JP4100638B2 - Server operation information acquisition apparatus, method, and computer program - Google Patents

Description

  The present invention is a technique for acquiring log data of operations performed on a server from a client in a client-server system, and in particular, does not put a load on the server side and is a special computer on the server or client side. Even if a program is not installed, it is suitable as a mechanism for acquiring log data by simply connecting to a network without worrying about the OS (Operating System) on the server side.

Recently, in organizations such as companies, the data recorded in the computer is taken out without permission, or unauthorized employees access the computer to obtain the data, There is a social problem of illegal leakage.
To prevent this situation, which client accessed the file management server that stores and manages the files in the organization, and which files on the file management server were created, modified, or deleted A mechanism is provided to obtain operation log data such as

As such a mechanism, in general, a computer program for access monitoring is executed on a server, which client has accessed, and what operation the client has performed on which file. A mechanism for obtaining log data has been proposed.
Further, as an example of a mechanism for acquiring a log, for example, an access count statistics processing unit having a log file in a Web server records the access status from each user in the log file, and based on the recorded contents of the log file A technique for performing statistical processing on the number of accesses for each user has been proposed (see, for example, Patent Document 1).

JP 2002-288069

However, in the conventional mechanism as described above, it is necessary to execute an access monitoring program on the server, so that the server traffic is taken up by the access management process, and the server processing speed decreases. There was a problem that.
Also, when monitoring on a server, it is necessary to set information such as files and clients to be monitored on the server side, and it is necessary to change the management program used depending on the server model and OS. There was a problem that we had to prepare a monitoring program according to the situation.
In addition, when monitoring is performed on the server, there is a problem that the number of clients that can be monitored is limited.
In addition, when monitoring on the server side, the monitoring log data is recorded on the server, so there is a risk that this log data may be illegally accessed or tampered with. There was a problem with reliability.

  The present invention has been made to solve the above-described problems, and acquires an operation log from a client without imposing a load on the server and the client, regardless of the model of the server or the OS and the OS. The purpose is to provide a mechanism that can do this.

In order to achieve the above object, an operation information acquisition apparatus according to an aspect of the present invention includes a file management server that stores a plurality of files composed of actual data and management data , has a hierarchical file system, and the file management In a system comprising a plurality of client terminals connected to a server via a network, the apparatus is connected to the network and acquires log data relating to operations from the client terminal to the file management server, the client terminal and methods that represent the operation on the file management server from methods according to the type of protocol, and a command package sequence, the association with each other is a set of specific commands and specific commands required to perform each method and the definition storage means, the management de Data has an ID that is assigned to each hierarchy items above hierarchical structure, and the ID included in the packet, the ID corresponding item information store means corresponding with and stores the name of the hierarchical structure fields, the response waiting or requests Temporary storage means for temporarily storing waiting packets ; packet acquisition processing means for acquiring packets transmitted and received between the file management server and the client terminal; and determining a communication protocol from the acquired packet data Filtering processing that discards packets of a certain size or more, further discards fragmented packets, network control packets, and unnecessary command packets in the protocol, and selects packets corresponding to a predetermined protocol. It means, from among the filtered packets, the packet Stored in the temporary storage means to determine whether the request packet or response packet from Murrell command, from the stored request packet or response packet to the temporary storage means, the command corresponding to the response-waiting or request packets waiting Request response combining means for determining whether or not there is a packet including a response packet, and combining a response packet with a request packet or a request packet with a response packet when a corresponding command exists , and among the combined packets To a unique identifier that is stored in the packet and that is assigned from session establishment to session release between the client terminal and the hierarchical item in the file management server, and has a packet having a referenced unique identifier Sequence packet analyzing means for determining whether or not The ID corresponding item information by referring to the client specifying means for specifying which client has logged in by referring to the inside of the packet, and the ID assigned to each of the hierarchical items stored in the specified packet. A command package sequence completed by an ID corresponding item specifying unit for specifying a corresponding hierarchical item on the file management server with reference to the storage unit, a command completed by the request / response combining unit, or a sequence packet analyzing unit Based on the method definition storage means, the method specifying means for specifying the method corresponding to the command or command package sequence, at least the date and time when the method occurred, the information for specifying the client, and the analysis are performed. information, including the method was, Rogude the above hierarchy item Analysis result storage means for storing as data, and output means for generating and outputting output data based on the log data stored in the analysis result storage means.

The ID corresponding item specifying means updates the data corresponding to the ID and the hierarchical item name stored in the ID corresponding item information storing means every time a packet including information on the ID and the hierarchical item name arrives. It may be.

A server operation information acquisition method according to an aspect of the present invention stores a plurality of files composed of actual data and management data, and has a file management server having a hierarchical file system , the file management server and the network via the network. In a system consisting of a plurality of client terminals connected to each other, a method that is connected to the network and that represents an operation from the client terminal to the file management server, and a specification necessary for executing each method according to the protocol type a method definition storage means in association with the command package sequence, which is a collection of commands and specific commands, the management data includes an ID that is assigned to each hierarchy items above hierarchical structure, included in the packet and the ID which, in association with the name of the hierarchy item serial And ID corresponding item information storage means for, a method performed by a device comprising a temporary storage means for temporarily storing the response wait or request packets waiting, and between the file management server and the Klein Ant terminal Processing for acquiring transmitted / received packets and determining the communication protocol from the acquired packet data, discarding packets of a certain size or more, further fragmented packets, network control packets, and unnecessary commands in the protocol A process of selecting a packet corresponding to a predetermined protocol, and determining whether the packet is a request packet or a response packet from a command included in the packet from the filtered packets. Stored in the temporary storage means. From the request packet or response packet, it determines whether there is a packet including a command corresponding to the response-waiting or request packets waiting, binding processing or response packet of the response packet to the request packet when the corresponding command exists A process for combining request packets to the client, and from the combined packet to the session establishment and session release between the client terminal and the hierarchical item in the file management server stored in the packet. A process for determining whether or not there is a packet having a referenced unique identifier, a process for identifying which client has logged in by referring to the determined packet, and the above identification Refer to the ID assigned to each hierarchical item stored in the received packet, A process for specifying the corresponding hierarchical item on the file management server with reference to the ID corresponding item information storage means, a command completed by the request response combining means, or a command package completed by the sequence packet analyzing means Based on the sequence, referring to the method definition storage means, the process for identifying the method corresponding to the command or command package sequence, at least the date and time when the method occurred, the information for identifying the client, and the analysis And a process for storing information including a method and the hierarchical item as log data, and a process for generating and outputting output data based on the stored log data .

A computer program according to an aspect of the present invention stores a plurality of files composed of actual data and management data, and is connected to a file management server having a hierarchical file system and the file management server via a network. In a system composed of a plurality of client terminals, a method that represents an operation from the client terminal to the file management server connected to the network, and a specific command and a specification necessary for executing each method according to the protocol type a command package sequence is a set of commands, and method definition storage means for storing in association with, the management data includes an ID that is assigned to each hierarchy items above hierarchical structure, and the ID included in the packet , while correlating and storing the name of the hierarchy item And ID corresponding item information storage unit that includes a temporary storage means for temporarily storing response-waiting or request packets waiting, a computer program for functioning as an operation information acquisition apparatus a computer having a city, to the computer Processing for acquiring packets transmitted and received between the file management server and the client terminal, determining a communication protocol from the data of the acquired packets, discarding packets of a certain size or more, Discards fragmented packets, network control packets, and unnecessary command packets in the protocol, and selects a packet corresponding to a predetermined protocol, and is included in the packet from among the filtered packets. request packet from the command also To determine whether the response packet is stored in the temporary storage means, whether or not from the request packet or response packet is stored in the temporary storage means, there is a packet including a command corresponding to the response-waiting or request packets waiting The client stored in the packet out of the combined packet and the process of combining the response packet with the request packet or the process of combining the request packet with the response packet when the corresponding command exists A process for determining whether or not there is a packet having a referenced unique identifier by referring to a unique identifier assigned from session establishment to session release between the terminal and the hierarchical item in the file management server, and the determination To identify which client has logged in, and A process of referring to the ID assigned to each hierarchy item stored in the specified packet and specifying the corresponding hierarchy item on the file management server with reference to the ID corresponding item information storage means And a method corresponding to the command or command package sequence with reference to the method definition storage unit based on the command completed by the request / response combining unit or the command package sequence completed by the sequence packet analyzing unit. A process for storing at least the date and time when the method occurs, information for identifying the client, information including the analyzed method, the hierarchy item as log data, and the stored log data. based on, to generate output data, is performed and outputting a And wherein the Rukoto.

According to the present invention, operation records accumulated in a server can be stored without imposing a load on the server, and monitoring of whether a file on the server has leaked to the outside, has been tampered with, or has been deleted. it can.
Further, all files on the server can be monitored without depending on the server model or OS.
In addition, since monitoring can be performed simply by connecting the apparatus to a client-server network, it is not necessary to change server settings even when the number of clients increases, and the labor of setting changes can be saved.
Furthermore, since the operation log data is not recorded on the monitoring target server but is stored on the device side that stores the log, it is possible to prevent the operation log data from being illegally accessed or falsified.

Hereinafter, an embodiment according to the present invention will be described with reference to the drawings.
FIG. 1 shows the overall configuration of the system according to the present embodiment.
FIG. 1 shows the overall configuration of a system using a server operation information storage device according to the present invention. A server 1 to be monitored and a LAN (Local Area Network) or WAN (Wide) are connected to the server 1. A plurality of client terminals 3 configured to be connectable via a predetermined network such as an area network), a switch 2 for switching communication data between the server 1 and the client terminal 3, and the switch 2 The access log acquisition device 4 is configured to be connectable to a network.

The server 1 is a computer capable of storing files that can be used by a plurality of client terminals 3.
The server 1 sends and receives files to and from each client terminal 3 by executing a predetermined OS and an application program installed as necessary, and according to an operation from the client terminal 3, You can create, change, and delete folders and files.
The server 1 may manage access authority for each client. In this case, the server 1 determines whether or not each client has an access right to the server 1 and the right for the client to perform processing such as new creation, change, and deletion for each folder or file for which the access right is set. Manage the authority of whether or not you have.

The client terminal 3 is a computer that can access the server 1 and perform operations such as creating, changing, deleting, and acquiring data of folders and files on the server 1.
The client terminal 3 is constituted by a so-called personal computer or the like, as long as it can be connected to the server 1 via the switch 2, and the OS and application program installed in the client terminal 3 are not particularly limited.
Data is transmitted / received between the server 1 and the client terminal 3 using packets.

The switch 2 is a so-called line concentrator, and performs processing for switching data between the server 1 and the client terminal 3 to perform data communication with each other.
The switch 2 may be a mirror port system that allows all data passing through a normal port of the switch to be copied and passed, a tap system, or a bridge system that is bridge-connected.
Then, the switch 2 duplicates packet data transmitted and received between the client and the server, and the access log obtaining apparatus 4 obtains the duplicated packet data.

The access log acquisition device 4 is a device that acquires an access log from the client terminal 3 to the server 1.
The access log acquisition device 4 is composed of a CPU (Central Processing Unit) and storage means such as a computer program executed by the CPU, a RAM (Random Access Memory) for storing computer programs and other data, and the like. The functional block shown in FIG. 2 is realized.
The functional block shown in FIG. 2 includes an ID correspondence information storage unit 41, a sequence processing information storage unit 42, an access record database 43, a network interface (I / F) 44, a primary filter 45, a protocol analysis processing unit 46, and a database registration. The processing unit 47 and the management screen display processing unit 48 are included.

The ID correspondence information storage unit 41 is a table that stores correspondences between the types of IDs included in the packets and the names of actual volumes, folders, and files in the server 1 according to the type of protocol. .
For example, in AFP (AppleTalk Filing Protocol), the volume, folder, and file are specified by ID in the numerical value set for each session, but when recording the monitoring log, the ID is recorded as it is. If this happens, the correspondence relationship between volumes, folders, and files in the file system of the server 1 will not be known. Therefore, the correspondence between IDs and actual volumes, folders, and files is previously defined in the ID correspondence information storage unit 41. It is a thing.
As data stored in the ID correspondence information storage unit 41, for example, as shown in FIG. 3, in the case of AFP, an ID type, a target AFP command packet, and a management item are stored in association with each other. As an example, in the case of a volume ID, the target AFP command packet is “FPGetVolParms”, “FPGetFileDirParms”, “FPEnumerate”, and the management items are ID and name.
The data stored in the ID correspondence information storage unit 41 is updated each time an AFP packet including ID and name information arrives, and corresponds to the actual file system data on the server 1. It is like that.

The sequence processing information storage unit 42 is a storage unit that stores a correspondence between a method to be stored and a command to be extracted according to the type of protocol.
For example, in AFP, reading and writing of a file is performed using a reference number (RefNo) for two forks of the file, that is, a data fork and a resource fork. Then, the file is accessed by performing FPRead or FPWrite with the acquired RefNo, and the RefNo is released with the FPCCloseFork.
Therefore, in order to monitor file access, it is necessary to trace the AFP command package sequence of FPopenFork, FPRead, FPWrite, and FPCCloseFork, and thus a command to be subjected to the sequence processing is defined.
As an example, FIG. 4 shows the case of AFP, and FIG. 5 shows the case of SMB protocol.
For example, as shown in FIG. 4, in the case of reading a file, AFP can record a log obtained by performing reading processing on a certain file by tracing in order of FPopenFork, FPRead, and FPCcloseFork.

The access record database 43 is a database of access log data. In the access record database 43, as shown in FIG. 6, item names and descriptions thereof can be stored in association with each other.
As item names, date, session, user, and method (method type and attached information, status code) can be stored.
Date, time, hour, minute, and microsecond can be stored.
A MAC address and an IP address can be stored in the session.
As a method, a status code (0 = OK, non-zero = NG) such as a method name, a full path name as attached information, and a target name at the time of renaming can be stored.
As the method name, as shown in the method list, new file creation, reading, writing, renaming, moving, deleting, creating a new folder, renaming, moving, deleting, logging in, and logging out.

The network interface 44 is an interface for the access log monitoring device 4 to connect to the network.
The network interface 44 is connected to the switching device 3 via a predetermined port, and performs processing for acquiring a packet flowing in the network by a logical interface based on a predetermined data format.

The primary filter 45 performs processing for discarding unnecessary packets from the acquired packets.
The primary filter 45 determines session information (MAC address, IP address), protocol (port), packet size, determines a packet to be discarded, and performs processing for discarding other unnecessary packets.
Thereby, since unnecessary packets can be filtered in advance, the processing can be made more efficient.

The protocol analysis processing unit 46 performs processing for analyzing a packet and acquiring a log according to a protocol.
The protocol analysis processing unit 46 acquires an access log from a client login, or acquires a log in which each client accesses a file.
Further, in order to make the access log to the file easier to understand, processing such as associating the ID in the packet with the volume, folder, and file in the server file system is performed.

  The database registration processing unit 47 performs processing for storing the log data analyzed by the protocol analysis processing unit 46 in the access record database 43.

  The management screen display processing unit 48 generates output screen data to be displayed on the management screen based on the access log data stored in the access record database 43, and performs processing to display this on a display (not shown). .

Next, the flow of processing of the entire system will be described with reference to FIG.
In FIG. 7, first, when a file acquisition request is made from the client terminal 3 to the server 1 (S1), this acquisition request is transmitted to the server 1 via the switch 2 (S2).
At the same time, the file acquisition request data is also transmitted to the access log acquisition device 4 by the mirroring function of the switch 2 (S3).
Thereby, the access log acquisition device 4 acquires packets via the network interface 44, filters the packets acquired by the primary filter 45, discards unnecessary packets, and the protocol analysis processing unit 46 determines which client Is accessed, and the log of which file or the like has been operated is analyzed, and the database registration processing unit 47 performs processing of storing the analyzed log data in the access record database 43.

The server 1 transmits a file acquisition response to the switch 2 in response to the acquisition request from the client terminal 3 (S4). The client terminal 2 receives a file acquisition response via the switch 2 and performs a predetermined process (S5).
At the same time, the switch 2 transmits a file acquisition response from the server 1 to the access log acquisition device 4 by the mirroring function (S6).
Thereby, the access log acquisition device 4 acquires packets via the network interface 44, filters the packets acquired by the primary filter 45, discards unnecessary packets, and the protocol analysis processing unit 46 determines which client The terminal 3 accesses the server 1 to analyze a log indicating which file or the like has been operated, and the database registration processing unit 47 performs processing of storing the analyzed log data in the access record database 43.
Then, the database registration processing unit 47 of the server 1 records the analyzed access log in the access record database 43 (S7). At this time, at least the date and time when the method was performed, the user, the contents of the method, and the like are stored.

  By repeatedly performing the processes from S1 to S7 between the server 1 and the client terminal 3, an access log to the server 1 is stored.

On the other hand, when an administrator views the access log recorded in the access log acquisition device 4 at a certain point in time, the administrator first displays the management screen from the server 1 or an administrator terminal connected to a network (not shown). A request is made (S11).
Thereby, the access record database 43 is referred to search for data corresponding to the designated item (S12).
When the search is completed, the management screen display processing unit 48 of the server 1 acquires search result data from the access record database 43 (S13), and displays the management screen on a display (not shown) (S14).

As the screen display, as shown in FIG. 8, the number of pages created for each operator corresponding to the client terminal 3 during a predetermined period (for example, every month) may be displayed. In this case, the number of pages created per week may be displayed separately.
Further, as shown in FIG. 9, it may be displayed when and who has accessed and what operation is performed for each file. In this example, when (for example, operator A) who performed what operation (for example, newly created) on “file A” (for example, February 3, 2006, 16:38) May be displayed as a list.
Furthermore, as shown in FIG. 10, the reference count of a specific file may be displayed in a graph for each week.

Next, a detailed processing flow of the primary filter 45 of the access log acquisition device 4 in the processing of S3 and S6 described above will be described. At this point, the network interface 44 has acquired a packet from the switch 2.
In FIG. 11, the primary filter 45 first determines whether or not there is session information from the acquired packets, and sets a packet that does not include these as a discarded packet. (S101).
Specifically, this process is performed by determining whether the packet includes a MAC address or an IP address.

If the session information is present as a result of the discrimination, the primary filter 45 discriminates the protocol, and those not applicable are discarded packets (S102).
This process is performed by extracting the port number included in the packet and determining whether the port number matches a predetermined port number. Note that a protocol (port) that can be supported in advance is stored and defined in a memory or the like, so that only packets corresponding to the protocol are extracted.

If the session information can be confirmed as a result of the determination, the primary filter 45 determines whether or not the packet size is equal to or larger than a certain size, and discards the packet larger than the certain size (S103).
Thereby, for example, a packet having a relatively large size, such as a data file that is not directly related to acquiring a file operation log, is discarded.

  As a result of the determination, if the packet size is equal to or smaller than a certain size, the primary filter 45 determines whether or not the packet is a TCP control packet, and discards the TCP control packet (S104).

The primary filter 45 determines whether or not the packet is a protocol-specific packet and is unnecessary for log analysis (S105).
Packets unnecessary for this log analysis are defined in advance and stored in the memory, and packets corresponding to the defined packets are discarded.

The primary filter 45 determines whether or not there is a fragmented packet, discards the second and subsequent packets of the fragmented packet (S106), and performs a process of filtering only the selected packet. . As a result, if fragmented, the operation log can be acquired if the first packet can be acquired, and the second and subsequent packets are discarded.
Thus, log analysis can be efficiently performed by discarding packets unnecessary for log analysis through the primary filter.

Next, the processing flow of the protocol analysis processing unit 46 in the above-described processing of S3 and S6 will be described with reference to FIG.
In FIG. 12, first, among the packets selected by the primary filter 45, the protocol analysis processing unit 46 performs a process of combining a request (Request) and a response (Reply) (S201).
As a result, the request and the response are combined, and it is possible to specify that one operation has been performed on the server 1.
Then, the protocol analysis processing unit 46 performs a protocol sequence analysis process (S202). As a result, a method for a file or the like on the server 1 can be specified.
Finally, the database registration processing unit 47 generates log registration items (S203), and ends the process.

Next, detailed processing of the protocol analysis processing unit 46 in the processing flow of FIG. 13 will be described.
First, a detailed processing flow when the protocol analysis processing unit 46 performs a request and reply combining process will be described with reference to FIG.
FIG. 13A shows the entire processing flow of request-join processing. In FIG. 13 (a), first, a command included in a packet is referred to and it is determined whether or not it is a request packet (S30).
If it is determined that the packet is a request packet, the process proceeds to a response combining process (S31).

As a response combining process, as shown in FIG. 13B, it is determined whether there is a response corresponding to the request packet with reference to the memory storing the request waiting queue (S311).
As a result of the determination, if there is a corresponding response, a response combining process is performed (S312).
If there is no corresponding response as a result of determination, the request packet is stored in the memory as a response waiting queue (S313), and the process is terminated.

If it is determined that the packet is not a request packet in the above-described processing of S30, it is determined whether or not the packet is a response packet with reference to a command included in the packet (S32).
If the packet is not a response packet as a result of the determination, the process ends by discarding the packet as not related to log acquisition.
If it is determined as a response packet as a result of the determination, the process proceeds to a request combining process (S33).

As the request combining process, as shown in FIG. 13C, first, it is determined whether or not there is a request corresponding to the response packet by referring to the memory storing the response waiting queue (S331).
As a result of the determination, if there is a corresponding request, a request combining process is performed (S332).
If there is no corresponding request as a result of determination, the response packet is registered in the request waiting queue (S333), and the process is terminated.

Next, processing when the protocol analysis processing unit 46 performs protocol sequence analysis processing will be described with reference to FIG.
In FIG. 14, first, a login sequence process of the client terminal 3 is performed to determine which client terminal 3 has logged in (S401).
For example, in the AFP protocol, login is performed in two stages, and there are two types of AFP command packets, FPLogin and FPCount. Therefore, this command is received and the client is identified by determining who it is. . These are analyzed as a login sequence and recorded in the access record database 43.

When the login sequence is completed, the ID held in the packet is associated with the name, and the correspondence table is updated as necessary (S402).
This processing refers to the ID correspondence information storage unit 41 shown in FIG. 3 and performs processing for specifying the names of volumes, folders, and files in the actual file system of the server 1 based on the ID in the packet.
For example, when a file is deleted by the AFP command FPDelete, the target file is given by “volume ID”, “parent folder ID”, and “file ID”. By drawing the correspondence table with these IDs, the complete path name of the file system on the server 1 can be acquired, and the complete path name can be recorded in the log.
Note that character code conversion processing may be performed for displaying Japanese names.

Finally, a file access sequence process is performed (S403), and the access analysis process ends.
In this sequence process, the sequence process information storage unit 42 shown in FIG. 4 or 5 is referred to, a command in the method list is extracted from the packet, and a process corresponding to which method is specified.
For example, in the case of reading a file in AFP, if the AFP command package sequence is FPOpenFork, FPRead, or FPCCloseFork, it is specified that this file reading process has been performed.
In addition, the time in the packet is extracted to specify the time at which the process was performed. Note that the correspondence table between the command and the log recording method may be held for each protocol. In the case of SMB, FIG. And a sequence process is executed for the corresponding command with reference to this table.

As described above, according to the above-described embodiment, the operation log data to the server 1 is acquired by the access log acquisition device 4 that is different from the server 1 without executing the access monitoring program on the server 1. Therefore, log data can be acquired without imposing a load on the server 1, and logs such as unauthorized access to the server 1 and creation, modification, and deletion of files can be acquired and monitored.
In addition, since the program is not executed on the server 1 and a packet on the network is acquired by the access log acquisition device 4 of another device and the log analysis is performed, it does not depend on the model or OS of the server 1. In both cases, log analysis according to various protocols can be performed on the access log acquisition device 4 side. As a result, regardless of the model of the server 1 and the OS, an operation log can be acquired as long as the communication protocol is compatible.

Since the monitoring can be performed simply by connecting the access acquisition device 4 to the network, there is no need to change the setting of the server 1 and the setting change can be saved.
Furthermore, since the acquired log data is recorded in the access log acquisition device 4 and does not exist in the server 1, the operation log data is illegally accessed by unauthorized access to the server 1. Or being tampered with.

  The above-described embodiment is an example, and can be appropriately changed without departing from the present invention.

It is a figure showing the whole system composition concerning one embodiment of the present invention. The functional block diagram concerning this embodiment. The figure which showed an example of the data memorize | stored in ID corresponding | compatible information storage part. The figure which showed an example of the data memorize | stored in a sequence process information storage part. The figure which showed an example of the data memorize | stored in a sequence process information storage part. The figure which showed an example of the data memorize | stored in an access record database. The figure which showed the flow of the process of the whole system. The figure which showed an example of the display of log data. The figure which showed another example of the display of log data. The figure which showed another example of the display of log data. The processing flow which showed the detailed process of the primary filter. A processing flow showing processing of the protocol analysis processing unit. The flowchart of a request-response combination process. Detailed processing flow of the protocol analysis processing unit.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Server, 2 ... Switch, 3 ... Client terminal, 4 ... Access log acquisition apparatus, 41 ... ID corresponding | compatible information storage part, 42 ... Sequence processing information storage part, 43. ..Access record database, 44... Network interface, 45... Primary filter, 46... Protocol analysis processing section, 47... Database registration processing section, 48.

Claims (4)

In a system comprising a file management server having a hierarchical file system and a plurality of client terminals connected to the file management server via a network, storing a plurality of files consisting of actual data and management data. An apparatus for connecting and acquiring log data related to an operation from a client terminal for the file management server,
And methods that represent the operation on the file management server from said client terminal, according to the type of protocol, in association with a command package sequence is a set of specific commands and specific commands required to perform each method A method definition storage means for storing;
Said management data includes an ID that is assigned to each hierarchy items above hierarchical structure, and the ID included in the packet, the ID corresponding item information store means corresponding with and stores the name of the hierarchical structure fields,
A temporary storage means for temporarily storing a response waiting packet or a request waiting packet ;
Packet acquisition processing means for acquiring packets transmitted and received between the file management server and the client terminal;
The communication protocol is determined from the acquired packet data, a packet of a certain size or more is discarded, and further, fragmented packets, network control packets, unnecessary command packets in the protocol are discarded, Filtering processing means for selecting packets corresponding to the selected protocol;
From the filtered packet, it is determined whether it is a request packet or a response packet from a command included in the packet, and is stored in the temporary storage unit. From the request packet or the response packet stored in the temporary storage unit, determine whether there is a packet including a command corresponding to the response-waiting or request packets waiting, the request to perform the binding processing of the request packet to the binding process or the response packet of the response packet to the request packet when the corresponding command exists A response coupling means;
From the combined packet, refer to the unique identifier that is stored in the packet and that is assigned from session establishment to session release between the client terminal and the hierarchical item in the file management server. Sequence packet analyzing means for determining whether or not there is a packet having an identifier;
Client identification means for referring to the determined packet and identifying which client has logged in;
An ID for identifying the corresponding hierarchical item on the file management server by referring to the ID assigned to each hierarchical item stored in the specified packet, referring to the ID corresponding item information storage means Corresponding item identification means,
A method for identifying a method corresponding to the command or command package sequence by referring to the method definition storage unit based on the command completed by the request / response combining unit or the command package sequence completed by the sequence packet analyzing unit Specific means,
At least the date and time when the method occurred, information identifying the client, information including the analyzed method, analysis result storage means for storing the hierarchical items as log data,
Output means for generating and outputting output data based on the log data stored in the analysis result storage means;
A server operation information acquisition apparatus characterized by comprising: The ID corresponding item specifying means updates the data corresponding to the ID and the hierarchical item name stored in the ID corresponding item information storing means every time a packet including ID and hierarchical item name information arrives.
The server operation information acquisition apparatus according to claim 1. In a system comprising a file management server having a hierarchical file system and a plurality of client terminals connected to the file management server via a network, storing a plurality of files consisting of actual data and management data. are connected, and methods that represent an operation on the file management server from said client terminal, according to the type of protocol, a command package sequence is a set of specific commands and specific commands required to perform the respective method, the a method definition storage means for association with each other, the management data includes an ID that is assigned to each hierarchy items above hierarchical structure, and the ID included in the packet, in association with the name of the hierarchy item storage and ID corresponding item information storage means for, response-waiting or requests waiting A temporary storage means for temporarily storing packets, a method performed by a device having,
A process of acquiring packets transmitted and received between the file management server and the client terminal;
The communication protocol is determined from the acquired packet data, a packet of a certain size or more is discarded, and further, fragmented packets, network control packets, unnecessary command packets in the protocol are discarded, Process to select the packet corresponding to the selected protocol,
From the filtered packet, it is determined whether it is a request packet or a response packet from a command included in the packet, and is stored in the temporary storage unit. From the request packet or the response packet stored in the temporary storage unit, Determining whether or not there is a packet including a command corresponding to the response waiting or request waiting packet, and processing for combining the response packet with the request packet or combining the request packet with the response packet when the corresponding command exists ,
From the combined packet, refer to the unique identifier that is stored in the packet and that is assigned from session establishment to session release between the client terminal and the hierarchical item in the file management server. Processing to determine whether there is a packet having an identifier;
A process of referring to the determined packet and identifying which client has logged in,
A process of referring to the ID assigned to each hierarchy item stored in the specified packet and specifying the corresponding hierarchy item on the file management server with reference to the ID corresponding item information storage means When,
Processing for identifying a method corresponding to the command or command package sequence by referring to the method definition storage unit based on the command completed by the request / response combining unit or the command package sequence completed by the sequence packet analyzing unit When,
At least the date and time when the method occurred, information for identifying the client, information including the analyzed method, and processing for storing the hierarchical items as log data;
A process of generating and outputting output data based on the stored log data;
A server operation information acquisition method characterized by comprising: In a system comprising a file management server having a hierarchical file system and a plurality of client terminals connected to the file management server via a network, storing a plurality of files consisting of actual data and management data. are connected, a method represented by the operations on the file management server from said client terminal, according to the type of protocol, a command package sequence is a set of specific commands and specific commands required to perform the respective method, the a method definition storage means for association with each other, the management data includes an ID that is assigned to each hierarchy items above hierarchical structure, and the ID included in the packet, in association with the name of the hierarchy item storage and ID corresponding item information storage means for, response-waiting or requests waiting A temporary storage means for temporarily storing packets, a computer program for functioning as an operation information acquisition apparatus a computer having a city,
For the above computer
A process of acquiring packets transmitted and received between the file management server and the client terminal;
The communication protocol is determined from the acquired packet data, a packet of a certain size or more is discarded, and further, fragmented packets, network control packets, unnecessary command packets in the protocol are discarded, Process to select the packet corresponding to the selected protocol,
From the filtered packet, it is determined whether it is a request packet or a response packet from a command included in the packet, and is stored in the temporary storage unit. From the request packet or the response packet stored in the temporary storage unit, Determining whether or not there is a packet including a command corresponding to the response waiting or request waiting packet, and processing for combining the response packet with the request packet or combining the request packet with the response packet when the corresponding command exists ,
From the combined packet, refer to the unique identifier that is stored in the packet and that is assigned from session establishment to session release between the client terminal and the hierarchical item in the file management server. Processing to determine whether there is a packet having an identifier;
A process of referring to the determined packet and identifying which client has logged in,
A process of referring to the ID assigned to each hierarchy item stored in the specified packet and specifying the corresponding hierarchy item on the file management server with reference to the ID corresponding item information storage means When,
Processing for identifying a method corresponding to the command or command package sequence by referring to the method definition storage unit based on the command completed by the request / response combining unit or the command package sequence completed by the sequence packet analyzing unit When,
At least the date and time when the method occurred, information for identifying the client, information including the analyzed method, and processing for storing the hierarchical items as log data;
A process of generating and outputting output data based on the stored log data;
A computer program that executes