JP2014153742A - Log management system, log management device and log management method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a log management technology for enabling a user to efficiently grasp the derivative status of a file.SOLUTION: A log management device includes: a file operation log storage part for storing a file operation log including at least information indicating the operation target file of a file operation in a client terminal, which is applied with log identification information for uniquely identifying a series of file operation logs; a server log storage part for storing an access log including at least information indicating the access target file of access to the server; and a log storage part for extracting the access log including the access target file matching the operation target file of the file operation log stored in the file operation log storage part from among access logs stored in the server log storage part, and for setting the extracted access log to a start point in the series of file operation logs, and for storing the file operation log added with the log identification information for uniquely identifying the series of file operation logs in the file operation log storage part.

Description

  The present invention relates to a log management technique for accumulating file operation logs for electronic files (hereinafter also simply referred to as “files”), searching the accumulated file operation logs, and tracking the history of operations relating to electronic files.

  In recent years, with the spread of cloud services, services that deposit business data in a virtual storage area on a network, represented by online storage services, are becoming widespread. The use of such a service has the advantage that the business efficiency can be improved without having to construct and operate the facility itself. On the other hand, security concerns have been pointed out, such as whether the deposited data and files are handled appropriately and whether the files derived from the original files are spread.

  As a technique corresponding to this, there is a method of clarifying a derivation state of a file using a file operation log. For example, it is performed as follows. First, file operation logs are collected from client terminals that perform file operations and stored in a unified manner. Next, the stored file operation log is searched using information related to file operations such as a file storage location and operation contents as a search condition. In this way, it is possible to extract a log indicating how a specific file is handled.

  In addition, a series of file operations on a specific file can be clarified by tracking an arbitrary file operation log as a starting point in time series. By investigating the handling status of the file from the tracking result, it is possible to confirm the remaining important information contained in the file. Here, the file operation log that is the starting point in the follow-up survey is called the starting point log. The process of tracking a series of logs toward the future based on the operation time described in the origin log is called derivative tracking, and the process of tracking a series of logs toward the past is called origin tracking.

  Patent Literature 1 and Patent Literature 2 are technologies for displaying a series of operation logs for a specific file in a tree format having a function of clarifying a file handling status using such a file operation log. Are known.

JP 2008-052570 A JP 2009-015659 A

  A conventional computer system is generated at a client terminal that operates on a file stored in a hard disk directly connected to the client terminal that performs the operation, or a file that can be shared via a network by a file sharing server. It collects file operation logs and records and displays file derivation relationships.

  However, in a conventional computer system, a file downloaded from a server (web server, FTP server, mail server, server constituting an online storage service, etc.) that downloads a file is derived and traced, and an arbitrary file is downloaded. It is difficult to track the origin of the information because the access method is different.

  The present invention has been made in view of these points, and collects server access logs and client terminal file operation logs, and generates file operation logs for downloads. The purpose is to provide log management technology that can be grasped automatically.

  In order to solve the above problem, according to the first aspect of the present invention, the log management system includes a client terminal that generates a file operation log including at least information indicating a file operation target file in the terminal, A server that generates an access log including at least information indicating a file to be accessed accessed from a client terminal, a log management device that accumulates file operation logs and access logs, a search condition to the log management device, and log management A search device that receives search results from the device. The log management device assigns log identification information for uniquely identifying a series of file operation logs to the file operation log, accumulates the file operation log storage unit, stores the access log, server log storage unit, and file operation An access log that includes an access target file that matches the operation target file of the file operation log stored in the log storage unit is extracted from the access log stored in the server log storage unit, and the extracted access log is a series of file operations. A log accumulation unit that accumulates in the file operation log storage unit by adding log identification information that uniquely identifies the series of file operation logs as a starting point in the log, and among the file operation logs accumulated in the file operation log storage unit A log search / aggregation unit that extracts file operation logs that match the search conditions and generates search results, and a log Based on the information, including a log tracking unit for generating a tracking result of the derived tracking or derived track, the.

  In order to solve the above problem, according to another aspect of the present invention, the log management device adds a series of file operation logs to a file operation log including at least information indicating a file operation target file in the client terminal. A file operation log storage unit that assigns and accumulates log identification information that is uniquely identified, a server log storage unit that stores an access log including at least information indicating an access target file for access to the server, and a file operation log storage unit The access log that contains the access target file that matches the operation target file of the file operation log accumulated in the server is extracted from the access log accumulated in the server log storage unit, and the extracted access log is the starting point in the series of file operation logs. Log identification information that uniquely identifies the set of file operation logs. Is added to the file operation log storage unit, and the file operation log that matches the search conditions specified by the search device is extracted from the file operation log stored in the file operation log storage unit. A log search / aggregation unit for generating a search result; and a log tracking unit for generating a tracking result of derivative tracking or origin tracking based on the log identification information.

  In order to solve the above problems, according to another aspect of the present invention, the log management method includes a step of generating a file operation log including at least information indicating an operation target file of the file operation in the client terminal. A server generating an access log including at least information indicating an access target file accessed from a client terminal, a log management device storing a file operation log and an access log, and a search device Transmitting a search condition to the log management device and receiving a search result from the log management device. The log management step includes a file operation log storage step in which the log management device assigns log identification information that uniquely identifies a series of file operation logs to the file operation log, and accumulates in the operation log storage unit; Server log storage step in which the device stores the access log in the server log storage unit, and the access target file in which the log storage unit of the log management device matches the operation target file of the file operation log stored in the file operation log storage unit Is extracted from the access logs stored in the server log storage unit, and the log identification information that uniquely identifies the series of file operation logs as the starting point in the series of file operation logs. Log accumulation step to be added and accumulated in the file operation log storage unit, and log search / aggregation of the log management device However, the log search / aggregation step for extracting the file operation log that matches the search condition from the file operation log accumulated in the file operation log storage unit and generating the search result, and the log tracking unit of the log management device, And a log tracking step for generating a tracking result of the derived tracking or the origin tracking based on the log identification information.

  In order to solve the above problem, according to another aspect of the present invention, a log management method includes a series of file operation logs in a file operation log including at least information indicating a file operation target file in a client terminal. A file operation log storage step for accumulating in the file operation log storage unit by assigning uniquely identifying log identification information and an access log including at least information indicating an access target file for access to the server are stored in the server log storage unit In the access log stored in the server log storage unit, the server log storage step and the log storage unit include an access log including an access target file that matches the operation target file of the file operation log stored in the file operation log storage unit. And extract the extracted access logs into a series of file operation logs A log accumulation step for adding log identification information for uniquely identifying a series of file operation logs and accumulating them in the file operation log storage unit and a log search / aggregation unit are accumulated in the file operation log storage unit. The log search / aggregation step that extracts the file operation log that matches the search conditions specified by the search device from the file operation log and generates the search result, and the log tracking unit derives the tracking based on the log identification information Or a log tracking step for generating a tracking result of origin tracking.

  When accumulating file operation logs, the log management apparatus according to the present invention acquires the access logs for the server files in addition to the file operation logs of the client terminal, thereby indicating the derivation status of the files stored in the server. Can be tracked.

It is a block diagram which shows the structural example of a log management apparatus. It is a figure which shows the structural example of a file operation log. It is a figure which shows the structural example of a file access log. The figure which shows the structural example of the file operation log to which the log identification information for identifying a series of file operation was provided. It is a flowchart which shows the process sequence which accumulate | stores a download file. It is a figure which shows the example in which a search device displays a search result. It is a flowchart which shows the process sequence which searches / aggregates a download log. It is a figure which shows the example which a search apparatus displays the list of download files as a search result. It is a flowchart which shows the process sequence which tracks a download log. It is a figure which shows the example in which a search device displays a tracking result. The figure which shows the example which displays a search result when a search device designates a file name as a search condition. The figure which shows the example which displays the list of the files in which the search device matched the designated file name.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the component which has the same function in drawing, and duplication description is abbreviate | omitted.

  FIG. 1 is a block diagram showing the configuration of the log management apparatus 100 and peripheral devices of this embodiment. The log management system 10 includes a log management device 100, a search device 200, a client terminal 300n (n = 1, 2,..., N) to be monitored for N file operation logs, and a server 400. , Connected to the network 1. The network 1 is configured so that the log management device 100 and the search device 200, the log management device 100, each of the N client terminals 300n, and the server 400 can communicate with each other. The network 1 can be configured by, for example, the Internet, a LAN, or a WAN. The log management apparatus 100 includes a log tracking unit 110, a log storage unit 120, a log search / aggregation unit 130, a file operation log storage unit 140, and a server log storage unit 150.

[Explanation of log accumulation method]
Each of the N client terminals 300n monitors a file operation at the own terminal, and each time a file operation is performed, a file operation log describing the operation content is generated and transmitted to the log management apparatus 100. Any known method can be used for monitoring the file operation as long as the information set in the file operation log described later can be acquired. For example, it may be acquired by an agent program that always operates on the client terminal 300n that is the monitoring target device, or may be acquired from a security log provided by basic software (Operation System) that configures the client terminal 300n.

  The server 400 monitors access to the server from the client terminal 300n, generates an access log describing the access information, and transmits the access log to the log management apparatus 100. The server 400 is described as an example of a web server that provides a file download service. However, the server 400 may be a server that constitutes an online storage service, or may be a mail server that handles e-mails that send and receive attached files. In short, any server that downloads a file in response to a request from the client terminal 300n may be used. Any known method can be used for monitoring access to a file as long as information set in an access log described later can be acquired. For example, you may acquire from the access log which the middleware which comprises the server 400 provides.

  FIG. 2 shows a configuration example of the file operation log. A character string following “date and time =” represents the date and time when the operation was performed (hereinafter, the operation date and time). The character string following “host =” represents the name of the client terminal 300m (m is any one of 1, 2,..., N, and the client terminal 300m is also referred to as an operation terminal hereinafter) on which the file operation is performed. . The character string following “user =” represents the user who has logged in to the operation terminal when the file operation is performed. The character string following “application =” represents the name of the application used for the file operation. The character string following “operation type =” represents the type of file operation content. A character string following “original file name =” represents a file name before the file operation. The character string following “original file path =” represents the file path before the file operation. A character string following “destination file name =” represents a file name after file operation. The character string following “destination file path =” represents the file path after the file operation. Create (Delete), reference (Read), update (Modify), duplicate (Copy), move (Move), rename (Rename), save as (SaveAs), etc. are set as the operation type . The original file path and the destination file path may be set as a local path or a network path. The local path is a description method of a file path including information indicating a disk drive mounted on the operation terminal. The network path is a file path description method including the host name (including the IP address) of the terminal that holds the file. The path description method differs depending on the basic software that configures the device. For example, in the case of Microsoft Windows (registered trademark), the local path is a character string that starts with the drive letter of the disk drive, and the network path is "\\". The string starts with a string followed by the host name.

  FIG. 2A is an example of a file operation log that is output when a file is generated. On November 12, 2012 at 10: 10: 15.311 seconds, at any client terminal 300m with the host name "PC_001", the user "User_001" uses the application "APPLICATION01.exe" and the file path is " This indicates that the file name “Explanation document.txt”, which is “C: \ My Documents \ Explanation document.txt”, has been created. When the operation type is “Create”, since the operation target file does not exist before the file operation, an empty string is set in the destination file name and the destination file path. If the operation target file does not exist after the file operation, such as when the operation type is Delete (Delete), or the file name and the operation target file before and after the file operation, such as referencing (Read) or updating (Modify) Even when the file path is not changed, an empty string is set in the destination file name and the destination file path.

  FIG. 2B is an example of a file operation log that is output when a file is replicated. At 11: 35: 05.335 on November 12, 2012, the user "User_002" uses the application "APPLICATION02.exe" and the file path is " The file name “explanation material.doc” with \\ 10.10.1.5 \ File \ explanation material.doc ”is changed to the file name“ explanation material.doc ”with the file path“ C: \ My Documents \ explanation material.doc ”. , Indicating that it was duplicated. If the operation type is Duplicate (Copy), Move (Move), Rename (Rename) or Save As (SaveAs), the file name or file path of the operation target file is changed before and after the file operation, so the destination file Name and destination file path are set.

  FIG. 3 shows a configuration example of the access log in the server 400. The character string in the “host name” column represents the name of the access source client terminal 300p (p is any one of 1, 2,..., N, and the client terminal 300p is also referred to as an access terminal hereinafter). A character string in the “date and time” column represents the date and time when access was performed (hereinafter referred to as access date and time). The character string in the “mail address” column represents the user identifier (the mail address in this embodiment) of the user who has accessed the server 400. The character string in the “request” column represents the content and protocol of the request to the server 400. A character string in the “status” column means an access result and represents an HTTP status code transmitted to the client. For example, when the HTTP status code is “200”, it means that the access result is successful. The character string in the “byte count” column represents the byte count of the file transmitted to the client. The character string in the “Request” column consists of the request type such as GET, PUT, URL (character string indicating the access destination starting with http: //), and protocol type (character string such as HTTP / 1.0). The Furthermore, it is good also as a structural example which acquires a user name, an e-mail address, and a file path name combining with the log of the server 400 which comprises a storage service. The access log includes information indicating the access target file. In this example, the file name included in the character string “request” in FIG. 3 is the access target file. For example, the access target file of the access log on the first line in FIG. 3 is “index.html”.

  The log management apparatus 100 receives the file operation log from the client terminal 300n, adds log identification information for uniquely identifying a series of file operation logs, and accumulates the log operation information in the file operation log storage unit 140. Further, the log management apparatus 100 receives the access log from the server 400 and accumulates it in the server log storage unit 150.

  The file operation log storage unit 140 stores a previously received file operation log. A series of file operations for a specific file are concatenated and stored. Specifically, the same identifier (hereinafter also referred to as “log identification information”) is assigned to each log that file A.txt has been created, copied, and renamed (see FIG. 5). 4 (1-3 lines). The server log storage unit 150 stores previously received access logs. The file operation log storage unit 140 and the server log storage unit 150 include, for example, a semiconductor memory device such as a RAM (Random Access Memory) and a flash memory, a middleware such as a relational database and a key / value store, a hard disk, An auxiliary storage device such as an optical disk can be used. Here, a case where the file operation log storage unit 140 and the server log storage unit 150 are configured by a relational database will be described as an example (see FIGS. 3 and 4). In this case, the accumulated file operation log and access log are registered as one record with one log in each table having a column corresponding to each element.

  The file operation log storage unit 140 monitors the order of arrival of the file operation logs, and generates a new file operation log when it matches a pre-registered rule. For example, when the client terminal 300m displays a window title of “save as”, the log management apparatus 100 receives information indicating the display from the client terminal 300m. In this case, the log management apparatus 100 includes information indicating that the window title “Save As” is displayed within a certain time from the client terminal 300m, and a file operation log whose operation type is “Create”. , Monitoring whether or not the file operation log whose operation type is reference (Read) arrives at the file operation log storage unit 140, and when the arrival of three file operation logs can be detected (according to the rules registered in advance) If they match), create a new file operation log with the operation type as Save As. At this time, the original file name and original file path of the newly generated file operation log are set as the original file name and original file path of the file operation log whose operation type is “Read”, and the destination of the newly generated file operation log The file name and destination file path are used as aliases and save destinations when saving as aliases. By generating a file operation log that includes the pre-change file name and post-change file name at the time of such file operations, it is possible to accumulate the file operation log with identification information that uniquely identifies a series of file operations. become able to. Note that the order of arrival of the file operation logs shown here is monitored, and a process for generating a new file operation log when it matches a pre-registered rule is executed at the client terminal, and the newly generated file operation log May be transmitted to the log management apparatus.

  In the conventional technology, when determining the derivation of a file, when acquiring a log for performing a “Save As” file operation using a document creation application, the log is acquired without changing the document creation application. Therefore, a method using an application for monitoring file I / O was effective. However, there is a problem that it is judged that the file has been newly created and saved because the log of creation is output instead of the log of saving as (SaveAs). In that case, the file saved under a different name was originally derived from the original file, but could not be treated as derived.

  On the other hand, in the configuration of the present embodiment, it can be stored as a series of file operation logs. More specifically, by generating a file operation log that includes the pre-change file name and the post-change file name when saving with a name, the tree of a series of file operations is tracked without interruption when saving with a name. And understand the relationship of file operations. Therefore, in the conventional technology, a file generated by saving as a different name that was not considered as a derived file can be regarded as a derived file for reference (Read) and saved as a series of file operation logs. Can do.

  With reference to FIG. 5, the operation of the log storage unit 120 when a file is downloaded from the server 400 will be described. When storing in the file operation log storage unit 140, the log storage unit 120 extracts a file operation log in which the application is a web browser (Internet Explorer (registered trademark) or the like) and the operation type is Create (S1101). ). In this case, an access log having the same file name and the same date and time is extracted from the server log recording unit 150 using the original file name and date and time included in the extracted file operation log as keys (S1102). In this embodiment, the name of the file to be accessed is included in the character string in the “request” column. For example, in the case of the access log on the second line in FIG. 3, “document001.txt” is the access target file. Regarding the date and time, it is desirable to extract an access log including a date and time in the vicinity of the date and time included in the file operation log in consideration of time synchronization lag and operation time lag. Therefore, the same date and time does not need to be completely the same, and means a predetermined period before and after the file operation date and time considering the time synchronization deviation and the operation time lag. At this time, when the “user” in FIG. 2 is a Windows (registered trademark) user name, for example, it is different from the “mail address” in FIG. The relationship may be registered in the log storage unit 120 and used as the extraction condition in S1102. That is, the fact that the “user” in the file operation log and the user having the “mail address” in the access log are the same is also added as an extraction condition. With such a configuration, it is possible to grasp the relevance of the file more accurately. More specifically, it is an access log that includes the access target file that matches the operation target file of the file operation log and includes the same access date and time as the operation date and time of the file operation log, Extraction can be prevented. The log storage unit 120 determines whether the access log has been extracted (S1103). If it can be extracted, the operation type is downloaded so that the log storage unit 120 is at the head of the tree for the created log, a file operation log is generated, and added to a series of file operation logs ( S1104). Further, the added file operation log is stored in the file operation log storage unit 140 (S1105). If it cannot be extracted, it takes into account a delay in arrival of the log and waits for a preset time for a preset number of times (S1106, S1107). If the specified number of times is exceeded, it is determined that there is no corresponding access log, and the process ends. For example, when the file operation log of FIG. 2A is given log identification information and stored in the file operation log storage unit 140 (refer to the fourth line in FIG. 4), the log storage unit 120 displays “ .txt ”as the access target file, and the same access date and time as“ 2012/11/12 10: 10: 15.311 ”(in other words, the access date is included within a predetermined period before and after the file operation date and time) Is not present in the server log storage unit 150, and if it exists, the access log is extracted. In the case of FIG. 3 (where “APPLICATION01.exe” is a web browser), the access log in the third line is extracted, a file operation log is generated based on this, and stored in the file operation log storage unit 140 ( (Refer to the fifth line in FIG. 4). If an access log that satisfies the conditions does not exist in the server log storage unit 150 (when the access log on the third line in FIG. 3 does not exist), the file operation log on the fifth line in FIG. 4 is not generated, and FIG. “Explanation material.txt” on the fourth line is determined not to be a downloaded file but a newly created file, and serves as a starting point for a series of file operation logs.

  By accumulating file operation logs in this way, it is possible to track the downloaded file as the starting point, and track whether any file has been downloaded, and derivation of the file stored on the server The situation can be tracked.

[Explanation of log search method]
An example in which a download file is searched using the search device 200, the download file is derived and tracked, and the tracking result is displayed will be described. FIG. 6 shows an example in which the search device 200 displays search results. When the search button 511 on the log search screen 50 is pressed, the search device 200 transmits the search condition input in the search condition column 51 to the log management device 100. For example, in the search condition column 51, search conditions for the administrator column that is the user name of the administrator who manages the system and the period column that is the date and time for searching the download file can be input. In FIG. 6, the person in charge of information A is designated as the administrator, and the period is designated from 00: 00: 00: 00 on November 12, 2012 to 23:59:59 on November 13, 2012. The administrator can use the administrator to specify the search range. In that case, a searchable range can be set in advance for each administrator. For example, the file operation logs of the client terminals 3001 to 300p are set as a searchable range, and the file operation logs of the client terminals 300 (p + 1) to 300N are set as a searchable range. In addition, the range may be specified by specifying a plurality of specific users and searching only the file operation logs of the specified users. Further, the range may be specified by a combination of the client terminal and the user name. Alternatively, it may be set as a range in which only file operation logs including the same user as the administrator can be searched. Further, the administrator may perform a login action when displaying the log search screen 50 using the search device 200, and may display the login user name. In addition, it is good also as a structure which all the users of the search device 200 can search all the file operation logs without providing an administrator column. In the example of FIG. 6, it is assumed that the information person A can search all file operation logs.

  The log search / aggregation unit 130 included in the log management apparatus 100 extracts file operation logs, and then aggregates according to specific search conditions to generate a search result. Hereinafter, the operation of the log search / aggregation unit 130 included in the log management apparatus 100 will be described with reference to FIG. The log search / aggregation unit 130 receives a search condition (for example, “period”) from the search device 200 (S1201). Next, a file operation log whose operation type is download (hereinafter also referred to as a download log) in the period specified in the search condition is extracted from the file operation log accumulated in the file operation log storage unit 140 (S1202). Subsequently, it is determined whether or not the corresponding download log has been extracted (S1203). When the corresponding download log is extracted, the number of download files, the number of deleted files derived from the download file, and the number of undeleted files are calculated using the extracted download log (S1204). If the downloaded file is duplicated and derived, even if one remains, it is not deleted, and it is deleted when all the derived files are deleted. The number of derived files may be calculated to display whether the file is deleted or not deleted. In this case, derivation tracking is performed on the download log, and the total number of download files and their derived files, the number of downloaded files or their derived files deleted and the number of undeleted files are calculated and displayed. Subsequently, the calculated number is transmitted as a search result to the search device 200 (S1205). If the corresponding download log is not extracted, information indicating that the corresponding download log does not exist is returned to the search device 200 (S1206).

  When the search device 200 receives the search result from the log management device 100, the search device 200 displays the search result in the search result column 52. FIG. 6 is an example in which the search result is displayed when the search condition is set and the download log is searched as in the example of the search condition column 51. The search result 521 indicates the number of downloaded files in the period specified in the search condition, the search result 522 indicates the number of deleted files among the downloaded files, and the search result 523 is downloaded. This is an example of the number of files that have not been deleted. In addition, the search result 524 is deleted in the downloaded file in the period from the start of operation to the end date and time of the range specified in the search condition by registering in advance the date and time when the server 400 started operation. This is an example of the number of files that do not exist. By specifying the search condition as shown in FIG. 6, the user can grasp, for example, whether or not a file downloaded from the server 400 operated by the own department has been deleted.

  When the list display buttons 531 and 532 displayed in the search result field 52 are pressed, the search apparatus 200 transmits a download log display request corresponding to the list display button to the log management apparatus 100. . The log management apparatus 100 returns the download log extracted in S1202 to the search apparatus 200 as a list. When the search device 200 receives the list from the log management device 100, the search device 200 displays a download file list screen. FIG. 8 shows an example in which the list display button 531 is pressed and the download log is displayed on the download file list screen 60. For example, the character string in the “file” column in FIG. 8 is the file path of the download destination, the character string that becomes the “IP address” column is the IP address of the client client terminal 300m, and the “delete” column is This indicates whether the derived file of the download file has been deleted.

  When any of the tracking buttons 621 to 628 displayed in the display results 611 to 618 in the list display field 61 is pressed, the searching device 200 uses the download log corresponding to the tracking button as a starting point log. A tracking request is transmitted to the log management apparatus 100. The download log is stored in the file operation log storage unit 140 with log identification information as a starting point of a series of file operation logs. Therefore, when the log management apparatus 100 receives a tracking request using the download log corresponding to the tracking button as a starting point log, a series of file operation logs starting from the download log can be easily acquired.

  With reference to FIG. 9, the operation of the log tracking unit 110 included in the log management apparatus 100 will be described. The log tracking unit 110 receives the starting point log information from the search device 200 (S1301). Next, derivation tracking is performed using the starting point log as a starting point (S1302). Derived tracking is a tracking method that extracts a file operation log that has the same origin log and operation target file and has a newer operation date than the origin log, and is a log given to identify the relationship between a series of operations. Any method that can indicate the derivation status of the file using the identification information may be used. For example, it is possible to show the derivation status of the download file by taking out all the file operation logs having the same log identification information and arranging the file operation logs in time series using the download log as a starting log.

  Then, the file operation log extracted by the derivation tracking and the file operation log as the starting point log are merged to generate a tracking result. For example, in FIG. 4, the file operation log with the operation type “Create” on the fourth line and the file operation log on the fifth line, which is the origin log, mean the same download operation and are merged. In order to reduce the processing for the search apparatus 200 to display the tracking result, the tracking result may be arranged in time series based on the operation date and time.

  Subsequently, the log tracking unit 110 determines whether the tracking result is extracted by the derivative tracking (S1303). When the tracking result is extracted by the derivative tracking, the extracted tracking result is transmitted to the search device 200 (S1304). If the tracking result is not extracted by the derivative tracking, information indicating that there is no file operation log to be tracked is returned to the search device 200 (S1305). However, when the tracking result is not extracted by the derivative tracking, only the file operation log that is the origin log may be transmitted to the search device 200 as the tracking result.

  FIG. 10 shows an example in which the search device 200 displays the tracking result. When receiving the tracking result from the log management apparatus 100, the search device 200 shapes the received tracking result on the log tracking screen 70 and displays it in a tree diagram. FIG. 10 is an example in which the tracking result when the tracking button 622 is pressed on the download file list screen 60 of FIG. 8 is displayed.

  The tree diagram is arranged in chronological order of operation date and time from the upper part of the screen to the lower part of the screen, with each file operation log included in the tracking result as each node. The operation date and time, operation type, host name, and user are displayed in the square frames 711 to 713. The original file name or the destination file name of the tracking result record is displayed in each of the round frames 721 to 723. The original file path or the destination file path may be displayed. The square frame and the round frame are combined by arrows and displayed as a series of file operations. It can be seen that the node 722 is copied from the node 721, and the file name of the node 722 is changed by a subsequent operation (renamed (Rename)) and is derived from the node 723.

  In the prior art, when tracking whether a file has been reliably deleted when grasping the handling status of the file, it is necessary to follow the tree of the file to the end, and there is a problem that visibility is low. on the other hand. In this embodiment, the download file list screen is displayed, and the remaining status can be easily visually recognized without chasing the downloaded file tree to the end, thereby improving the visibility (FIG. 8). reference). Furthermore, the derivation status of the selected download file can be displayed in more detail by the user's selection (see FIG. 10).

  Moreover, the remaining status of a specific file can be easily grasped by the totalization processing of the handling status of the files downloaded from the server 400 (see FIG. 6). Therefore, it is possible to easily identify whether important information remains and there is a file to be tracked. Therefore, according to the log management system 10, the work efficiency for grasping the appropriate handling situation of information can be improved as a whole.

  When specifying the search condition, if the file name of the node 722 is known in advance (for example, an actual file existing in the client terminal), the downloaded operation is started from the origin tracking by specifying the file name. It can be understood that the file is. Origin tracking is a tracking method for extracting a file operation log in which the search target file and the operation target file are the same and the operation date and time is older than the search target file. Here, an example will be described in which the search device 200 is used to track the origin of a file and display the tracking result.

  FIG. 11 shows an example in which the search device 200 displays search results. When the search button 811 on the log search screen 80 is pressed, the search device 200 transmits the search condition input in the search condition column 81 to the log management device 100. For example, in the search condition column 81, the file name of the search target file can be input as the search condition.

  An operation of the log search / aggregation unit 110 included in the log management apparatus 100 will be described. The log search / aggregation unit 110 receives a search condition (for example, “file name of search target file”) from the search terminal 200. Next, the log search / aggregation unit 110 stores the file operation log in which the “original file name” or “destination file name” matches the “file name of the search target file” stored in the file operation log storage unit 140. Extract from the log. The log search / aggregation unit 110 counts the number of extracted cases and transmits the number of cases to the search device 200 as a search result.

  When the search device 200 receives the search result from the log management device 100, the search device 200 displays the search result in the search result column 82. FIG. 11 is an example in which the search result is displayed when the search condition is set and the file operation log is searched as in the example of the search condition column 81. The search result 821 is an example showing the number of file operation logs having the same “original file name” or “destination file name” as the file name specified in the search condition.

  When the list display button 831 displayed in the search result column 82 is pressed, the search device 200 transmits a file operation log display request corresponding to the list display button to the log management device 100. The log management apparatus 100 returns the extracted file operation logs to the search apparatus 200 as a list. When the search device 200 receives the list from the log management device 100, the search device 200 displays a file operation log list screen.

  FIG. 12 shows an example in which the file operation log is displayed on the file operation log list screen 90 when the list display button 831 is pressed. For example, the character string in the column “original file” in FIG. 12 represents the file path before the file operation. The character string in the “destination file” column represents the file path after the file operation. The character string that becomes the column of “IP address” is the IP address of the client client terminal 300m.

  When any of the tracking buttons 921 to 923 displayed in the display results 911 to 913 in the list display column 91 is pressed, the searching device 200 displays the file operation log corresponding to the tracking button as a start log. The origin tracking request is transmitted to the log management apparatus 100.

  An operation of the log tracking unit 110 included in the log management apparatus 100 will be described. The log tracking unit 110 receives information on the origin log from the search device 200. Next, origin tracking is performed using the origin log as the origin. Any method may be used as long as it can indicate the origin of the file using the log identification information given to identify the relationship between the series of operations. For example, all file operation logs with the same log identification information can be extracted, file operation logs whose operation date and time are older than the start point log can be extracted, and the origin of the search target file can be shown by arranging the file operation logs in time series . Moreover, you may display as a dendrogram like FIG.

<Effect>
With this configuration, the log management device of the invention stores the file operation log in the server by acquiring the access log for the server file in addition to the file operation log of the client terminal when accumulating the file operation log. You can track the derivation status of files that have been. The downloaded file can be derived and traced from the starting point, and whether or not an arbitrary file is downloaded can be traced.

  Moreover, the remaining status of a specific file can be easily grasped by the totaling processing of the handling status of the files downloaded from the server. Therefore, it is possible to easily identify whether important information remains and there is a file to be tracked. Therefore, according to the log management apparatus of the present invention, the work efficiency for grasping the appropriate handling status of information can be improved as a whole.

[Modification]
In the present embodiment, the case where there is one server has been described. However, even when there are a plurality of servers, the same processing can be performed.

  The file operation log may include at least information indicating the operation date and time and the operation target file, and the access log may include at least information indicating the access date and time and the access target file. Further, in the log storage unit 120, an access log including an access target file that matches the operation target file of the file operation log stored in the file operation log storage unit 140 is selected from the access logs stored in the server log storage unit 150. When extracting and extracting the extracted access log as a starting point log as a starting point in a series of file operation logs, adding log identification information that uniquely identifies the series of file operation logs, and accumulating in the file operation log storage unit, Information indicating at least an operation target file may be included as a file operation log, and information indicating at least an access target file may be included as an access log.

[Program, recording medium]
The present invention is not limited to the above-described embodiment, and it goes without saying that modifications can be made as appropriate without departing from the spirit of the present invention. The various processes described in the above-described embodiments are not only executed in time series according to the order described, but may be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes.

  When various processing functions in each device described in the above embodiment are realized by a computer, the processing contents of the functions that each device should have are described by a program. Then, by executing this program on a computer, various processing functions in each of the above devices are realized on the computer. In the above embodiment, the log management device 100, the search device 200, the server 400, and the client terminal 300n are each realized by separate computers, but a part or all of them may be realized by a single computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

DESCRIPTION OF SYMBOLS 1 Network 10 Log management system 100 Log management apparatus 110 Log tracking part 120 Log storage part 130 Log search / aggregation part 140 File operation log storage part 150 Server log storage part 200 Search apparatus 300n Client terminal 400 Server

Claims (8)

A client terminal that generates a file operation log including at least information indicating an operation target file of the file operation in the terminal;
A server that generates an access log including at least information indicating an access target file accessed from the client terminal;
A log management device for accumulating the file operation log and the access log;
A search device that transmits search conditions to the log management device and receives search results from the log management device, and
The log management device includes:
A file operation log storage unit for accumulating and accumulating log identification information for uniquely identifying a series of file operation logs in the file operation log; and
A server log storage unit for accumulating the access log;
An access log including an access target file that matches an operation target file of the file operation log stored in the file operation log storage unit is extracted from the access log stored in the server log storage unit, and the extracted access log is A log storage unit that is a starting point in a series of file operation logs, adds log identification information that uniquely identifies the series of file operation logs, and accumulates in the file operation log storage unit;
A log search / aggregation unit that extracts a file operation log that matches the search condition from the file operation logs accumulated in the file operation log storage unit and generates a search result;
A log tracking unit that generates tracking results for derivative tracking or origin tracking based on log identification information, and
Log management system. A file operation log storage unit that adds log identification information that uniquely identifies a series of file operation logs to a file operation log that includes at least information indicating a file operation target file in a client terminal,
A server log storage unit for accumulating an access log including at least information indicating an access target file for access to the server;
An access log including an access target file that matches an operation target file of the file operation log stored in the file operation log storage unit is extracted from the access log stored in the server log storage unit, and the extracted access log is A log storage unit that is a starting point in a series of file operation logs, adds log identification information that uniquely identifies the series of file operation logs, and accumulates in the file operation log storage unit;
A log search / aggregation unit that extracts a file operation log that matches a search condition specified by a search device from the file operation logs stored in the file operation log storage unit and generates a search result;
A log tracking unit that generates tracking results for derivative tracking or origin tracking based on log identification information, and
Log management device. The log management device according to claim 2,
The file operation log includes information indicating the operation date / time and operation type of the file operation, the access log includes information indicating the access date / time of access, and the log storage unit creates the operation type When the file operation log is accumulated in the file operation log storage unit, the access includes the access target file that matches the operation target file of the file operation log and includes the same access date and time as the operation date and time of the file operation log. The log is extracted from the access log accumulated in the server log storage unit, the extracted access log is set as the starting point in the series of file operation logs, and log identification information for uniquely identifying the series of file operation logs is added. Accumulated in the file operation log storage unit,
Log management device. The log management device according to claim 2 or 3,
Monitor the arrival of file operation logs at a certain time, generate and accumulate file operation logs according to pre-registered rules,
Log management device. A log management device according to any one of claims 2 to 4,
The search condition is a predetermined period, and the log search / aggregation unit totals the number of file operation logs to which log identification information is added as a starting point in the log storage unit within the predetermined period, and uses the log identification information as a starting point. Derived and traced a series of file operation logs related to each added file operation log, totaled the number of cases where the operation type at the end of the series of file operation logs is all deleted, and the number of other cases, and searched the aggregated results To the search device as
Log management device. A step in which the client terminal generates a file operation log including at least information indicating an operation target file of the file operation in the terminal;
A server generating an access log including at least information indicating an access target file accessed from the client terminal;
A log management step in which the log management device accumulates the file operation log and the access log;
A search device transmits a search condition to the log management device and receives a search result from the log management device, and
The log management step includes:
A file operation log storage step in which the log management device assigns log identification information that uniquely identifies a series of file operation logs to the file operation log, and accumulates in the operation log storage unit;
A server log storage step in which the log management device accumulates the access log in a server log storage unit;
The log storage unit of the log management device stores an access log including an access target file that matches an operation target file of the file operation log stored in the file operation log storage unit. A log accumulation step of extracting the access log as a starting point in a series of file operation logs, adding log identification information for uniquely identifying the series of file operation logs, and accumulating the log in the file operation log storage unit; ,
Log search / aggregation unit in which the log search / aggregation unit of the log management device extracts a file operation log that matches the search condition from the file operation logs accumulated in the file operation log storage unit and generates a search result Steps,
A log tracking unit for generating a tracking result of derivative tracking or origin tracking based on log identification information, and a log tracking unit of the log management device,
Log management method. File operation log storage that accumulates in a file operation log storage unit by adding log identification information that uniquely identifies a series of file operation logs to a file operation log that includes at least information indicating a file operation target file in a client terminal Steps,
A server log storage step of accumulating in the server log storage unit an access log including at least information indicating an access target file for access to the server;
A log storage unit that extracts an access log including an access target file that matches an operation target file of the file operation log stored in the file operation log storage unit from the access log stored in the server log storage unit; A log accumulating step in which the extracted access log is set as a starting point in a series of file operation logs, and log identification information for uniquely identifying the series of file operation logs is added and accumulated in the file operation log storage unit;
A log search / aggregation unit that extracts a file operation log that matches a search condition specified by a search device from the file operation logs accumulated in the file operation log storage unit and generates a search result Steps,
A log tracking step, wherein the log tracking unit generates a tracking result of the derived tracking or the origin tracking based on the log identification information,
Log management method. The log management method according to claim 7, comprising:
The file operation log includes information indicating the operation date / time and operation type of the file operation, and the access log includes information indicating the access date / time of access. The operation type is created in the log accumulation step. When the file operation log is accumulated in the file operation log storage unit, the access includes the access target file that matches the operation target file of the file operation log and includes the same access date and time as the operation date and time of the file operation log. The log is extracted from the access log accumulated in the server log storage unit, the extracted access log is set as the starting point in the series of file operation logs, and log identification information for uniquely identifying the series of file operation logs is added. Accumulated in the file operation log storage unit,
Log management method.

Images