JP5341604B2 - User log collection device and user log management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology for enabling the collection and integrated management of a user operation log by making a collection function for a window title log compatible with a 64-bit OS irrespective of compatibility with a 32-bit OS or the 64-bit OS. <P>SOLUTION: An m_bit window title log collection processing unit collects a window title log of an m_bit OS application that operates in an m_bit (i.e., m=64) OS environment and is activated. An emulator processes so that the m_bit OS application may be activated when an n (n&lt;m, e.g., n=32) bit OS application is activated. When the m_bit OS application is activated, direct activation is caught, and when the n_bit OS application is activated, the activation is caught through the emulator, thereby acquiring a window title log. The collected window title log is transmitted to a server apparatus at predetermined time intervals. <P>COPYRIGHT: (C)2011,JPO&amp;INPIT

Description

  The present invention relates to a user log collection device and a user log management system, for example, a technique for collecting window titles of applications.

  The collection and management of user operation logs in business terminals are regarded as important due to the recent increase in information leakage accidents and the spread of internal control momentum represented by the J-SOX method.

  Further, in recent years when improvement in computer processing performance is required, not 32-bit Windows (registered trademark) that can handle (recognize) memory up to 3 GB but 64-bit Windows (registered trademark) that can handle memory of 4 GB or more. ) May be used. In particular, this is a prominent example in which 64-bit Windows (registered trademark) is used by companies in the manufacturing industry who often use CAD software that requires a large amount of memory when creating a design drawing.

  Currently, as a user operation log collection / management tool, a 32-bit log collection tool that supports 32-bit OS and has a 32-bit log collection processing unit is used. This 32-bit log collection tool is disclosed in Patent Document 1, for example.

JP 2006-277518 A

  However, the conventional user operation log collection / management tool has a restriction that the operating environment is only 32 bit OS (processing unit is 32 bit), and is used on a 64-bit OS (processing unit is 64 bit) that has been used for workstations and servers. The operation log could not be collected in. Specifically, user operation logs are file operation logs collected when creating, copying, and deleting various files, drive addition operation logs collected when an external recording medium or external drive is connected, There are roughly three types of window title logs that collect window titles and the like, but since only the window title log collection function of these three types is not compatible with 64-bit OS, the collection of user operation logs is incomplete. It was.

  In recent years, as described above, a 64-bit OS is often used also in a personal computer. Therefore, it is desired that a user operation log collection / management tool fully supports the 64-bit OS.

  Although the needs of the user operation log collection tool and the 64-bit OS are increasing, the user operation log collection tool is not compatible with the 64-bit OS, and when the user operation log collection tool for 32-bit OS is installed in the 64-bit OS, the user operation log Since the processing unit of the collection tool is 32 bits, a log of a 64-bit window (a window when a 64-bit OS application is activated) cannot be collected.

  The present invention has been made in view of such a situation. The window title log collection function is made compatible with 64-bit OS, and the user operation log can be recorded regardless of whether the client computer is compatible with 32-bit OS or 64-bit OS. The technology to enable collection and centralized management is provided.

  In order to solve the above-described problem, the log collection device of the present invention includes an m_bit window title log collection processing unit and an emulator. The m_bit window title log collection processing unit operates in an m_bit (for example, 64-bit) OS environment, collects a window title log of an activated m_bitOS application with a processing unit as m_bit. The emulator performs processing so that the m_bitOS application is activated when the n (n <m) _bitOS application is activated. The m_bit window title log collection processing unit acquires the window title log by directly catching activation or activation of the window when the m_bitOS application is activated or when the window by the m_bitOS application is activated, and acquires the n_bitOS application. When the window is activated or the window by the n_bitOS application is activated, the activation or activation of the window is caught via the emulator to acquire the window title log, and the acquired window title log is stored in the log storage unit. In addition, the window title log collected in the log storage unit is transmitted to the server device at regular time intervals.

  Further, the log collection device includes an n_bit window title log collection processing unit and an OS determination unit. The n_bit window title log collection processing unit collects the window title logs of the activated n_bitOS application with the processing unit as n_bit. The OS determination unit determines the type of OS on which the user log collection device operates. When the OS determination unit determines that the user log collection device is operating in the m_bitOS environment, the m_bit window title log collection processing unit collects the window title log. On the other hand, when the OS determination unit determines that the user log collection device is operating in the n_bitOS environment, the n_bit window title log collection processing unit collects the window title log.

  In the present invention, the server device receives the window title log transmitted from the user log collection device. The server device also includes a database and a log distribution processing unit. This database stores a plurality of types of user operation logs including a window title log, and has at least a window title storage unit that manages only the window title log. The log distribution processing unit distributes the window title log among the plurality of types of user operation logs transmitted from the user log collection device to the window title log storage unit of the database. When sorting, a predetermined header is added to the window title log.

  Further features of the present invention will become apparent from the best mode for carrying out the present invention and the accompanying drawings.

  According to the present invention, the m_bit (64-bit) window title log that operates on the client computer of the m_bit (64-bit) OS can be collected, thereby expanding the range of log audits.

  Then, since logs of user operations can be collected on the m_bit (64-bit) OS, it is possible to centrally manage logs together with user operation logs on the n-bit (32-bit) OS in the database in the server computer. Here, n is a natural number smaller than m.

  In addition, it is possible to collect user operation logs, particularly window title logs, regardless of whether the OS of the client computer that collects user operation logs is an n_bit (32 bit) OS or an m_bit (64 bit) OS. The range of computers that can collect data can be expanded.

It is a figure which shows schematic structure of the server computer by embodiment of this invention. It is a figure which shows schematic structure of the client computer by embodiment of this invention. It is a figure for demonstrating the outline | summary of the window title log collection process in a 32-bit client computer. It is a figure for demonstrating the outline | summary of the window title log collection process in a 64-bit client computer. It is a flowchart for demonstrating the content of the window title log collection process in a client computer. It is a flowchart for demonstrating the content of the user operation log distribution process in a server computer. It is a figure which shows the structural content example of a window title log.

  The present invention provides a mechanism for collecting window title logs of both 64-bit OS applications and 32-bit OS applications in a client computer equipped with a 64-bit OS, and centrally managing user operation logs on the 32-bit OS and 64-bit OS client computers. It is about the mechanism.

  Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be noted that this embodiment is merely an example for realizing the present invention, and does not limit the technical scope of the present invention. In each drawing, the same reference numerals are assigned to common components.

<Hardware configuration>
The log collection system according to the embodiment of the present invention has a configuration in which a server computer 100 and a client computer 200 are connected via a network (not shown).

  FIG. 1 is a diagram showing a schematic configuration of a server computer 100 according to the present embodiment. In FIG. 1, a server computer 100 includes a transmission / reception unit 101 that transmits / receives data, a database 102 for centrally managing user logs acquired from a client computer 200, and various processing programs (a log distribution processing program 110 described later). A read only memory (ROM) 109 for storing various data, a CPU 111 for controlling various processes, a random access memory (RAM) 112 serving as a work area for various processes, a memory 113, and an HDD (hard disk drive) 114. And. Note that the database 102 may be configured to be included in the HDD 114. Various programs operate as each processing unit in cooperation with the CPU 111. For example, the log distribution processing program operates as a log distribution processing unit in cooperation with the CPU 111.

  The database 102 stores and manages a login log 103, a take-out operation log 104, and a user operation log 105. Among them, the user operation log 105 is a log in which user operations collected from the client computer 200 are recorded. The user operation log 105 holds a file operation log 106, a drive addition operation log 107, and a window title log 108.

  FIG. 2 is a diagram showing a schematic configuration of the client computer 200 according to the present embodiment. 2, a client computer 200 includes a ROM (Read Only Memory) 201 that stores various processing programs, a transmission / reception unit 208 that transmits and receives data, a CPU 209 that controls various processes, a work area for various processes, and the like. A random access memory (RAM) 210, a memory 211, and an HDD (hard disk drive) 212.

  The ROM 201 stores at least a user operation log collection program 202. The user operation log collection program 202 includes a file operation log collection program 203 that collects file operation logs including file copy, deletion, and creation by a user, and a log when a drive is added (device controller recognizes addition). A drive addition operation log collection program 204 for collecting the window title log, and a window title log collection program 205 for collecting a window title log of the application when the application is started. The window title log collection program 205 includes a 32-bit window title log collection program 206 for collecting an application window title log under a 32-bit OS operating environment and a 64-bit window for collecting an application window title log under a 64-bit OS operating environment. A window title log collection program 207.

  Various operation logs collected by each program are transmitted to the server computer 100 by the transmission / reception unit 208 at regular intervals. In addition, the window title log collection program 205 automatically determines the OS of the client computer 200 installed to determine whether to use the 32-bit window title log collection program 206 or the 64-bit window title log collection program 207. Start the appropriate program. Various programs operate as each processing unit in cooperation with the CPU 209. For example, the file operation log collection program operates as a file operation log collection processing unit in cooperation with the CPU 209.

<Window title log collection processing>
FIG. 3 is a diagram for explaining the outline of the window title log collection process executed by the 32-bit window title log collection program in a client computer having a 32-bit OS operating environment (hereinafter referred to as “32-bit OS client computer”). In the 32-bit OS client computer, the 32-bit window title log collection program 206 catches the activation signal of the 32-bit OS application, collects the window title log of the 32-bit active window 301 by the application, and writes it to the window title log file 302 in the HDD 212. Yes. In the present embodiment, the window title log collection time will be described mainly taking the case of starting up a 32-bit OS application as an example, but in addition, the 32-bit window title log collection program 206 generally has a window by a 32-bit OS application. It becomes active (activated. For example, in Windows (registered trademark), the title bar of the window changes from light blue to dark blue), the activation signal is caught and the window title log of the 32-bit active window 301 is displayed. Collecting.

  FIG. 4 is a diagram for explaining an outline of window title log collection processing in a client computer having a 64-bit OS operating environment (hereinafter referred to as “64-bit OS client computer”). FIG. 4A shows the operation when the 32-bit window title log collection program 206 is installed on a 64-bit OS client computer, and FIG. 4B shows the operation when the 64-bit window title log collection program 207 is installed on a 64-bit OS client computer. The 32-bit window title log collection program 206 is a program that sets the processing unit of the application activation signal to 32 bits, and the 64-bit window title log collection program 207 is a program that sets the processing unit of the signals to 64 bits.

  As shown in FIGS. 4A and 4B, in the 64-bit OS client computer, a 32-bit OS application is activated via the WOW 64. WOW64 is an emulator for starting a 32-bit OS application in a 64-bit OS environment. That is, as a result, the 32-bit processing unit is converted to 64-bit, and the 32-bit active window is recognized as a 64-bit active window.

  Therefore, as shown in FIG. 4A, in a 64-bit OS client computer, the processing unit is 64 bits even if it is a 32-bit OS application, as well as a 64-bit OS application, so a 32-bit window title log collection program 206 with a processing unit of 32 bits. Cannot catch the application activation signal and cannot collect window title logs.

  On the other hand, as shown in FIG. 4B, in the 64-bit OS client computer, the 64-bit window title log collection program 207 whose processing unit is 64 bits collects the window title logs of both the 32-bit active window 401 and the 64-bit active window 402. . As described above, this is because the 32-bit active window 401 is operated by WOW64 on a 64-bit OS, and thus is recognized as a 64-bit window. As a result, both the window title logs of the 32-bit active window 401 and the 64-bit active window 402 can be written to the window title log file 403.

  FIG. 5 is a flowchart for explaining the contents of the window title log collection process on the client computer 200.

  First, when the computer is activated, the window title log collection program 205 determines whether the OS of the client computer is a 64-bit OS or a 32-bit OS (step S501). When it is determined that the OS of the client computer 200 is not a 64-bit OS but a 32-bit OS, the window title log collection program 205 starts the conventional 32-bit window title log collection program 206 (step S502), and collects a 32-bit window title log. Perform (step 503).

  On the other hand, if it is determined that the OS of the client computer 200 is a 64-bit OS, the window title log collection program 205 starts the 64-bit window title log collection program (step 504) and collects the 32-bit window title log (step 504). S505) and 64-bit window title log collection processing (step S506) are executed.

  Then, the user operation log file including the collected window title log file is periodically transmitted to the server computer 100.

<Client log distribution processing on the server>
FIG. 6 is a flowchart for explaining the contents of the client log distribution process in the server computer 100.

  In FIG. 6, when the transmission / reception unit 101 of the server computer 100 receives a client log (file operation log, drive addition operation log, window title log) periodically transmitted from the client computer 200 (step S601), log distribution is performed. The program 110 is activated, and a header (for example, items 1 to 3 in FIG. 7) is added to each received log (step S602).

  Then, the log distribution program (log distribution processing unit) 110 selects one of the received logs and confirms the log type (step S603). If the log is a window title log, the log distribution program 110 stores the log in the window title log table 108 of the database 102 (step S604). If the log is a file operation log, the log distribution program 110 stores the log in the file operation log table 106 of the database 102 (step S605). Further, when the log is a drive addition operation log, the log distribution program 110 stores the log in the drive addition operation log table 107 of the database 102 (step S606).

  After any of the processes in steps S604 to S606, the log distribution program 110 determines whether there is an unprocessed log. If there is an unprocessed log, the process proceeds to step S603, and if not, the log distribution process ends.

  FIG. 7 is a diagram showing an example of the contents of the window title log stored in the window title log table 108 after the sorting process. Items 1 to 3 are header information provided in step S602 in the server computer 100.

  By executing the sorting process as described above, the server computer 100 can manage the client logs in a unified manner for each log type. Therefore, by checking this centrally managed client log, it is possible to recognize the operation executed in each client computer, and to easily find fraud and the like.

<Summary>
In this embodiment, in a 64-bit OS operating environment client computer, a 64-bit window title log collection processing unit having a processing unit of 64 bits catches direct activation and acquires a window title log when a 64-bit OS application is activated. On the other hand, when the 32-bit OS application is activated, the WOW 64 (emulator) processes the application so that the 64-bit OS application is activated, and the 64-bit window title log collection processing unit catches the activation via the WOW 64 and acquires the window title log. The acquired window title log is written to the window title log file. This makes it possible to acquire the window log title regardless of whether the 64-bit OS application or the 32-bit OS application is activated.

  The window title log written in the window title log file is transmitted to the server computer at regular time intervals. As a result, the server computer can centrally manage the window title log transmitted from each of the plurality of client computers.

  Further, the client computer determines the type of the OS and determines whether to operate either the 64-bit window title log collection processing unit or the 32-bit window title log collection processing unit. The collected window title log is transmitted to the server computer and managed. As a result, the server computer can centrally manage the window title log of each client computer regardless of whether the OS of the client computer is a 32-bit OS or a 64-bit OS.

  In the present specification, the embodiments have been described by taking 64-bit OS and 32-bit OS as examples. However, the types of OS provided by the present invention are not limited to these, and generalized to m_bitOS and n_bitOS. (M> n).

  The present invention can also be realized by software program codes that implement the functions of the embodiments. In this case, a storage medium in which the program code is recorded is provided to the system or apparatus, and the computer (or CPU or MPU) of the system or apparatus reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the program code itself and the storage medium storing the program code constitute the present invention. As a storage medium for supplying such program code, for example, a flexible disk, CD-ROM, DVD-ROM, hard disk, optical disk, magneto-optical disk, CD-R, magnetic tape, nonvolatile memory card, ROM Etc. are used.

  Also, based on the instruction of the program code, an OS (operating system) running on the computer performs part or all of the actual processing, and the functions of the above-described embodiments are realized by the processing. May be. Further, after the program code read from the storage medium is written in the memory on the computer, the computer CPU or the like performs part or all of the actual processing based on the instruction of the program code. Thus, the functions of the above-described embodiments may be realized.

  Also, by distributing the program code of the software that realizes the functions of the embodiment via a network, the program code is stored in a storage means such as a hard disk or memory of a system or apparatus, or a storage medium such as a CD-RW or CD-R And the computer of the system or apparatus (or CPU or MPU) may read and execute the program code stored in the storage means or the storage medium when used.

DESCRIPTION OF SYMBOLS 100 ... Server computer, 102 ... Database, 103 ... Login log, 104 ... Take-out operation log, 105 ... User operation log, 106 ... File operation log, 107 ... Drive addition operation log, 108 ... Window title log, 200 ... Client computer, 202 ... User operation log collection, 203 ... File operation log collection program, 204 ... Drive addition operation log collection program, 205 ... Window title log collection program, 206 ... 32-bit window title log collection program, 207 ... 64-bit window title log collection program, 301 ... 32-bit active window, 302 ... window title log file, 401 ... 32-bit active window, 402 ... 64-bit active window Doe, 403 ... window title log file

Claims (5)

A user log collection device that collects user operation logs,
an m_bit window title log collection processing unit that operates in an m_bitOS environment, sets the processing unit as m_bit, and collects the window title log of the activated m_bitOS application;
A log storage unit for storing the window title log;
an emulator that performs processing so that the m_bitOS application is activated when the n (n <m) _bitOS application is activated,
The m_bit window title log collection processing unit obtains the window title log by catching direct activation or activation of a window when the m_bitOS application is activated or when a window by the m_bitOS application is activated, When the n_bitOS application is activated or when a window by the n_bitOS application is activated, the activation or activation of the window is caught via the emulator to acquire the window title log, and the acquired window title log is stored in the log. A user log collection device characterized in that it is stored in a storage unit.   The user log collection device according to claim 1, further comprising a transmission unit configured to transmit the window title log collected in the log storage unit to the server device at regular time intervals. Further, an n_bit window title log collection processing unit that collects a window title log of an activated n_bitOS application with a processing unit of n_bit,
An OS determination unit that determines the type of OS on which the user log collection device operates,
When the OS determination unit determines that the user log collection device is operating in an m_bitOS environment, the m_bit window title log collection processing unit collects the window title log, and the user log collection device performs n_bitOS. The user log collection device according to claim 1, wherein the n_bit window title log collection processing unit collects the window title log when it is determined that it is operating in an environment. A user log collection device according to claim 2, and a server device connected to the user log collection device via a network,
The server device
A receiving unit for receiving a window title log transmitted from the user log collection device;
A database for storing a plurality of types of user operation logs including the window title log, the database having at least a window title storage unit for managing only the window title log;
Among a plurality of types of user operation logs transmitted from the user log collection device, a log distribution processing unit that distributes the window title log to the window title log storage unit of the database;
A user log management system comprising:   The user log management system according to claim 4, wherein the log distribution processing unit distributes the window title log to the window title log storage unit after adding a predetermined header to the window title log.

Images