JP2013235408A - Log management system, log management server, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To eliminate access logs corresponding to a file search operation from access logs of a file server.SOLUTION: A file server 3 transmits access logs of a predetermined period registered with an access log DB 30 to a log management server 1 via a network 5 under predetermined conditions. Each user terminal 4 transmits search operation history data concerning a history of file search operations on the file server 3 to the log management server 1 via the network 5 under predetermined conditions. The log management server 1 refers to the search operation history data transmitted from each user terminal 4, and eliminates access logs corresponding to a file search operation from access logs transmitted from the file server 3.

Description

  The present invention relates to a technique for managing a log for access to a shared file.

  In recent years, information systems such as mission-critical systems built in companies tend to be large and complicated. On the other hand, problems such as unauthorized access and information leakage not only from the outside but also by insiders tend to increase. On the other hand, for example, as a measure for preventing unauthorized access to a highly confidential file stored in a file server, log management for access to the file is effectively utilized.

  In this type of log management, an access log (for example, information on who performed what, what file, what operation, etc.) is recorded by the file server every time a user terminal accesses. It is common for log administrators such as system administrators, business managers, risk managers, etc. to check and control the existence of unauthorized access by regularly monitoring (monitoring activities). Various proposals have been made regarding access log management techniques (for example, Patent Documents 1 to 3).

JP-A-6-67956 JP-A-6-202926 JP 2008-77325 A

  By the way, in general, the access log of a file server often depends on a general-purpose OS log function employed by the file server. In this case, for example, in a Windows (registered trademark) event log, a “read” log is output not only by a substantial operation (for example, update, delete, copy, etc.) on a file but also by an operation such as a file search. Will be. Therefore, in the access log acquired in this way, even if “read” is recorded, it is difficult to determine whether or not the file is due to a substantial operation on the file, which hinders detection of fraudulent acts. It was a factor.

  With respect to the above points, none of the above Patent Documents 1 to 3 discloses an effective solution.

  The present invention has been made in view of such a situation, and provides a log management system and the like that can remove a file generated by an operation other than a substantial operation on a file from an access log acquired by a file server. The purpose is to do.

In order to achieve the above object, a log management system according to the present invention includes:
A log management system comprising a file server, a user terminal, and a log management server, which are configured to be capable of data communication via a predetermined network,
The file server is
File storage means for storing files shared on the network;
When an access to the file storage means from the user terminal via the network is performed, an access log including identification information of the user terminal, access date and time, and operation type is stored in the access log database. Access log registration means to be registered;
An access log transmitting means for transmitting an access log group for a predetermined period registered in the access log database to the log management server via the network under a predetermined condition;
The user terminal is
When a file search operation is performed on the file storage unit, the search operation history storage unit includes a search operation history including identification information of the user terminal and a file search operation period including start and end dates and times of the file search operation. Search operation history registration means for registering in the search operation history table stored in
Search operation history transmission means for generating search operation history data storing the contents of the search operation history table under a predetermined condition, and transmitting the generated search operation history data to the log management server via the network; Prepared,
The log management server
Search log removal means for removing an access log corresponding to the file search operation from the access log group sent from the file server with reference to the search operation history data sent from the user terminal It is characterized by providing.

  According to the present invention, since an access log acquired by a file server can be removed by a file search operation, it can contribute to easy and accurate detection of an illegal act.

It is a figure showing the whole log management system composition concerning an embodiment of the present invention. It is a figure which shows an example of the access log registered into access log DB with which the file server of this embodiment is provided. It is a block diagram which shows the structure of the user terminal of this embodiment. It is a figure which shows an example of the search operation history stored in the search operation history table with which the user terminal of this embodiment is provided. It is a block diagram which shows the structure of the log management server which concerns on embodiment of this invention. It is a figure which shows an example of the search operation log | history of each user terminal preserve | saved at the search operation log | history memory | storage part with which the log management server of this embodiment is provided. It is a figure which shows an example of the access log group after a search operation log is removed. It is a flowchart which shows the procedure of a log report production | generation process. It is a figure which shows an example of the access log group registered into the access log memory | storage part with which the log management server of other embodiment is provided. In another embodiment, it is a figure which shows an example of the access log group after a search operation log is removed.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram showing an overall configuration of a log management system according to the present embodiment. This log management system is a system that is installed in companies and manages access to files shared on a network. The log management system according to the present embodiment includes a log management server 1, an administrator terminal 2, a file server 3, and a plurality of user terminals 4. These can transmit and receive data to and from each other. Thus, it is connected to a network 5 such as an intranet.

  The file server 3 is a device that stores and manages a plurality of files shared on the network 5, and has a hardware configuration equivalent to that of a general server computer. That is, the file server 3 is not shown, but includes a control device including a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), etc., a readable / writable nonvolatile semiconductor memory, An external storage device (file storage means) composed of a hard disk drive and the like, a communication interface for performing communication via the network 5, and the like are provided.

  Further, when there is an access from another device such as the user terminal 4 via the network 5, the file server 3 registers a log (access log) for the access in the access log DB (access log database) 30. Log registration means (not shown) is provided. For example, the file server 3 employs Windows (registered trademark) as an OS (Operating System), and one function of the OS functions as an access log registration unit. That is, in this embodiment, an access log is acquired and registered in the access log DB 30 by a log method depending on the OS. As shown in FIG. 2, one access log includes items such as “user name”, “computer name”, “access date / time”, “operation type”, “result”, “file path”, “server name”, and the like. Consists of

  The “user name” stores a name (for example, expressed in alphabets and numbers) for identifying a user of the computer such as the user terminal 4 that has accessed. The “computer name” stores a name (for example, represented by alphabets and numbers) for identifying the accessed computer. In the “access date / time”, the date (AD) and time (hour / minute / second) when access is started are stored. In the “operation type”, information indicating the type of operation content (“read” or “write” in the present embodiment) is stored. Information indicating whether the operation has succeeded or failed (in this embodiment, “success” or “failure”) is stored in the “result”. The “file path” stores information indicating a file name accessed by the computer in a full path. The “server name” stores a computer name assigned in advance to the file server 3 (in this embodiment, “HOST01”).

  Each user device 4 has a hardware configuration equivalent to that of a general personal computer. More specifically, each user device 4 includes a communication unit 40, an input unit 41, a display unit 42, a storage unit 43, and a control unit 44, as shown in FIG. Each unit is connected to each other via a bus 45.

  The communication unit 40 is configured to include a communication interface such as a network card. Under the control of the control unit 44, the communication unit 40 communicates with other devices such as the file server 3 and the log management server 1 through a predetermined communication method. Communicate in line. The input unit 41 includes a keyboard, a mouse, a keypad, a touch pad, a touch panel, and the like, receives an input operation from the user, and sends a signal (operation signal) related to the received input operation to the control unit 44.

  The display unit 42 includes a CRT, a liquid crystal display, and the like, and displays a screen for user operation and the like under the control of the control unit 44.

  The storage unit 43 is configured by a readable / writable nonvolatile semiconductor memory such as a hard disk drive or a flash memory, and stores various general-purpose programs and various data. As a specific configuration of the present invention, the storage unit 43 stores in advance a search operation detection program 430 and a search operation history transmission program 431 for executing a search operation detection process and a search operation history transmission process, which will be described later, respectively. In addition, a search operation history table 432 for storing a result (search operation history) detected by executing the search operation detection process is stored.

  The search operation history table 432 is a data table in which a history of file search operations (search operation history) to the file server 3 from startup to shutdown in the user terminal 4 is stored. As shown in FIG. 4, one search operation history stored in the search operation history table 432 includes items such as “user name”, “computer name”, “file search start date and time”, “file search end date and time”, and the like. Consists of

  The “user name” stores a name for identifying the user of the user terminal 4 (for example, represented by alphabets and numbers). The “computer name” stores a name for identifying the user terminal 4 (for example, represented by alphabets and numbers). The “file search start date and time” stores the date (year) and time (hour / minute / second) when the file search operation is started. “File search end date and time” stores the date (Western calendar) and time (hour / minute / second) when the file search is ended.

  Returning to FIG. 3, the control unit 44 includes a CPU, a ROM, a RAM, and the like, and controls each unit via the bus 45. As a specific configuration of the present invention, the control unit 44 functionally includes a search operation detection unit 440 and a search operation history transmission unit 441 as shown in FIG. The functions of these functional units are realized by the CPU executing the search operation detection program 430 and the search operation history transmission program 431 stored in the storage unit 43, respectively.

  The search operation detection unit 440 (search operation history registration means) executes a search operation detection process. In the search operation detection process, the search operation detection unit 440 monitors the presence or absence of a file search operation on the file server 3 from the user terminal 4. When a file search operation is performed, the search operation detection unit 440 acquires the date and time (start date and time) from a clock function unit (not shown) included in the user terminal 4 and temporarily stores the acquired start date and time in the RAM.

  Then, when the file search related to the file search operation ends, the search operation detection unit 440 acquires the date / time (end date / time) from the clock function unit. The search operation detection unit 440 displays the user name of the user terminal 4, the name of the user terminal 4, and the acquired start date / time and end date / time as “user name”, “computer name”, “file”, respectively. Search operation histories stored in “search start date and time” and “file search end date and time” are generated and additionally registered in the search operation history table 432.

  The search operation history transmission unit 441 executes search operation history transmission processing. In the search operation history transmission process, the search operation history transmission unit 441 monitors whether or not the user terminal 4 is shut down by the user, and when the shutdown operation is performed, the contents of the search operation history table 432 (that is, the search operation history). (History) stored data (search operation history data) is generated, and the generated search operation history data is transmitted to the log management server 1. When this transmission is completed, the search operation history transmission unit 441 clears the contents of the search operation history table 432. That is, the registered record of each search operation history is deleted.

  Returning to FIG. 1, the administrator terminal 2 has a hardware configuration equivalent to that of a general personal computer, like the user terminal 4. The administrator terminal 2 receives a log report (details will be described later) sent from the log management server 1 on a regular basis (for example, every day), and displays the contents of the received log report on a liquid crystal monitor or the like (not shown). Display through the device.

  The log management server 1 generates a log report based on the access log acquired from the access log DB 30 of the file server 3 and the search operation history acquired from each user terminal 4 and transmits the log report to the administrator terminal 2. . The log management server 1 has a hardware configuration equivalent to that of a general server computer. That is, the log management server 1 includes a control device composed of a CPU, a ROM, a RAM, etc., an external storage device composed of a readable / writable nonvolatile semiconductor memory, a hard disk drive, etc. A communication interface for performing communication via the network.

  As shown in FIG. 5, the log management server 1 functionally includes an access log acquisition unit 10, an access log storage unit 11, a search operation history acquisition unit 12, a search operation history storage unit 13, and a search log. A removal unit 14, a log report generation unit 15, and a log report transmission unit 16 are provided. The functions of these functional units are realized by the CPU executing predetermined programs stored in the ROM or the external storage device.

  The access log acquisition unit 10 receives data including an access log (access log group) for a predetermined period sent from the file server 3 at a predetermined timing (for example, every day), and extracts from the received data The access log group is stored in the access log storage unit 11. In this embodiment, when an access log transmission unit (not shown) included in the file server 3 reaches a predetermined time (for example, midnight), accesses for the past predetermined period (for example, one day) registered in the access log DB 30 are performed. A log group is extracted, data incorporating the log group is generated, and transmitted to the log management server 1.

  The search operation history acquisition unit 12 receives the search operation history data sent from each user terminal 4 and stores the search operation history extracted from the received search operation history data in the search operation history storage unit 13. When the access log group is stored in the access log storage unit 11 by the access log acquisition unit 10, the search log removal unit 14 reads the access log group from the access log storage unit 11. Then, the search log removal unit 14 refers to the search operation history of each user terminal 4 stored in the search operation history storage unit 13 and retrieves an access log corresponding to a predetermined condition from the read access log group. Consider it as a search operation log and remove it.

  In the present embodiment, the search log removal unit 14 determines an access log that satisfies any of the following conditions (1) and (2) as a search operation log.

(1) The “operation type” of the access log is “read” (2) the name of the user and the name of the user terminal 4 stored in each of the “user name” and “computer name” of the access log The search operation history that matches and the date and time stored in the “access date and time” of the access log is stored in the “file search end date and time from the date and time stored in the“ file search start date and time ”. Search operation history included in the period until the date and time)

  For example, the contents of the access log group read from the access log storage unit 11 are as shown in FIG. 2, and the search operation history of each user terminal 4 stored in the search operation history storage unit 13 is shown in FIG. 6, the search log removal unit 14 determines from the access log group No. 6. Nos. 4 to 101 and the access log No. The access logs 105 to 175 are removed as search operation logs. The contents of the access log group after the search operation log is removed are as shown in FIG.

  Returning to FIG. 5, the log report generation unit 15 creates a log report based on the contents of the access log group after the search operation log is removed by the search log removal unit 14. For example, the log report includes the contents of the access log group and other additional information (for example, information such as the number of accesses to the same file and the number of accesses for each user).

  The log report transmission unit 16 transmits the log report generated by the log report generation unit 15 to the administrator terminal 2.

  Next, log report generation processing executed by the log management server 1 configured as described above will be described with reference to the flowchart of FIG. When the access log acquisition unit 10 receives data including the access log group from the file server 3 and the access log group extracted from the received data is stored in the access log storage unit 11 (step S101; YES). The search log removing unit 14 reads the access log group from the access log storage unit 11, refers to the search operation history of each user terminal 4 stored in the search operation history storage unit 13, and satisfies the above-described conditions. The corresponding access log, that is, the search operation log is searched (step S102).

  The search log removal unit 14 removes all search operation logs from the access log group (step S103). Then, the search log removing unit 14 supplies the access log group from which the search operation log has been removed to the log report generating unit 15.

  The log report generation unit 15 generates a log report as described above based on the contents of the access log group supplied from the search log removal unit 14 (step S104). And the log report transmission part 16 transmits the log report produced | generated by the log report production | generation part 15 to the administrator terminal 2 via the network 5 (step S105).

  As described above, according to the log management system according to this embodiment of the present invention, a substantial operation (for example, update, file) is performed on the file from the access log acquired by the log method depending on the OS of the file server 3. It is possible to automatically remove an access log by a file search operation different from deletion, copy, etc.). Therefore, it is possible to contribute to easy and accurate detection of an illegal act with respect to access to a shared file.

  In addition, this invention is not limited to the said embodiment, Of course, the various change in the range which does not deviate from the summary of this invention is possible.

  For example, the condition for considering the above-described search operation log is an arbitrary design matter and is not limited to the above-described one. For example, the following condition (3) may be added to the above conditions (1) and (2).

(3) When there are a plurality of access logs stored in each of “user name”, “computer name”, and “file path” and having the same contents and a common search operation history, The oldest access log

  When such a condition (3) is added, for example, the contents of the access log group read from the access log storage unit 11 are as shown in FIG. When the search operation history of the user terminal 4 is as shown in FIG. 6, the search log removal unit 14 selects No. 1 from the access log group. 4 to 100 and access log No. The access logs 105 to 175 are removed as search operation logs. The contents of the access log group after the search operation log is removed are as shown in FIG.

  In this way, for example, in a certain user terminal 4, when a substantial operation is performed on a specific file of the file server 3 in parallel with the file search operation, an access log related to the substantial operation is performed. Can be left without removal.

  In the above embodiment, the file server 3 transmits an access log for a predetermined period (for example, one day) to the log management server 1 at a predetermined timing (for example, every day). Not only the specification that the file server 3 voluntarily transmits the access log, but also the specification that the file server 3 transmits the access log in response to a transmission request from the log management server 1 may be adopted.

  The timing at which the user terminal 4 transmits the search operation history is also arbitrary. For example, it may be transmitted at startup (when the power is turned on).

  In the above embodiment, each time the log management server 1 receives an access log group from the file server 3, the log management server 1 generates a log report corresponding to the received access log group. After that, log reports corresponding to a plurality of access log groups may be generated.

  In addition, by applying the program executed by the log management server 1 and the user terminal 4 of the above embodiment to an existing server computer, personal computer, etc., these function as a log management server and a user terminal according to the present invention. It is also possible to make it.

  Such a program distribution method is arbitrary, for example, a computer-readable recording medium such as a CD-ROM (Compact Disk Read-Only Memory), a DVD (Digital Versatile Disk), an MO (Magneto Optical Disk), or a memory card. It may be stored and distributed in a network, or distributed via a communication network such as the Internet.

  Various embodiments and modifications can be made to the present invention without departing from the broad spirit and scope of the present invention. Further, the above-described embodiment is for explaining the present invention, and does not limit the scope of the present invention. That is, the scope of the present invention is shown not by the embodiments but by the claims. Various modifications within the scope of the claims and within the scope of the equivalent invention are considered to be within the scope of the present invention.

1 log management server 2 administrator terminal 3 file server 4 user terminal 5 network 10 access log acquisition unit 11 access log storage unit 12 search operation history acquisition unit 13 search operation history storage unit 14 search log removal unit 15 log report generation unit 16 Log report transmitter 30 Access log DB
40 communication unit 41 input unit 42 display unit 43 storage unit 44 control unit 45 bus 430 search operation detection program 431 search operation history transmission program 432 search operation history table 440 search operation detection unit 441 search operation history transmission unit

Claims (5)

A log management system comprising a file server, a user terminal, and a log management server, which are configured to be capable of data communication via a predetermined network,
The file server is
File storage means for storing files shared on the network;
When an access to the file storage means from the user terminal via the network is performed, an access log including identification information of the user terminal, access date and time, and operation type is stored in the access log database. Access log registration means to be registered;
An access log transmitting means for transmitting an access log group for a predetermined period registered in the access log database to the log management server via the network under a predetermined condition;
The user terminal is
When a file search operation is performed on the file storage unit, the search operation history storage unit includes a search operation history including identification information of the user terminal and a file search operation period including start and end dates and times of the file search operation. Search operation history registration means for registering in the search operation history table stored in
Search operation history transmission means for generating search operation history data storing the contents of the search operation history table under a predetermined condition, and transmitting the generated search operation history data to the log management server via the network; Prepared,
The log management server
Search log removal means for removing an access log corresponding to the file search operation from the access log group sent from the file server with reference to the search operation history data sent from the user terminal Prepare
A log management system characterized by that. The search log removing means of the log management server indicates that the operation type included in the access log indicates reading of a file, and is included in the access log in the search operation history data. If there is a search operation history that matches the identification information of the user terminal that is included and the access date and time included in the access log is included in the file search operation period, the access log As an access log corresponding to the file search operation,
The log management system according to claim 1. The access log transmission means of the file server transmits the access log group to the log management server every predetermined period,
The search operation history transmission unit of the user terminal transmits the search operation history data to the log management server when a shutdown operation is performed on the user terminal by a user.
The log management system according to claim 1 or 2, characterized in that Access log acquisition means for acquiring an access log group of a user terminal for the file server, which is sent from the file server via a predetermined network;
Search operation history acquisition means for acquiring search operation history data relating to a history of file search operations by the user terminal with respect to the file server sent from the user terminal via the network;
A search log removing unit that refers to the search operation history data and removes an access log corresponding to the file search operation from the access log group;
A log management server characterized by that. Computer
Access log acquisition means for acquiring a user terminal access log group for the file server, which is sent from the file server via a predetermined network;
Search operation history acquisition means for acquiring search operation history data relating to a history of file search operations by the user terminal with respect to the file server, which is sent from the user terminal via the network,
With reference to the search operation history data, function as search log removal means for removing an access log corresponding to the file search operation from the access log group,
A program characterized by that.

Images