information, and the instruction information The search condition generation function for generating the operation log and the operation log corresponding to the search condition are managed by the operation log management function To realize the operation log extraction function of extracting from the work log, to the computer. Naturally, such an operation log search program can also obtain the effects described in the operation log search system described above, and can further incorporate the above-described additional technology.

[First Embodiment]
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings. In the operation log search system of the present invention, as shown in FIG. 1, a plurality of terminals C are connected to a management terminal S via a communication network (hereinafter referred to as a network) N. The network N is a CSMA / CD (Carrier Sense Multiple Access with Collision Detection) system including a cable for physically transmitting information in a limited facility such as a company or a school, and a relay device such as a LAN switch or a hub. Ethernet (trademark) type LAN, but this network N is constructed by an intranet using the Internet technology in addition to the Ethernet type LAN, or WAN (Wide Area Network) ).

  The management terminal S includes a general-purpose computer 1 and includes a display 2 and an input device 3 (keyboard 3a and mouse 3b). The terminal C includes a computer main body 4 to which a display 5 and an input device 6 (a keyboard 6a and a mouse 6b) are connected. Of course, instead of the mouse 3b functioning as a pointing device, a trackball, a tablet, or the like can be used, and a touch panel can be provided on the display 2, and the display 2 can be used as a pointing device. Furthermore, a cursor key or the like of the keyboard 3a may be used as a pointing device.

   FIG. 2 shows a functional block diagram of the management terminal S and terminal C constituting the operation log search system of the present invention. The terminal C generates an operation log representing various operations in the network I / F 10 and the terminal C for transmitting / receiving various information to / from the management terminal S and other terminals C via the network N, and transmits the operation log to the management terminal S The operation log generation unit 11 to generate, the screen information including the operation image representing the operation screen in the terminal C, the screen information generation unit 12 to be transmitted to the management terminal S, and the input from the input device 6 and the display 5 includes a GUI unit 13 that controls input / output to and from the computer 5.

  Usually, the operation log generation unit 11 and the screen information generation unit 12 execute the processing when the means (program, module, etc.) for executing the processing is read into the hardware, but these are combined with the hardware. It may be configured by only hardware that combines logic or the like.

  In the present embodiment, the operation log includes operation contents, terminal identification information, date and time information, and position information related to the operation, but may further include user identification information that can identify the user. Absent. The screen information includes an operation image representing an operation at the terminal C, the size of the operation image (in this embodiment, the width is W, the height is H), terminal identification information, and date / time information. Like the operation log, user identification information may be included. The user identification information can use a user name or a number assigned exclusively for each user. The terminal identification information is information that can uniquely identify the terminal C, and includes the terminal name, IP address, MAC An address, a unique number assigned exclusively to each terminal, or the like can be used. The operation log and the terminal identification information are not limited to these, and other information may be used as long as the object of the present invention is achieved. In the present embodiment, the position information related to the operation uses the coordinates clicked by the mouse 6b, the information of the area designated by the mouse 6b, the position information of the window to be operated, and the like. Position information such as buttons and menus included in the window can be included, but other information may be used as position information as long as the object of the present invention is achieved.

  The operation log generation unit 11 generates information representing various operations on the terminal C at a predetermined timing. In the present embodiment, the predetermined timing represents the timing at which the predetermined operation is performed and every predetermined interval, but is not limited to this, and other timings may be used. The generated operation log is transmitted to the management terminal S via the network I / F 10 and the network N.

  The screen information generation unit 12 generates an operation image representing an operation at the terminal C, and transmits it to the management terminal S as screen information together with the terminal identification information of the terminal C and date / time information regarding the date and time when the operation image was generated. The generation timing of the screen information by the screen information generation unit 12 may be synchronous or asynchronous with the operation log generation by the operation log generation unit 11.

  The management terminal S is transmitted from the terminal I, the network I / F 20 for transmitting / receiving various information to / from the terminal C via the network N, the operation log management unit 21 that acquires and stores the operation log transmitted from the terminal C, and the like. A screen information acquisition unit 22 for acquiring screen information, an image display unit 23 for displaying an operation image included in the screen information acquired by the screen information acquisition unit 22 on the display 2 and generating display information indicating a display form, The detection unit 24 that detects an instruction operation based on the user's operation on the operation image displayed by the display unit 23, generates the instruction information including the instruction position based on the instruction operation, and the screen acquired by the screen information acquisition unit 22 Information, the display information generated by the image display unit 23, and the search position specified based on the instruction information generated by the detection unit 24. A search condition generation unit 25 that generates a condition, an operation log extraction unit 26 that extracts an operation log corresponding to the search condition generated by the search condition generation unit 25 from an operation log managed by the operation log management unit 21, and an operation log A control unit 27 that performs predetermined control based on the operation log extracted by the extraction unit 26, and a GUI unit 30 that acquires input from the input device 3 and controls input / output with the display 2 are provided.

  Usually, the operation log management unit 21, the screen information acquisition unit 22, the image display unit 23, the detection unit 24, the search condition generation unit 25, the operation log extraction unit 26, and the control unit 27 are means for executing the processing (program or The processing is executed by reading the module etc. into the hardware, but these may be configured in combination with hardware, or may be configured only in hardware combining logic and the like.

  The operation log management unit 21 acquires and stores the operation log transmitted from the terminal C via the network I / F 20. Similarly, the screen information acquisition unit 22 acquires the screen information transmitted from the terminal C.

  The image display unit 23 acquires the screen information acquired by the screen information acquisition unit 22, displays an operation image included in the screen information on the display 2, and generates display information indicating a display form on the display 2. . In the present embodiment, the display information representing the display form is information representing the size and position of the operation image on the display 2. At this time, the image display unit 23 acquires the size of the operation image and the terminal identification information of the terminal on which the operation image is generated from the screen information, and passes it to the search condition generation unit 25.

  The detection unit 24 detects an instruction operation on the operation image displayed by the screen display unit 23 based on a user (administrator) operation, and generates instruction information including an instruction position based on the instruction operation. In the present embodiment, the instruction operation is an operation of instructing a position on the operation screen by a pointing device such as the mouse 3a or an input device of the keyboard 3a and instructing to search an operation log operated at the indicated position. Yes, for example, a click (point instruction) with the mouse 3b, or an area instruction by area designation. It is also possible to expand the clicked point according to the click time (the time from the button press of the mouse 3b to the button release) and handle it as an area instruction. In addition, when a pointing device capable of detecting writing pressure such as a tablet is used instead of the mouse 3b, it is possible to detect an area instruction using writing pressure instead of the click time.

  The search condition generation unit 25 includes a search including the screen information displayed by the screen display unit 23, the display information generated by the screen display unit 23, and the position information specified based on the instruction information generated by the detection unit 24. Generate a condition. Specifically, the size of the operation image included in the screen information is acquired from the screen display unit 23, and the position and size of the operation image displayed on the display 2 are acquired from the screen display unit 23. Further, the coordinate value of the designated position as the instruction information is acquired from the detection unit 24. At this time, based on the size of the operation image and the position and size of the displayed operation image, the search condition generation unit 25 sets the coordinate value of the indicated position as the instruction information as the coordinate value on the display 2 on the operation image. The position indicated in the operation image is specified from the position indicated on the display 2, and the position is set as the search position. Then, a search condition is generated from the search position and terminal identification information acquired from the screen information.

  The operation log extraction unit 26 extracts an operation log corresponding to the search condition generated by the search condition generation unit 25 from the operation log management unit 21. Specifically, the operation log extraction unit 26 is an operation log having the same terminal identification information as the terminal identification information included in the search condition from the operation log managed by the operation log management unit 21, and the search An operation log having position information corresponding to the search position included in the condition is extracted. In the present embodiment, the operation log having position information corresponding to the search position is that the search position is included in the position information (in the case of a region) when the search position is a point and the search position matches the position information. This is the case. Further, when the search position is an area, it means a case where all or part of the position information is included in the search position. That is, the position information includes the search position, the search position includes the position information, and one is not included in the other, but the position information and the search position have overlapping regions. If the search position does not include position information and the position information is related to the operation target window, an operation log related to the entire window may be extracted, a button included in the search position, Only operation logs related to overlapping areas or the like may be extracted. Of course, as long as the object of the present invention is achieved, another positional relationship may be the correspondence relationship between the search position and the positional information.

  The control unit 27 performs predetermined control according to the operation log extracted by the operation log extraction unit 26. As the predetermined control in the present embodiment, it is possible to use a list display of extracted operation logs, a display of the number of operation logs, a display of whether or not operation logs can be extracted, or a notification of these information. However, the present invention is not limited to this, and other controls may be performed.

  Next, the processing flow of the present embodiment will be described using the flowchart of FIG. Although not described in the processing flow, it is assumed that the operation log acquired from the terminal C is sequentially acquired and stored by the operation log management unit 21.

First, screen information including an operation image is generated by the screen information generation unit 12 of the terminal C, and acquired by the screen information acquisition unit 22 (# 01). The operation image included in the acquired screen information is displayed on the display 2 of the management terminal S by the screen display unit 23 via the GUI unit 30 (# 02). At this time, display information corresponding to the display form of the operation image is generated (# 03). FIG. 4 is an example of a display screen by the screen display unit 23. The display screen 41 includes operation images 42a, 42b, 42c and 42d included in the screen information acquired from the four terminals C. At this time, display information for each operation image is generated. For example, the display information of the operation image 42a is, w, h, given as x _1, y _1. This display information means that the width of the operation image on the display 2 is w, the height is h, and the coordinates of the upper left corner are (x ₁ , y ₁ ). Similarly, display information 42d operation image is w, h, and x _4, y _4. In this example, the display size of all the operation images is the same, but the size of the operation image may be different for each terminal C. In addition, a configuration in which a specific operation image can be enlarged and displayed as appropriate may be used. In this case, the display information is regenerated as the display form is changed.

  In this way, the administrator performs various operations on the operation image displayed on the display 2. If the detection unit 24 determines that this operation is an instruction operation (Yes branch of # 04), instruction information is generated based on this instruction operation (# 05). As described above, the instruction operation is a click or area designation with the mouse 3b, and the instruction information includes the clicked coordinates when the instruction operation is click, and the upper left corner and lower right corner of the area when the area is designated. This is the indicated position such as the coordinates.

The search condition generation unit 25 is specified based on the screen information related to the operation image 42 displayed by the screen display unit 23, the display information generated by the screen display unit 23, and the instruction information generated by the detection unit 24. A condition is generated (# 06). For example, FIG. 5 shows a state in which the operation image 42a is clicked by the administrator on the display screen of FIG. At this time, the acquired screen information by the screen information acquisition unit 22, an operation W and H is obtained as the size of the image 42a, w as the display information generated by the screen data generating unit, h, x _1, y ₁ And (x _p , y _p ) is obtained as the instruction information generated by the detection unit 24. At this time, the operation condition generation unit 25 searches for the search position (x _s , y _s ) obtained by converting the coordinates obtained as the instruction information using these pieces of information into the coordinates on the display 5 of the terminal C. Generate as a condition. _{That, x s = W × (x} p -x 1) / w, a _{y s = H × (y p} -y 1) / h. When the instruction operation is area designation, the area defined based on the two coordinates obtained by the above-described coordinate conversion is the search position with respect to the coordinates of the upper left corner and lower right corner according to area designation. The search position obtained in this way is passed to the operation log extraction unit 26 as a search condition. In the configuration in which operation images of a plurality of terminals C are simultaneously displayed as in the present embodiment, the search condition includes the terminal identification information of the terminal C from which the instructed operation image is generated.

  The operation log extraction unit 26 that has acquired the search condition generated by the search condition generation unit 25 extracts an operation log corresponding to the search condition from the operation log management unit 21 (# 07). Specifically, the operation log extraction unit 26 is an operation log having the same terminal identification information as the terminal identification information included in the search condition from the operation log managed by the operation log management unit 21, and the search An operation log having position information corresponding to the search position included in the condition is extracted.

  The control unit 27 displays the operation log extracted by the operation log extraction unit 26 on the display 2 via the GUI unit 30 (# 08). As a display form by the control unit 27, in addition to displaying a detailed operation log, only the presence or absence of the corresponding operation log can be displayed.

[Second Embodiment]
Next, a second embodiment of the operation log search system of the present invention will be described. This embodiment is different from the first embodiment in that a search period is included in the search condition. Since the functional block diagram and the flowchart are the same as those of the first embodiment, the description of the same parts is omitted.

  In the present embodiment, the detection unit 24 generates not only coordinate information but also time information as instruction information based on the instruction operation (# 05). The time information is information generated by an instruction operation to obtain a period for extracting the operation log, and can be generated from the click time of the mouse 3b, the writing pressure of a tablet or the like. For example, a longer period can be used as time information as the click time is longer or the writing pressure is stronger. In this case, the time information can specify a past time starting from the date and time information acquired from the screen information that included the displayed operation image. In the case of a configuration using screen information recorded as will be described later, the end of the period can be set as the future. With this configuration, since coordinate information and time information can be input with a single operation, convenience can be improved, which is preferable. However, the present invention is not limited to such a method. For example, a method of displaying a slider together with an operation image, specifying a period by operating the slider, displaying an operation image of a single terminal C in time series, and specifying a period by specifying a plurality of operation images. A method or the like may be used. When these methods are used, two arbitrary time points can be designated. Of course, the method of generating time information is not limited to these, and other methods may be used as long as the object of the present invention is achieved.

  The search condition generation unit 25 that has acquired the instruction information generates a search position as in the first embodiment, and also generates a search period that is defined based on time information included in the instruction information, and uses it as a search condition. (# 06).

  The operation log extraction unit 26 extracts an operation log corresponding to the search condition generated by the search condition generation unit 25 from the operation log management unit 21 (# 07). In the present embodiment, the search condition includes a search period in addition to the search position of the first embodiment. Accordingly, the operation log is extracted by the search period in addition to the extraction method of the first embodiment. Specifically, an operation log having the same terminal identification information as the terminal identification information of the search condition, the position information corresponding to the search position of the search condition, and the date / time information included in the search period of the search condition is extracted. The

  Thus, in the present embodiment, not only the position but also the period can be used as the search condition, and a more accurate operation log search can be performed. Moreover, since the position and the period can be specified by one operation by using the click time, the writing pressure, or the like as the period specifying method, the convenience of the manager can be improved.

[Third Embodiment]
Next, a third embodiment of the operation log search system of the present invention will be described. FIG. 6 is a functional block diagram of the present embodiment, which differs from the first and second embodiments in that it includes a related operation log extraction unit 28.

  The related operation log extraction unit 28 has a function of extracting an operation log related to the operation log extracted by the operation log extraction unit 26. Normally, the related operation log extraction unit 28 executes the processing by reading the means (program, module, etc.) for executing the processing into hardware, but these may be configured by a combination with hardware. It may be configured only by hardware combining logic or the like.

  FIG. 7 is a flowchart showing a flow of processing in which the related operation log extraction unit 28 extracts a related operation log. First, an operation log is extracted by the processing of the first or second embodiment, and the extracted operation log is transferred to the related operation log extraction unit 28 (# 11).

  The related operation log extraction unit 28 that has acquired the operation log generates related information based on the acquired operation log (# 12). As related information, various pieces of information included in the operation log such as file identification information that is an operation target, an application that executes the operation, and information on the date and time when the operation was performed can be used. Generation of related information may be configured to be automatically set based on the acquired operation log, and a dialog or the like for inputting which item is used as related information is displayed, and an administrator or the like is allowed to specify an item. The related information may be generated from the acquired operation log in accordance with the item that has been set.

  The related operation log extraction unit 28 that has generated the related information as described above extracts the operation log corresponding to the related information from the operation log management unit 21 (# 13). At this time, instead of the operation log recorded and managed in the operation log management unit 21, the operation log extracted in # 07 may be extracted. In this case, the operation log is narrowed down.

  In this embodiment, with this configuration, when a notable operation log is searched, an operation log related to the operation log can be further searched. Search is possible.

[Another embodiment]
(1) In the above embodiment, the operation image included in the screen information acquired by the screen information acquisition unit 22 is displayed as it is. However, the screen information is recorded in a screen information recording unit (not shown). Alternatively, the recorded operation image may be acquired by the screen information acquisition unit 22 and displayed on the display 2 by the image display unit 23. In this case, the date information included in the image information is transferred from the image display unit 23 to the search condition generation unit 25, and the search condition generation unit 25 generates a search condition including the date information. Then, the operation log extraction unit 26 extracts an operation log based on a search condition including date and time information when the operation log is extracted. That is, the operation log extracting unit 26 includes the same terminal identification information as the terminal identification information included in the search condition, has date information for a predetermined period from the date information included in the search condition, and stores position information corresponding to the search position. Extract the operation log that you have.

(2) In the above-described embodiment, the operation log search system of the present invention is configured by the terminal C and the management terminal S. However, the present invention is not limited to such a configuration, and various configurations are adopted. Can do. For example, FIG. 8 shows a stand-alone system composed only of the terminal C. By providing all the functional units of the management terminal S in the terminal C, the operation log can be searched in the terminal C. In this case, it is not necessary to include terminal identification information in the operation log, search condition, and the like.

  FIG. 9 shows an example of a system in which the arrangement of the functional units of the terminal C and the management terminal S is changed. In this configuration, the terminal C includes an operation log generation unit 11, an operation log management unit 21, an operation log extraction unit 26, a screen information generation unit 12, and a screen information management unit 22 ′. The screen information management unit 22 ′ has a function of recording and managing the screen information generated by the screen information generation unit 12. On the other hand, the management terminal S includes an image display unit 23, a detection unit 24, a search condition generation unit 25, and a control unit 27. In this case, the operation log and screen information are generated and recorded and managed by the terminal C, and the operation log is also extracted by the terminal C. In this configuration, since the management terminal S only performs screen display, search condition generation, and the like, the load on the management terminal S can be reduced.

  Furthermore, as shown in FIG. 10, it is possible to adopt a configuration in which a server is added in addition to the terminal C and the management terminal S. In this configuration, an operation log management unit 21, a screen information management unit 22 ′, and an operation log extraction unit 26 are provided in the server. With such a configuration, it is possible to reduce the load on the terminal C and the management terminal S and improve the performance of the entire system.

(3) In the above embodiment, the search is performed based on the terminal identification information. However, as described above, the user identification information is included in the operation log and the screen information, and the user identification information is used instead of the terminal identification information. It is also possible to perform a search based on this.

System configuration diagram of operation log search system according to the present invention The functional block diagram in 1st Embodiment of the operation log search system by this invention The flowchart showing the flow of the process in 1st Embodiment of the operation log search system by this invention. Example of display screen of operation log search system according to the present invention Example of instruction operation of operation log search system according to the present invention Functional block diagram of the third embodiment of the operation log search system according to the present invention. The flowchart showing the flow of the process of the related operation information extraction in 3rd Embodiment of the operation log search system by this invention. Functional block diagram of the operation log search system of the present invention configured as a stand-alone type Functional block diagram in another embodiment of the operation log search system of the present invention Functional block diagram in another embodiment of the operation log search system of the present invention

Explanation of symbols

S: Management terminal C: Terminal 10, 20: Network I / F
11: Operation log generation unit 12: Screen information generation unit 13, 30: GUI unit 21: Operation log management unit 22: Screen information acquisition unit 23: Image display unit 24: Detection unit 25: Search condition generation unit 26: Operation log extraction Unit 27: Control unit

  The present invention relates to a technique for monitoring an operation at a terminal, and more particularly, to an operation log search technique representing an operation at a terminal.

  2. Description of the Related Art Conventionally, in order to monitor terminal operations and the like, operation logs representing operations at the terminals are acquired from the terminals. Usually, the acquired operation logs are accumulated and searched by an administrator as necessary to confirm the contents.

  As a technique for monitoring the operation of the terminal, there is a technique that uses a screen displayed on the monitor of the terminal. For example, in the technique of Patent Document 1, a remote control server and a client terminal are connected via a communication network, the remote control server receives access request information from the client terminal, and the client terminal displays image data displayed on a monitor. Is transmitted to the remote control server, and the remote control server displays the received image data on the monitor, and the captured image recording means of the remote control server records the screen of the client terminal as a captured image at a predetermined interval. After the recording, the captured image recorded by the reproducing means of the remote control server is reproduced.

  In this patent document 1, when image data transmitted from a plurality of client terminals is displayed on a monitor of a remote control server, the image data of each screen is reduced so that the plurality of image data can be viewed in a list. The display form is set.

JP-A-2006-108947 (paragraph numbers [0065] to [0077], [0095], [0096], FIGS. 1 to 5)

  As described above, in the method of accumulating and searching for operation logs, the administrator can obtain the necessary operation logs by visual search from the operation log list or by creating a search formula each time and searching. There must be. Therefore, the process becomes complicated, and in order to perform an accurate search using a search formula, it is necessary to be skilled in creating a search formula. Further, with the technique of Patent Document 1, it is possible to intuitively grasp the operation at the terminal from the image data, but it is not possible to grasp the details of the detailed operation.

  The subject of this invention is providing the technique which searches the operation log showing operation in a terminal efficiently and easily in view of the said actual condition.

In order to solve the above-described problem, an operation log search system according to the present invention is configured such that a management terminal and a managed terminal are connected via a network, and the management terminal represents an operation in the managed terminal. acquiring an operation log management unit that acquires store operation logs including location information on the operation on the screen of a screen information including the size of the operation image and the operation image representing the screen of the operation in the managed terminal An operation log search system for searching an operation log including predetermined position information , wherein the operation image is displayed on the screen of the management terminal on the management terminal, and the management is performed. an image display unit for generating display information indicating the operation position and size in relation to the standard point of the image on the screen of the terminal, the field of the management terminal by the image display unit A detector Oite user detects the instruction operation for specifying a predetermined point or area, to obtain the instruction information including the coordinates or the region indicates the point on the displayed operation picture to the screen information, wherein Based on display information and the instruction information, a search condition for searching the operation log by converting the coordinates or the area on the screen of the management terminal to the coordinates or area on the screen of the managed terminal A search condition generation unit that generates the operation log, and an operation log extraction unit that extracts an operation log having position information corresponding to the search condition from the operation log management unit.

  In this configuration, the instruction position is acquired based on the instruction operation performed on the displayed operation image. A search condition is generated from the acquired designated position, and an operation log corresponding to the search condition is extracted. That is, while grasping the outline of the operation from the operation image, specifying the operation position on the operation image, and simply indicating the position, an operation log having position information related to the indicated position is extracted. Detailed operation details can be grasped. In particular, by performing an instruction operation on a display object such as a window or icon displayed in the operation image, an operation log related to the position of the display object can be extracted. Logs can be extracted.

In one preferred embodiment of the operation log search system of the present invention, an operation log that represents an operation at the terminal and stores an operation log including position information related to the operation on the terminal screen is displayed on the terminal. A management unit, an operation image representing an operation screen on the terminal, a screen information recording unit that records screen information including the size of the operation image, and a screen information acquisition unit that acquires the screen information from the screen information recording unit And an operation log search device for searching an operation log including the predetermined position information, wherein the acquired operation image is displayed on the screen on the terminal, and a reference for the operation image on the screen is displayed. An image display unit that generates display information indicating the position and size of the point, and the user displays a predetermined point or point on the operation image displayed on the screen by the image display unit. Detecting an instruction operation to specify a range, a detection unit for acquiring instruction information including the coordinates or the region indicates the point, the screen information based on the display information and the instruction information, on the screen of the terminal A search condition generation unit that generates a search condition for searching the operation log by converting the coordinate or the area into a coordinate or area on the acquired operation image, and an operation log corresponding to the search condition An operation log extraction unit that extracts from the operation log management unit.

In one preferred embodiment of the operation log search system of the present invention, a management terminal and a managed terminal are connected via a network, and the managed terminal represents an operation in the managed terminal, An operation log management unit for storing an operation log including position information related to the operation on the screen of the managed terminal, an operation image representing the operation screen on the managed terminal, and screen information including the size of the operation image. A screen information management unit for storing, and an operation log search system for searching an operation log including the predetermined position information, displaying the operation image on the screen of the management terminal on the management terminal, An image display unit that generates display information indicating a position and a size of a reference point of the operation image on the screen of the management terminal, and the image display unit A detection unit that detects an instruction operation in which a user designates a predetermined point or area on the operation image displayed on the screen, and acquires instruction information including coordinates indicating the point or the area; and the screen information and the display Based on the information and the instruction information, the search condition for searching the operation log is generated by converting the coordinate or the area on the screen of the management terminal into the coordinate or the area on the screen of the managed terminal. And an operation log extraction unit that extracts, from the operation log management unit, an operation log having position information corresponding to the search condition.

In one preferred embodiment of the operation log search system of the present invention, a server, a management terminal, and a managed terminal are connected via a network, and the server represents an operation in the managed terminal. An operation log management unit that acquires and stores an operation log including position information related to the operation on the screen of the managed terminal, an operation image representing the operation screen on the managed terminal, and screen information including the size of the operation image An operation log search system that searches for an operation log including the predetermined position information, and displays the operation image on a screen of the management terminal. An image display unit for generating display information indicating the position and size of a point serving as a reference for the operation image on the screen of the management terminal, and the tube by the image display unit. A detection unit that detects an instruction operation in which a user designates a predetermined point or region on an operation image displayed on a screen of a terminal and acquires instruction information including coordinates indicating the point or the region; and the screen information; Search for searching the operation log by converting the coordinates or the area on the screen of the managed terminal to the coordinates or area on the screen of the managed terminal based on the display information and the instruction information A search condition generation unit that generates a condition, and an operation log extraction unit that extracts, from the operation log management unit, an operation log having position information corresponding to the search condition.

In one preferred embodiment of the operation log search system of the present invention, the operation log includes date and time information related to the operation, the search condition is further determined based on the instruction operation , and the date and time information Includes a search period for searching operation logs . Thereby, it is possible to perform a search including not only the position but also the concept of time. In particular, a configuration in which a search position and a search period can be specified based on an instruction operation is preferable because a search condition can be easily specified.

Furthermore, in one preferred embodiment of the operation log search system of the present invention, at least one of the information included in the operation log extracted by the operation log extraction unit is generated as related information, and the related information is As an extraction condition, an operation log related to the operation log is extracted from the operation log management unit. As a result, after extracting an operation log based on an instruction operation, when an operation log to be noticed such as an illegal operation is found, an operation log related to the operation log can be easily searched. Yes.

The technical features of the operation log search system according to the present invention described above can be applied to a similar operation log search program. For example, represents the operation in the managed terminal, said the operation log management function of acquiring store operation logs including location information on the operation of the managed terminal screen, operation image representing the screen of the operation in the managed terminal And a screen information acquisition function for acquiring screen information including the size of the operation image, and an operation log search program for searching for an operation log including the predetermined position information. and displays the image on the screen of the management terminal, and an image display function of generating display information indicating the position and size in relation to the standard in terms of the operation image on the screen of the management terminal, the management by the image display unit On the operation image displayed on the terminal screen, the user detects an instruction operation for designating a predetermined point or region, and includes the coordinates or the region indicating the point. A detection function of obtaining indication information, the screen information based on the display information and the instruction information, the coordinates or the area on the screen of the management terminal to the coordinates or area on the screen of said managed terminal A search condition generation function for generating a search condition for converting and searching the operation log, and an operation log having position information corresponding to the search condition are extracted from the operation log managed by the operation log management function An operation log extraction function is realized on a computer. Naturally, such an operation log search program can also obtain the effects described in the operation log search system described above, and can further incorporate the above-described additional technology.

[First Embodiment]
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings. In the operation log search system of the present invention, as shown in FIG. 1, a plurality of terminals C are connected to a management terminal S via a communication network (hereinafter referred to as a network) N. The network N is a CSMA / CD (Carrier Sense Multiple Access with Collision Detection) system including a cable for physically transmitting information in a limited facility such as a company or a school, and a relay device such as a LAN switch or a hub. Ethernet (trademark) type LAN, but this network N is constructed by an intranet using the Internet technology in addition to the Ethernet type LAN, or WAN (Wide Area Network) ).

  The management terminal S includes a general-purpose computer 1 and includes a display 2 and an input device 3 (keyboard 3a and mouse 3b). The terminal C includes a computer main body 4 to which a display 5 and an input device 6 (a keyboard 6a and a mouse 6b) are connected. Of course, instead of the mouse 3b functioning as a pointing device, a trackball, a tablet, or the like can be used, and a touch panel can be provided on the display 2, and the display 2 can be used as a pointing device. Furthermore, a cursor key or the like of the keyboard 3a may be used as a pointing device.

FIG. 2 shows a functional block diagram of the management terminal S and terminal C constituting the operation log search system of the present invention. The terminal C generates an operation log representing various operations in the network I / F 10 and the terminal C for transmitting / receiving various information to / from the management terminal S and other terminals C via the network N, and transmits the operation log to the management terminal S The operation log generation unit 11 to generate, the screen information including the operation image representing the operation screen in the terminal C, the screen information generation unit 12 to be transmitted to the management terminal S, and the input from the input device 6 and the display 5 includes a GUI unit 13 that controls input / output to and from the computer 5.

  Usually, the operation log generation unit 11 and the screen information generation unit 12 execute the processing when the means (program, module, etc.) for executing the processing is read into the hardware, but these are combined with the hardware. It may be configured by only hardware that combines logic or the like.

  In the present embodiment, the operation log includes operation contents, terminal identification information, date and time information, and position information related to the operation, but may further include user identification information that can identify the user. Absent. The screen information includes an operation image representing an operation at the terminal C, the size of the operation image (in this embodiment, the width is W, the height is H), terminal identification information, and date / time information. Like the operation log, user identification information may be included. The user identification information can use a user name or a number assigned exclusively for each user. The terminal identification information is information that can uniquely identify the terminal C, and includes the terminal name, IP address, MAC An address, a unique number assigned exclusively to each terminal, or the like can be used. The operation log and the terminal identification information are not limited to these, and other information may be used as long as the object of the present invention is achieved. In the present embodiment, the position information related to the operation uses the coordinates clicked by the mouse 6b, the information of the area designated by the mouse 6b, the position information of the window to be operated, and the like. Position information such as buttons and menus included in the window can be included, but other information may be used as position information as long as the object of the present invention is achieved.

  The operation log generation unit 11 generates information representing various operations on the terminal C at a predetermined timing. In the present embodiment, the predetermined timing represents the timing at which the predetermined operation is performed and every predetermined interval, but is not limited to this, and other timings may be used. The generated operation log is transmitted to the management terminal S via the network I / F 10 and the network N.

  The screen information generation unit 12 generates an operation image representing an operation at the terminal C, and transmits it to the management terminal S as screen information together with the terminal identification information of the terminal C and date / time information regarding the date and time when the operation image was generated. The generation timing of the screen information by the screen information generation unit 12 may be synchronous or asynchronous with the operation log generation by the operation log generation unit 11.

  The management terminal S is transmitted from the terminal I, the network I / F 20 for transmitting / receiving various information to / from the terminal C via the network N, the operation log management unit 21 that acquires and stores the operation log transmitted from the terminal C, and the like. A screen information acquisition unit 22 for acquiring screen information, an image display unit 23 for displaying an operation image included in the screen information acquired by the screen information acquisition unit 22 on the display 2 and generating display information indicating a display form, The detection unit 24 that detects an instruction operation based on the user's operation on the operation image displayed by the display unit 23, generates the instruction information including the instruction position based on the instruction operation, and the screen acquired by the screen information acquisition unit 22 Information, the display information generated by the image display unit 23, and the search position specified based on the instruction information generated by the detection unit 24. A search condition generation unit 25 that generates a condition, an operation log extraction unit 26 that extracts an operation log corresponding to the search condition generated by the search condition generation unit 25 from an operation log managed by the operation log management unit 21, and an operation log A control unit 27 that performs predetermined control based on the operation log extracted by the extraction unit 26, and a GUI unit 30 that acquires input from the input device 3 and controls input / output with the display 2 are provided.

  Usually, the operation log management unit 21, the screen information acquisition unit 22, the image display unit 23, the detection unit 24, the search condition generation unit 25, the operation log extraction unit 26, and the control unit 27 are means for executing the processing (program or The processing is executed by reading the module etc. into the hardware, but these may be configured in combination with hardware, or may be configured only in hardware combining logic and the like.

  The operation log management unit 21 acquires and stores the operation log transmitted from the terminal C via the network I / F 20. Similarly, the screen information acquisition unit 22 acquires the screen information transmitted from the terminal C.

  The image display unit 23 acquires the screen information acquired by the screen information acquisition unit 22, displays an operation image included in the screen information on the display 2, and generates display information indicating a display form on the display 2. . In the present embodiment, the display information representing the display form is information representing the size and position of the operation image on the display 2. At this time, the image display unit 23 acquires the size of the operation image and the terminal identification information of the terminal on which the operation image is generated from the screen information, and passes it to the search condition generation unit 25.

  The detection unit 24 detects an instruction operation on the operation image displayed by the screen display unit 23 based on a user (administrator) operation, and generates instruction information including an instruction position based on the instruction operation. In the present embodiment, the instruction operation is an operation of instructing a position on the operation screen by a pointing device such as the mouse 3a or an input device of the keyboard 3a and instructing to search an operation log operated at the indicated position. Yes, for example, a click (point instruction) with the mouse 3b, or an area instruction by area designation. It is also possible to expand the clicked point according to the click time (the time from the button press of the mouse 3b to the button release) and handle it as an area instruction. In addition, when a pointing device capable of detecting writing pressure such as a tablet is used instead of the mouse 3b, it is possible to detect an area instruction using writing pressure instead of the click time.

  The search condition generation unit 25 includes a search including the screen information displayed by the screen display unit 23, the display information generated by the screen display unit 23, and the position information specified based on the instruction information generated by the detection unit 24. Generate a condition. Specifically, the size of the operation image included in the screen information is acquired from the screen display unit 23, and the position and size of the operation image displayed on the display 2 are acquired from the screen display unit 23. Further, the coordinate value of the designated position as the instruction information is acquired from the detection unit 24. At this time, based on the size of the operation image and the position and size of the displayed operation image, the search condition generation unit 25 sets the coordinate value of the indicated position as the instruction information as the coordinate value on the display 2 on the operation image. The position indicated in the operation image is specified from the position indicated on the display 2, and the position is set as the search position. Then, a search condition is generated from the search position and terminal identification information acquired from the screen information.

  The operation log extraction unit 26 extracts an operation log corresponding to the search condition generated by the search condition generation unit 25 from the operation log management unit 21. Specifically, the operation log extraction unit 26 is an operation log having the same terminal identification information as the terminal identification information included in the search condition from the operation log managed by the operation log management unit 21, and the search An operation log having position information corresponding to the search position included in the condition is extracted. In the present embodiment, the operation log having position information corresponding to the search position is that the search position is included in the position information (in the case of a region) when the search position is a point and the search position matches the position information. This is the case. Further, when the search position is an area, it means a case where all or part of the position information is included in the search position. That is, the position information includes the search position, the search position includes the position information, and one is not included in the other, but the position information and the search position have overlapping regions. If the search position does not include position information and the position information is related to the operation target window, an operation log related to the entire window may be extracted, a button included in the search position, Only operation logs related to overlapping areas or the like may be extracted. Of course, as long as the object of the present invention is achieved, another positional relationship may be the correspondence relationship between the search position and the positional information.

  The control unit 27 performs predetermined control according to the operation log extracted by the operation log extraction unit 26. As the predetermined control in the present embodiment, it is possible to use a list display of extracted operation logs, a display of the number of operation logs, a display of whether or not operation logs can be extracted, or a notification of these information. However, the present invention is not limited to this, and other controls may be performed.

  Next, the processing flow of the present embodiment will be described using the flowchart of FIG. Although not described in the processing flow, it is assumed that the operation log acquired from the terminal C is sequentially acquired and stored by the operation log management unit 21.

First, screen information including an operation image is generated by the screen information generation unit 12 of the terminal C, and acquired by the screen information acquisition unit 22 (# 01). The operation image included in the acquired screen information is displayed on the display 2 of the management terminal S by the screen display unit 23 via the GUI unit 30 (# 02). At this time, display information corresponding to the display form of the operation image is generated (# 03). FIG. 4 is an example of a display screen by the screen display unit 23. The display screen 41 includes operation images 42a, 42b, 42c and 42d included in the screen information acquired from the four terminals C. At this time, display information for each operation image is generated. For example, the display information of the operation image 42a is, w, h, given as x _1, y _1. This display information means that the width of the operation image on the display 2 is w, the height is h, and the coordinates of the upper left corner are (x ₁ , y ₁ ). Similarly, display information 42d operation image is w, h, and x _4, y _4. In this example, the display size of all the operation images is the same, but the size of the operation image may be different for each terminal C. In addition, a configuration in which a specific operation image can be enlarged and displayed as appropriate may be used. In this case, the display information is regenerated as the display form is changed.

  In this way, the administrator performs various operations on the operation image displayed on the display 2. If the detection unit 24 determines that this operation is an instruction operation (Yes branch of # 04), instruction information is generated based on this instruction operation (# 05). As described above, the instruction operation is a click or area designation with the mouse 3b, and the instruction information includes the clicked coordinates when the instruction operation is click, and the upper left corner and lower right corner of the area when the area is designated. This is the indicated position such as the coordinates.

The search condition generation unit 25 is specified based on the screen information related to the operation image 42 displayed by the screen display unit 23, the display information generated by the screen display unit 23, and the instruction information generated by the detection unit 24. A condition is generated (# 06). For example, FIG. 5 shows a state in which the operation image 42a is clicked by the administrator on the display screen of FIG. At this time, the acquired screen information by the screen information acquisition unit 22, an operation W and H is obtained as the size of the image 42a, w as the display information generated by the screen data generating unit, h, x _1, y ₁ And (x _p , y _p ) is obtained as the instruction information generated by the detection unit 24. At this time, the operation condition generation unit 25 searches for the search position (x _s , y _s ) obtained by converting the coordinates obtained as the instruction information using these pieces of information into the coordinates on the display 5 of the terminal C. Generate as a condition. _{That, x s = W × (x} p -x 1) / w, a _{y s = H × (y p} -y 1) / h. When the instruction operation is area designation, the area defined based on the two coordinates obtained by the above-described coordinate conversion is the search position with respect to the coordinates of the upper left corner and lower right corner according to area designation. The search position obtained in this way is passed to the operation log extraction unit 26 as a search condition. In the configuration in which operation images of a plurality of terminals C are simultaneously displayed as in the present embodiment, the search condition includes the terminal identification information of the terminal C from which the instructed operation image is generated.

  The operation log extraction unit 26 that has acquired the search condition generated by the search condition generation unit 25 extracts an operation log corresponding to the search condition from the operation log management unit 21 (# 07). Specifically, the operation log extraction unit 26 is an operation log having the same terminal identification information as the terminal identification information included in the search condition from the operation log managed by the operation log management unit 21, and the search An operation log having position information corresponding to the search position included in the condition is extracted.

  The control unit 27 displays the operation log extracted by the operation log extraction unit 26 on the display 2 via the GUI unit 30 (# 08). As a display form by the control unit 27, in addition to displaying a detailed operation log, only the presence or absence of the corresponding operation log can be displayed.

[Second Embodiment]
Next, a second embodiment of the operation log search system of the present invention will be described. This embodiment is different from the first embodiment in that a search period is included in the search condition. Since the functional block diagram and the flowchart are the same as those of the first embodiment, the description of the same parts is omitted.

  In the present embodiment, the detection unit 24 generates not only coordinate information but also time information as instruction information based on the instruction operation (# 05). The time information is information generated by an instruction operation to obtain a period for extracting the operation log, and can be generated from the click time of the mouse 3b, the writing pressure of a tablet or the like. For example, a longer period can be used as time information as the click time is longer or the writing pressure is stronger. In this case, the time information can specify a past time starting from the date and time information acquired from the screen information that included the displayed operation image. In the case of a configuration using screen information recorded as will be described later, the end of the period can be set as the future. With this configuration, since coordinate information and time information can be input with a single operation, convenience can be improved, which is preferable. However, the present invention is not limited to such a method. For example, a method of displaying a slider together with an operation image, specifying a period by operating the slider, displaying an operation image of a single terminal C in time series, and specifying a period by specifying a plurality of operation images. A method or the like may be used. When these methods are used, two arbitrary time points can be designated. Of course, the method of generating time information is not limited to these, and other methods may be used as long as the object of the present invention is achieved.

  The search condition generation unit 25 that has acquired the instruction information generates a search position as in the first embodiment, and also generates a search period that is defined based on time information included in the instruction information, and uses it as a search condition. (# 06).

  The operation log extraction unit 26 extracts an operation log corresponding to the search condition generated by the search condition generation unit 25 from the operation log management unit 21 (# 07). In the present embodiment, the search condition includes a search period in addition to the search position of the first embodiment. Accordingly, the operation log is extracted by the search period in addition to the extraction method of the first embodiment. Specifically, an operation log having the same terminal identification information as the terminal identification information of the search condition, the position information corresponding to the search position of the search condition, and the date / time information included in the search period of the search condition is extracted. The

  Thus, in the present embodiment, not only the position but also the period can be used as the search condition, and a more accurate operation log search can be performed. Moreover, since the position and the period can be specified by one operation by using the click time, the writing pressure, or the like as the period specifying method, the convenience of the manager can be improved.

[Third Embodiment]
Next, a third embodiment of the operation log search system of the present invention will be described. FIG. 6 is a functional block diagram of the present embodiment, which differs from the first and second embodiments in that it includes a related operation log extraction unit 28.

  The related operation log extraction unit 28 has a function of extracting an operation log related to the operation log extracted by the operation log extraction unit 26. Normally, the related operation log extraction unit 28 executes the processing by reading the means (program, module, etc.) for executing the processing into hardware, but these may be configured by a combination with hardware. It may be configured only by hardware combining logic or the like.

  FIG. 7 is a flowchart showing a flow of processing in which the related operation log extraction unit 28 extracts a related operation log. First, an operation log is extracted by the processing of the first or second embodiment, and the extracted operation log is transferred to the related operation log extraction unit 28 (# 11).

  The related operation log extraction unit 28 that has acquired the operation log generates related information based on the acquired operation log (# 12). As related information, various pieces of information included in the operation log such as file identification information that is an operation target, an application that executes the operation, and information on the date and time when the operation was performed can be used. Generation of related information may be configured to be automatically set based on the acquired operation log, and a dialog or the like for inputting which item is used as related information is displayed, and an administrator or the like is allowed to specify an item. The related information may be generated from the acquired operation log in accordance with the item that has been set.

  The related operation log extraction unit 28 that has generated the related information as described above extracts the operation log corresponding to the related information from the operation log management unit 21 (# 13). At this time, instead of the operation log recorded and managed in the operation log management unit 21, the operation log extracted in # 07 may be extracted. In this case, the operation log is narrowed down.

  In this embodiment, with this configuration, when a notable operation log is searched, an operation log related to the operation log can be further searched. Search is possible.

[Another embodiment]
(1) In the above embodiment, the operation image included in the screen information acquired by the screen information acquisition unit 22 is displayed as it is. However, the screen information is recorded in a screen information recording unit (not shown). Alternatively, the recorded operation image may be acquired by the screen information acquisition unit 22 and displayed on the display 2 by the image display unit 23. In this case, the date information included in the image information is transferred from the image display unit 23 to the search condition generation unit 25, and the search condition generation unit 25 generates a search condition including the date information. Then, the operation log extraction unit 26 extracts an operation log based on a search condition including date and time information when the operation log is extracted. That is, the operation log extracting unit 26 includes the same terminal identification information as the terminal identification information included in the search condition, has date information for a predetermined period from the date information included in the search condition, and stores position information corresponding to the search position. Extract the operation log that you have.

(2) In the above-described embodiment, the operation log search system of the present invention is configured by the terminal C and the management terminal S. However, the present invention is not limited to such a configuration, and various configurations are adopted. Can do. For example, FIG. 8 shows a stand-alone system composed only of the terminal C. By providing all the functional units of the management terminal S in the terminal C, the operation log can be searched in the terminal C. In this case, it is not necessary to include terminal identification information in the operation log, search condition, and the like.

  FIG. 9 shows an example of a system in which the arrangement of the functional units of the terminal C and the management terminal S is changed. In this configuration, the terminal C includes an operation log generation unit 11, an operation log management unit 21, an operation log extraction unit 26, a screen information generation unit 12, and a screen information management unit 22 ′. The screen information management unit 22 ′ has a function of recording and managing the screen information generated by the screen information generation unit 12. On the other hand, the management terminal S includes an image display unit 23, a detection unit 24, a search condition generation unit 25, and a control unit 27. In this case, the operation log and screen information are generated and recorded and managed by the terminal C, and the operation log is also extracted by the terminal C. In this configuration, since the management terminal S only performs screen display, search condition generation, and the like, the load on the management terminal S can be reduced.

Furthermore, as shown in FIG. 10, it is possible to adopt a configuration in which a server is added in addition to the terminal C and the management terminal S. In this configuration, an operation log management unit 21, a screen information management unit 22 ′, and an operation log extraction unit 26 are provided in the server. With such a configuration, it is possible to reduce the load on the terminal C and the management terminal S and improve the performance of the entire system.

(3) In the above embodiment, the search is performed based on the terminal identification information. However, as described above, the user identification information is included in the operation log and the screen information, and the user identification information is used instead of the terminal identification information. It is also possible to perform a search based on this.

System configuration diagram of operation log search system according to the present invention The functional block diagram in 1st Embodiment of the operation log search system by this invention The flowchart showing the flow of the process in 1st Embodiment of the operation log search system by this invention. Example of display screen of operation log search system according to the present invention Example of instruction operation of operation log search system according to the present invention Functional block diagram of the third embodiment of the operation log search system according to the present invention. The flowchart showing the flow of the process of the related operation information extraction in 3rd Embodiment of the operation log search system by this invention. Functional block diagram of the operation log search system of the present invention configured as a stand-alone type Functional block diagram in another embodiment of the operation log search system of the present invention Functional block diagram in another embodiment of the operation log search system of the present invention

Explanation of symbols

S: Management terminal C: Terminal 10, 20: Network I / F
11: Operation log generation unit 12: Screen information generation unit 13, 30: GUI unit 21: Operation log management unit 22: Screen information acquisition unit 23: Image display unit 24: Detection unit 25: Search condition generation unit 26: Operation log extraction Unit 27: Control unit

In order to solve the above problems, an operation log search system according to the present invention is configured such that a management terminal and a managed terminal are connected via a network, and an operation on the managed terminal operated by a pointing device is performed on the management terminal. An operation log management unit that acquires and stores an operation log including information representing a point on the screen defined based on the operation position of the pointing device on the screen of the managed terminal as position information related to the operation; An operation log search that includes an operation image representing an operation screen on the managed terminal and a screen information acquisition unit that acquires screen information including a size of the operation image, and searches for an operation log including the predetermined position information In the system, the operation image is displayed on the screen of the management terminal and displayed on the screen of the management terminal. An image display unit that generates display information indicating the position and size of a point serving as a reference for the operation image, and the user displays a predetermined point on the operation image displayed on the screen of the management terminal by the image display unit. Based on a detection unit that detects an instruction operation for designating an area and acquires coordinates indicating the point or instruction information including the area, and the size and the display information of the operation image included in the screen information The operation log is searched for a search position which is position information obtained by converting the coordinates or area on the screen of the management terminal included in the information into coordinates or areas on the screen of the managed terminal. operation log extraction for extracting a search condition generating unit which generates a search condition for the operation log having position information matching or included in the search position of the search condition from the operation log management unit And it includes a part, a.

Further, in one preferred embodiment of the operation log retrieval system of the present invention, the terminal represents an operation in the terminal operated by the pointing device, based on the operating position of the pointing device on the screen of the terminal defined An operation log management unit that stores an operation log that includes information representing a point on the screen as position information related to the operation, an operation image that represents an operation screen on the terminal, and a screen that includes the size of the operation image An operation log search device comprising: a screen information recording unit for recording information; and a screen information acquisition unit for acquiring the screen information from the screen information recording unit, and searching for an operation log including predetermined position information. The acquired operation image is displayed on the screen on the terminal, and the position of the reference point of the operation image on the screen and An image display unit that generates display information representing the degree of coordinates; and a coordinate indicating the point by detecting an instruction operation in which a user designates a predetermined point or region on the operation image displayed on the screen by the image display unit. Or based on the size of the operation image included in the screen information and the display information , the coordinates on the screen of the terminal included in the instruction information or the detection unit that acquires the instruction information including the region the search position is position information obtained by converting the area into coordinates or areas on the acquired operation image, a search condition generation unit for generating a search condition for searching for the operation log, the search condition An operation log extraction unit that extracts an operation log that matches or is included in the search position from the operation log management unit.

In one preferred embodiment of the operation log search system of the present invention, a managed terminal and a managed terminal are connected via a network, and the managed terminal is operated by a pointing device to the managed terminal. Operation log management unit that stores an operation log including information indicating a point on the screen defined based on the operation position of the pointing device on the screen of the managed terminal as the position information related to the operation And an operation image representing an operation screen on the managed terminal and a screen information management unit for storing screen information including the size of the operation image, and an operation for searching an operation log including the predetermined position information In the log search system, the operation image is displayed on the screen of the management terminal on the management terminal. An image display unit that generates display information indicating the position and size of a point serving as a reference of the operation image in the operation image, and the user displays a predetermined point or point on the operation image displayed on the screen of the management terminal by the image display unit. Based on a detection unit that detects an instruction operation for designating an area and acquires coordinates indicating the point or instruction information including the area, and the size and the display information of the operation image included in the screen information The operation log is searched for a search position which is position information obtained by converting the coordinates or area on the screen of the management terminal included in the information into coordinates or areas on the screen of the managed terminal. and a search condition generation unit for generating a search condition for the management target device, the operation log operation logs having position information matching or included in the search position of the search condition And it includes an operation log extraction unit that extracts from the processing section, the.

In one preferred embodiment of the operation log search system of the present invention, a server, a management terminal, and a managed terminal are connected via a network, and the server represents an operation at the managed terminal, and pointing Operation log management for acquiring and storing an operation log including information representing a point on the screen defined based on the operation position of the pointing device on the screen of the managed terminal operated by the device as position information related to the operation A screen information management unit that acquires and stores operation information representing an operation screen on the managed terminal and screen information including the size of the operation image, and searches for an operation log including the predetermined position information An operation log search system for displaying the operation image on a screen of the management terminal on the management terminal, and the management terminal An image display unit that generates display information indicating the position and size of a reference point of the operation image on the screen, and the user displays a predetermined value on the operation image displayed on the screen of the management terminal by the image display unit. Based on a detection unit that detects an instruction operation that designates a point or an area, acquires the instruction information including coordinates indicating the point or the area, and the size and the display information of the operation image included in the screen information , A search position, which is position information obtained by converting the coordinates or area on the screen of the management terminal included in the instruction information into coordinates or areas on the screen of the managed terminal, and a search condition generation unit for generating a search condition for searching for, on the server, the operation logs having position information matching or included in the search position of the search condition And it includes an operation log extraction unit that extracts from the work log management unit.

In one preferred embodiment of the operation log search system of the present invention, the operation log includes date and time information related to the operation, the search condition is further determined based on the instruction operation, and the date and time information look including the search period for searching the operation log by the operation log extracting unit includes the position information match or included in the search position of the search condition is included in the search period of the search condition An operation log having the date information is extracted . Thereby, it is possible to perform a search including not only the position but also the concept of time. In particular, a configuration in which a search position and a search period can be specified based on an instruction operation is preferable because a search condition can be easily specified.

The technical features of the operation log search system according to the present invention described above can be applied to a similar operation log search program. For example, information indicating an operation on a managed terminal operated by a pointing device, and information indicating a point on the screen defined based on an operation position of the pointing device on the screen of the managed terminal is position information related to the operation An operation log management function that acquires and saves operation logs included as an operation log, and a screen information acquisition function that acquires operation information representing the operation screen on the managed terminal and screen information including the size of the operation image are realized in the computer. An operation log search program for searching an operation log including predetermined position information, displaying the operation image on a screen of the management terminal and serving as a reference for the operation image on the screen of the management terminal An image display function for generating display information indicating the position and size of a point, and the management terminal by the image display unit. A detection user detects the instruction operation for specifying a predetermined point or area, to obtain the instruction information including the coordinates or the region indicates the point on the displayed operation image on the screen of, included in the screen information Based on the size of the operation image to be displayed and the display information , the coordinates or the area on the screen of the management terminal included in the instruction information is converted into the coordinates or the area on the screen of the managed terminal. A search condition generation function for generating a search position that is obtained position information as a search condition for searching the operation log, and an operation log having position information that matches or is included in the search position of the search condition . An operation log extraction function for extracting from an operation log managed by the log management function is realized on a computer. Naturally, such an operation log search program can also obtain the effects described in the operation log search system described above, and can further incorporate the above-described additional technology.

Claims (4)

An operation log search system comprising: an operation log management unit that stores operation logs including position information related to operations on a terminal; and a screen information acquisition unit that acquires screen information including operation images representing operations on the terminal. And
An image display unit that displays the operation image on a screen and generates display information of the operation image displayed on the screen;
A detection unit that detects an instruction operation based on a user operation on the operation image displayed by the image display unit, and acquires instruction information including an instruction position based on the instruction operation;
A search condition generation unit that generates a search condition including a search position specified based on the screen information, the display information, and the instruction information;
An operation log search system comprising: an operation log extraction unit that extracts an operation log corresponding to the search condition from the operation log management unit.   The operation log search system according to claim 1, wherein the search condition further includes a search period specified based on the instruction information.   A related operation log extraction unit that generates related information from the operation log extracted by the operation log extraction unit and extracts an operation log related to the operation log from the operation log management unit based on the related information. The operation log search system according to claim 1 or 2. An operation log search program for causing a computer to realize an operation log management function for storing an operation log including position information related to an operation on a terminal and a screen information acquisition function for acquiring screen information including an operation image representing an operation on the terminal. Because
An image display function for displaying the operation image on a screen and generating display information of the operation image displayed on the screen;
A detection function for detecting an instruction operation based on a user operation on the operation image displayed by the image display function, and acquiring instruction information including an instruction position based on the instruction operation;
A search condition generation function for generating a search condition including a search position specified based on the screen information, the display information, and the instruction information;
An operation log search program that causes a computer to realize an operation log extraction function that extracts an operation log corresponding to the search condition from an operation log managed by the operation log management function.

Images