JP5621490B2 - Log management program, log management apparatus, and log management method - Google Patents

Description

  The present invention relates to a log management program, a log management apparatus, and a log management method.

  In recent years, preventing information leakage is an important issue from the viewpoint of corporate compliance. Accordingly, a company needs to strictly manage operations on files that can cause information leakage, such as new registration, name change, editing, and printing. In view of this, in the technology for managing the operation log for a file, a log management system that generates an operation log for the file when an operation for the file is detected and centrally manages the generated operation log on the server side is known ( For example, see Patent Document 1). For example, when the log management system detects a new file registration operation, the log management system gives an ID of the new file to the operation log. Further, when the log management system detects a file name change operation, the log management system gives an ID before change and an ID after change to the operation log.

  This log management system uses a file ID when executing file tracking for tracking an original file of a specified file from a plurality of operation logs managed in a centralized manner. This log management system uses the ID of the specified file. For example, if the ID before the change of the specified file and the ID after the change of the comparison target file completely match, the specified file matches the comparison target file. Judgment is high. The log management system can trace the original file of the specified file based on the determination result.

JP 2008-146192 A

  The log management system recognizes that the comparison target file is the original file of the specified file and tracks the original file of the specified file when the ID before the change of the specified file and the ID after the change of the comparison target file completely match it can. However, the log management system, for example, determines that the probability that the file contents match is low when the ID before the change of the specified file and the ID after the change of the comparison target file are not completely the same and are partially different. As a result, the comparison target file is recognized as not being the original file of the specified file. As a result, the tracking of the original file of the specified file is interrupted.

  For example, even when the file name before the change of the specified file and the file name after the change of the comparison target file are partially different, the file contents may be the same. However, in this case, the log management system recognizes that the comparison target file is not the original file of the designated file, and the tracking of the original file of the designated file is interrupted.

  In one aspect, an object of the present invention is to provide a log management program or the like that can improve accuracy when estimating the accuracy of file identity.

  In one aspect, the disclosed program includes a reception step of receiving identification information for identifying a file in a computer, and size information indicating the identification information and the data size of the file for each operation on a plurality of files including the file. A first extraction step of extracting the operation log having the received identification information from the storage unit storing the operation log including the operation log, and another operation log different from the operation log is extracted from the storage unit. A second comparison step, a first comparison step for comparing identification information included in the operation log with other identification information included in the other operation log, size information included in the operation log, A second comparison step for comparing other size information included in another operation log, the first comparison step, and the second comparison step. Based on the result, and so as to execute a calculation step of calculating the a file identification information indicates the likelihood that indicates the relevance of the other identification information indicating other files.

  With the disclosed program, it is possible to improve the accuracy when estimating the accuracy of file identity.

FIG. 1 is a block diagram illustrating the configuration of the log management system according to the first embodiment. FIG. 2 is an explanatory diagram illustrating an example of an operation log database. FIG. 3 is an explanatory diagram showing an example of a file path accuracy table. FIG. 4 is an explanatory diagram showing an example of the data size accuracy table. FIG. 5 is an explanatory diagram illustrating an example of the trace result storage unit. FIG. 6 is a flowchart illustrating the processing operation of the server-side control unit related to the operation file trace processing according to the first embodiment. FIG. 7 is a flowchart illustrating the processing operation of the server-side control unit related to the accuracy calculation process according to the first embodiment. FIG. 8 is an explanatory diagram showing an example when a file is copied by changing the drive in the same client terminal. FIG. 9 is an explanatory diagram illustrating an example when a file operation is performed between client terminals. FIG. 10 is an explanatory diagram showing an example when the same file in the shared folder in the file server is copied to a plurality of client terminals. FIG. 11 is a flowchart illustrating the processing operation of the server-side control unit related to the accuracy calculation process according to the second embodiment. FIG. 12 is an explanatory diagram of a computer that executes a log management program.

  Hereinafter, embodiments of a log management program, a log management apparatus, and a log management method disclosed in the present application will be described in detail based on the drawings. The disclosed technology is not limited by the present embodiment.

  FIG. 1 is a block diagram illustrating the configuration of the log management system according to the first embodiment. A log management system 1 illustrated in FIG. 1 includes a client terminal 2, a management server 3 that manages the client terminal 2, and a management console 4 that executes various settings of the management server 3. The management server 3 has a function of recording an operation of the client terminal 2 that is a risk of information leakage to suppress problem behavior and preventing leakage of electronic information to the outside.

  Therefore, the management server 3 has functions such as a logon control / recording function, a policy management function, an operation restriction / recording function, a take-out file original storage function, and a service activation control function. First, the logon control / recording function is a function for recording logon and logoff of the client terminal 2 while prohibiting the logon of the client terminal 2 with an account authority that violates the policy. The policy management function is a function for setting prohibited operations and collected logs for each terminal and group of the client terminal 2.

  The operation restriction / recording function has functions such as an application activation prohibition function, a file operation restriction / recording function, a print screen key invalidation function, a mail transmission restriction / recording function, and a mail attachment restriction / recording function. The application activation prohibition function is a function for acquiring and managing application information already installed in the client terminal 2 and prohibiting activation of a designated application. Furthermore, the application activation prohibition function is a function that collects an operation log when the activation operation of the designated application is detected. The file operation restriction / recording function is a function for prohibiting movement, copying, printing, and the like of a file using an external medium from the client terminal 2 and temporarily canceling the prohibition. Furthermore, the file operation restriction / recording function is a function for recording, for example, file operations such as reference, creation, update, deletion, copying, movement, and rename as a log.

  Further, the print screen key invalidation function is a function for prohibiting the operation of the print screen key for obtaining a hard copy of the display screen of the client terminal 2 and recording the key operation as a log. The mail transmission restriction / recording function is a function for restricting mail transmission from the client terminal 2 to a specified address with a policy set on the administrator side and recording the mail. The file attachment restriction / recording function for mail is a function that restricts mail transmission with a file attached from the client terminal 2 according to a policy set on the administrator side and records the mail.

  The original file storage function is a function for compulsorily encrypting when file export from the client terminal 2 to the external recording medium is permitted. Further, the original storage function is a function for recording a log at the time of taking out and storing the original file on the management server 3 side. The service activation control function is a function that obtains a list of services that can be activated on the client terminal 2 and can restrict activation of any service by remote operation.

  Furthermore, the management server 3 has functions such as a device configuration change recording function, a screen capture function, a file tracking function, and a mail notification function. The device configuration change recording function is a function of determining that the device configuration has changed when an external recording medium such as a USB memory device is connected to the client terminal 2, and recording the log. The screen capture function is a function for acquiring a snapshot (hard copy) of the display screen when the title name of the display screen (window) of the client terminal 2 includes a specific application name or a specific keyword.

  The file tracking function is a function for searching an operation log of a corresponding file such as reference, creation, update, deletion, copying, movement, and renaming in the back trace direction or the forward trace direction based on the file operation log. The file trace function in the back trace direction is a function that searches the operation log of the corresponding file retroactively. The file trace function in the forward trace direction is a function for searching the operation log of the corresponding file in time series. The mail notification function is a function for notifying the management console 4 on the administrator side of a mail generated when a specific operation, for example, a violation operation is detected on the client terminal 2 side.

  The management server 3 illustrated in FIG. 1 includes a server-side communication unit 11, a server-side storage unit 12, and a server-side control unit 13. The server side communication unit 11 is connected to the client terminal 2 and the management console 4 for communication. The server-side storage unit 12 stores various types of information, and includes an operation log database 41, a file path accuracy table 42, a data size accuracy table 43, and a trace result storage unit 44.

  FIG. 2 is an explanatory diagram showing an example of the operation log database 41. The operation log database 41 illustrated in FIG. 2 manages an operation log including an operation date and time 41A, a PC name 41B, a user name 41C, an operation classification 41D, an original file 41E, and a destination file 41F. The operation date and time 41A corresponds to the date and time when an operation related to a file such as reference, creation, update, deletion, copying, printing, moving, and renaming is completed. The PC name 41B corresponds to the machine name of the client terminal 2 etc. that executed the file operation. The user name 41C corresponds to the user name for logging on the client terminal 2 that executed the file operation. The operation category 41D corresponds to an operation category such as reference, creation, update, deletion, copying, renaming, printing, and the like.

  The original file 41E manages the file path name 41G, the data size 41H, and the update date and time 41I with respect to the file at the operation start time. The file path name 41G corresponds to identification information indicating the location of the file at the start of the operation. The data size 41H corresponds to size information such as the data amount of the file at the start of operation. The update date and time 41I corresponds to the update date and time of the file at the operation start time. For example, the update date 41I of the original file is acquired from the file property information. That is, it is information on the date and time when the target file in the operation log was last updated. The destination file 41F manages the file path name 41J, the data size 41K, and the update date and time 41L with respect to the file at the end of the operation. The file path name 41J corresponds to identification information indicating the location of the file at the end of the operation. The data size 41J corresponds to the data amount of the file at the end of the operation. The update date / time 41L corresponds to the update date / time of the file at the end of the operation. One record of the operation log is generated by the client terminal 2 for each operation on a certain file and managed by the management server 3. That is, the destination file that is the result of one operation on the original file is managed by one operation log for a certain file.

  FIG. 3 is an explanatory diagram showing an example of the file path accuracy table 42. The file path accuracy table 42 shown in FIG. 3 manages the accuracy 42B in association with the file path comparison definition 42A. The file path comparison definition 42A is a definition for comparing file paths.

  For example, when the comparison definition 42A is “perfect match with full path”, the accuracy 42B is “5”. When the comparison definition 42A is “exact match except drive name”, the accuracy 42B is “4”. When the comparison definition 42A is “matches after folder name”, the accuracy 42B is “3”. When the comparison definition 42A is “match only file name”, the accuracy 42B is “2”. When the comparison definition 42A is “part of the file name matches”, the accuracy 42B is “1”.

  Now, the file path comparison definition 42A will be described with a specific example. For example, the file path of the specified file is “C: \ AAA \ BBB \ CCC.txt”. At this time, if the file path of the comparison target file to be compared with the specified file is “C: \ AAA \ BBB \ CCC.txt”, the comparison definition 42A is “full path complete match”. As a result, the accuracy 42B is “5”. When the file path of the comparison target file is “F: \ AAA \ BBB \ CCC.txt”, the comparison definition 42A is “exact match except for the drive name”. As a result, the accuracy 42B is “4”. Note that the accuracy is set even for drives other than those assigned drive letters. In other words, for “F: \ AAA \ BBB \ CCC.txt”, like “\\ ServerName \ AAA \ BBB \ CCC.txt” and “\\ 192.168.0.3 \ AAA \ BBB \ CCC.txt” Even in the path configuration, it can be estimated that there is a high possibility that the designated file and the comparison target file match.

  Also, when the file path of the comparison target file is “E: \ BBB \ CCC.txt”, the comparison definition 42A is “Folder name and later match”. As a result, the accuracy 42B is “3”. When the file path of the comparison target file is “C: \ DDD \ CCC.txt”, the comparison definition 42A is “matches only the file name”. As a result, the accuracy 42B is “2”. When the file path of the comparison target file is “C: \ DDD \ CCCEE.txt”, the comparison definition 42A is “part of the file name matches”. As a result, the accuracy 42B is “1”.

  FIG. 4 is an explanatory diagram showing an example of the data size accuracy table 43. The data size accuracy table 43 shown in FIG. 4 manages the accuracy 43B in association with the data size comparison definition 43A. The data size comparison definition 43A is a definition for comparing the data sizes of files. For example, when the comparison definition 43A is “perfect match”, the accuracy 43B is “0.5”. When the comparison definition 43A is “data size difference within ± 5%”, the accuracy 43B is “0.3”. When the comparison definition 43A is “data size difference within ± 10%”, the accuracy 43B is “0.1”.

  FIG. 5 is an explanatory diagram illustrating an example of the trace result storage unit 44. The trace result storage unit 44 illustrated in FIG. 5 stores, as trace results, operation logs that are sequentially extracted using a file tracking function that tracks operation logs related to files with high probability of matching with the specified file. In the case of file tracing in the back trace direction, the trace result storage unit 44 uses, as a trace result, an operation log of a file whose accuracy that matches the specified file from the operation log before the operation date and time of the operation log related to the specified file is equal to or more than a threshold value. Store sequentially. In the case of the file trace function in the forward trace direction, the trace result storage unit 44 sequentially selects, as trace results, operation logs of files that are equal to or greater than the threshold value that matches the specified file from operation logs after the operation date and time of the operation log related to the specified file. Store.

  The trace result storage unit 44 stores the trace result of the operation log including the operation date / time 44A, the PC name 44B, the user name 44C, the operation classification 44D, the original file 44E, the destination file 44F, and the accuracy 44G. The operation date and time 44A corresponds to the date and time when an operation related to a file such as reference, creation, update, deletion, copying, printing, moving, or renaming is completed. The PC name 44B corresponds to the machine name of the client terminal 2 etc. that executed the file operation. The user name 44C corresponds to the user name for logging on the client terminal 2 that executed the file operation. The operation category 44D corresponds to an operation category such as reference, creation, update, deletion, copying, renaming, printing, and the like. The original file 44E manages the file path name, the data size, and the update date and time with respect to the file at the operation start time. The destination file 44F manages the file path name, the data size, and the update date and time with respect to the file at the end of the operation. The accuracy 44G corresponds to the accuracy related to the operation log.

  The server side control unit 13 includes an extraction unit 51, a comparison unit 52, a calculation unit 53, and a control unit 54. When the extraction unit 51 detects a designated file designation operation, the extraction unit 51 manipulates a comparison target file including a file path similar to the file path of the designated file from the operation log database 41 storing a file operation log including the file path and the data size. Extract logs. The designated file designation operation corresponds to, for example, an operation for receiving an instruction of a designated file to be tracked from the management console 4. For example, the administrator can access the management server 3 and browse the operation log. The administrator designates a desired operation log from the operation log being browsed. Information on the designated operation log is transmitted from the management console 4 to the management server 3, and the management server 3 may perform backtrace or forward trace with the destination file corresponding to the received operation log information as the designated file. good. Further, the administrator may simply input the file path. In this case, the designation operation may be executed when the management server 3 receives the input file path.

  When the extraction unit 51 traces a file in the backtrace direction related to the specified file, the comparison target includes the file path of the destination file similar to the file path of the original file of the specified file in the operation logs before the operation date and time of the specified file. Extract the file operation log. Note that the extraction unit 51 operates as a first extraction unit and a second extraction unit.

  Further, when extracting the operation log of the comparison target file, the extraction unit 51 sets this comparison target file as the next designated file. Further, the extraction unit 51 extracts the operation log of the comparison target file including the file path of the destination file similar to the file path of the original file of the next designated file.

  The comparison unit 52 includes a file path comparison unit 52A and a data size comparison unit 52B. The file path comparison unit 52A operates as a first comparison unit. When the extraction unit 51 extracts the operation log of the comparison target file, the file path of the original file of the specified file and the file path of the destination file of the comparison target file Compare Further, the data size comparison unit 52B operates as a second comparison unit, and compares the data size of the original file of the designated file with the data size of the destination file of the comparison target file.

  The calculation unit 53 acquires the file path accuracy 42B corresponding to the comparison definition 42A corresponding to the file path comparison result by the file path comparison unit 52A from the file path accuracy table 42. The calculation unit 53 acquires the data size accuracy 43B corresponding to the comparison definition 43A corresponding to the data size comparison result by the data size comparison unit 52B from the data size accuracy table 43. The calculation unit 53 adds the accuracy of the file path and the accuracy of the data size, and calculates the addition result as the accuracy of the file identity where the designated file matches the comparison target file. Note that when the accuracy of the file path is “3” and the accuracy of the data size is “0.5”, the calculation unit 53 determines that the accuracy of the file identity that matches the files is “3” + “0.5” = “3.5”. Note that the calculation method is not limited to addition but may be multiplication.

  The control unit 54 determines whether or not the accuracy of file identity is equal to or greater than a threshold value. For example, the threshold value is “1”. When the accuracy of the file identity is equal to or greater than the threshold value, the control unit 54 associates the accuracy 44G with the operation log of the comparison target file related to the specified file and stores it in the trace result storage unit 44 as a trace result. Further, the extraction unit 51 extracts an operation log of a new comparison target file including the file path of the destination file similar to the file path of the original file of the specified file when the accuracy of the file identity is not equal to or greater than the threshold value. The extraction unit 51 performs the operation log extraction operation when the number of trace results stored in the trace result storage unit 44 exceeds the specified number, or until the operation log of a new comparison target file cannot be extracted. continue. In addition, when there are a plurality of operation logs of the comparison target file including the file path of the destination file similar to the file path of the specified file, the extraction unit 51 extracts the operation logs of all the comparison target files. Until it is done, the operation log extraction operation is continued.

  The management console 4 illustrated in FIG. 1 corresponds to, for example, a personal computer or the like, and includes a management-side communication unit 21, a management-side display unit 22, a management-side operation unit 23, a management-side storage unit 24, and a management-side control unit 25. And have. The management communication unit 21 is connected to the management server 3 for communication. The management-side display unit 22 corresponds to, for example, a monitor unit that displays various types of information on the screen. The management side operation unit 23 corresponds to, for example, a mouse or a keyboard for inputting various information. The management-side storage unit 24 stores various information. The management-side control unit 25 controls the entire management console 4. The management console 4 can appropriately change the comparison definition, the accuracy content, and the like in the file path accuracy table 42 and the data size accuracy table 43 in the server-side storage unit 12 according to the setting operation.

  The client terminal 2 corresponds to, for example, a personal computer or the like, and includes an operation unit 31, a display unit 32, a storage unit 33, a communication unit 34, and a control unit 35. The operation unit 31 corresponds to, for example, a mouse or a keyboard for inputting various information. The display unit 32 corresponds to, for example, a monitor unit that displays various information on the screen. The storage unit 33 is a part that stores various types of information. The communication unit 34 is a part that is connected to the management server 3 and is connected to a network (not shown). In addition, the client terminal 2 employs a multi-user method that allows a plurality of users to use different logon user names.

  Next, the operation of the log management system 1 according to the first embodiment will be described. FIG. 6 is a flowchart showing the processing operation of the server-side control unit 13 related to the operation file trace processing. In FIG. 6, the server-side control unit 13 detects a trace target designation file by a designation operation on the management console 4 side (step S11). The server-side control unit 13 determines whether or not the operation log of the comparison target file including the file path of the destination file similar to the file path of the original file in the specified file is extracted from the operation log database 41 through the extraction unit 51. (Step S12). Here, the server-side control unit 13 extracts an operation log having a file path that matches a part of the file name in the file path of the original file in the designated file. Here, all the corresponding operation logs may be extracted, and the following processing may be executed on all the extracted operation logs.

  When the server-side control unit 13 extracts the operation log of the comparison target file including the file path of the destination file similar to the file path of the original file in the specified file (Yes in step S12), the accuracy shown in FIG. Calculation processing is executed (step S13). In the accuracy calculation process, the accuracy of the file identity where the specified file matches the comparison target file is calculated.

  After calculating the file identity accuracy in the accuracy calculation process, the server-side control unit 13 determines whether or not the file identity accuracy is equal to or greater than a threshold value through the control unit 54 (step S13A). When the accuracy of the file identity is equal to or greater than the threshold (Yes at Step S13A), the server-side control unit 13 stores the trace result in which the accuracy is associated with the operation log of the comparison target file in the trace result storage unit 44 ( Step S14). When the server-side control unit 13 stores the trace result in the trace result storage unit 44, the server-side control unit 13 increments the number of stored trace results by +1 (step S15), and determines whether or not the number of stored trace results is within a specified number (step S15). Step S16).

  When the stored number of trace results is within the specified number (Yes in step S16), the server-side control unit 13 sets the operation log of the comparison target file as the operation log of the next specified file. Further, the server-side control unit 13 extracts the operation log of the comparison target file including the file path of the destination file similar to the file path of the original file in the next designated file through the extraction unit 51 from the operation log database 41. Whether or not (step S17).

  When the server-side control unit 13 extracts the operation log of the comparison target file including the file path of the destination file similar to the file path of the original file in the next specified file (Yes in step S17), the accuracy of the file identity Is shifted to step S13.

  Further, when the operation log of the comparison target file cannot be extracted (No at Step S17), the server side control unit 13 determines whether or not the operation log of another comparison target file related to the specified file detected at Step S11 is extracted. Determination is made (step S18). That is, the server-side control unit 13 determines whether or not the operation log of another comparison target file including the file path of the previous file similar to the file path of the specified file detected in step S11 is extracted from the operation log database 41. judge. When the server-side control unit 13 extracts an operation log of another comparison target file (Yes at Step S18), the server-side control unit 13 proceeds to Step S13 so as to execute an accuracy calculation process described later. In addition, when the operation log of another comparison target file cannot be extracted (No at Step S18), the server side control unit 13 presents the trace result related to the specified file stored in the trace result storage unit 44 to the management console 4. (Step S19), the processing operation shown in FIG. The management console 4 displays the trace result related to the specified file from the management server 3 on the management side display unit 22 on the screen. As a result, the administrator can see the display contents of the management-side display unit 22 and recognize the trace result related to the locus of the file with high probability of matching with the designated file.

  If the number of trace results stored is not less than the specified number (No at Step S16), the server side control unit 13 proceeds to Step S18 to extract operation logs of other comparison target files.

  Moreover, the server side control part 13 complete | finishes the process operation shown in FIG. 6, when the operation log of a comparison object file cannot be extracted (step S12 negative). Further, when the accuracy is not equal to or higher than the threshold value (No at Step S13A), the server side control unit 13 proceeds to Step S12 in order to extract a new operation log.

  In the operation file trace processing shown in FIG. 6, if the accuracy of the file identity where the specified file matches the comparison target file is equal to or greater than the threshold value, the trace result in which the accuracy is associated with the operation log is sequentially stored in the trace result storage unit 44. Store. Since the management server 3 presents the trace result stored in the trace result storage unit 44 on the display screen of the management console 4, the administrator can track the file source of the specified file. As described above, if only one operation is performed on a certain file, it is possible to track the original file and the destination file included in one operation log. However, since a plurality of operation logs are generated in the client terminal 2 by performing a plurality of operations, the management server 3 that performs file tracing needs to specify the relationship between the operation logs. Through the above-described processing, the management server 3 can identify the related operation log and track the file.

  Furthermore, when there are a plurality of client terminals 2 or when there are a plurality of users who perform file operations, a certain file may be operated by the plurality of client terminals 2 or a plurality of users. In this case, each client terminal 2 may generate a large amount of operation logs related to a certain file. Therefore, as in this embodiment, the management server 3 comprehensively manages, so that the file trace can be executed more widely in the plurality of client terminals 2 and users managed by the management server 3.

  FIG. 7 is a flowchart showing the processing operation of the server-side control unit 13 related to the accuracy calculation processing. In FIG. 7, the server-side control unit 13 compares the file path of the original file of the designated file with the file path of the destination file of the comparison target file through the file path comparison unit 52A (step S21). The server-side control unit 13 acquires the file path accuracy 42B corresponding to the comparison definition 42A corresponding to the comparison result between the file paths from the file path accuracy table 42 through the calculation unit 53 (step S22).

  Further, the server side control unit 13 compares the data size of the original file of the designated file with the data size of the destination file of the comparison target file through the data size comparison unit 52B (step S23). The server-side control unit 13 acquires the data size accuracy 43B corresponding to the comparison definition 43A corresponding to the comparison result between the data sizes from the data size accuracy table 43 through the calculation unit 53 (step S24).

  The server-side control unit 13 adds the accuracy of the file path and the accuracy of the data size through the calculation unit 53 to calculate the accuracy of the file identity where the designated file matches the comparison target file (step S25). The processing operation shown in FIG.

  In the accuracy calculation process shown in FIG. 7, the accuracy of the file identity that matches the specified file and the comparison target file is calculated based on the accuracy of the file path between the specified file and the comparison target file and the accuracy of the data size. As a result, it is possible to improve accuracy related to the accuracy of file identity.

  In the first embodiment, based on the accuracy of the file path and the accuracy of the data size among the plurality of operation logs related to the file, the accuracy of the file identity that matches the specified file and the comparison target file is calculated. As a result, the accuracy when estimating the accuracy of file identity can be improved by taking into account the data size in addition to the file path.

  In the first embodiment, since the accuracy when estimating the accuracy of file identity can be improved, the tracking accuracy when tracking the original file of the specified file can be improved.

  In the first embodiment, the file path accuracy corresponding to the file path comparison result is acquired from the file path accuracy table 42, and the data size accuracy corresponding to the data size comparison result is acquired from the data size accuracy table 43. As a result, the accuracy of the file path between the files and the accuracy of the data size can be easily obtained.

  In the first embodiment, as the accuracy of the data size increases, the accuracy of matching files increases. As a result, for example, even when the file paths are the same, the accuracy in estimating the file identity accuracy can be improved by taking the data size into consideration.

  In the first embodiment, the operation log for the file operation is recorded including the file size at the start of the operation, that is, the data size of the original file, and the file at the end of the operation, that is, the data size of the destination file. As a result, the management server 3 can recognize the data size of the file at the operation start point and the operation end point.

  In the first embodiment, file tracking between files can be realized under the conditions shown in FIGS. FIG. 8 is an explanatory diagram showing an example when a file is copied by changing the drive in the same client terminal 2. When the same client terminal 2 copies the file a as the file b in the folder “\ A” of the same drive “D: \”, the original file of the operation log is “D: \ A \ a”, and the destination file is “ D: \ A \ b ”and the operation classification is“ Copy ”. Further, after the client terminal 2 changes the drive “D: \” to the drive “E: \”, when the client terminal 2 copies the file b as the file c, the original file of the operation log is “E: \”. A \ b ", the destination file is" E: \ A \ c ", and the operation category is" Copy ". The original file “E: \ A \ b” of the specified file is different from the destination file “D: \ A \ b” of the comparison target file.

  However, even when a file with the same contents is copied by changing the drive, the management server 3 copies the file path “of the destination file partially similar to the file path“ E: \ A \ b ”of the original file in the specified file. Operation logs of comparison target files including “D: \ A \ b” can be extracted. Therefore, the accuracy “4” of the file path “complete match except drive name” is acquired. As a result, since only the accuracy of the file path exceeds the threshold, this operation log is stored in the trace result storage unit 44 as a trace result. In addition to the file path, the file tracking of the specified file and the comparison target file can be realized by considering the data size. For example, if the degree of coincidence between the file size at the end of an operation and the file size at the start of another operation is high, there is a possibility that another operation has been performed on the file that has been operated. It can be estimated to be high.

  FIG. 9 is an explanatory diagram showing an example when a file operation is performed between the client terminals 2A and 2B. When the file a is copied as the file c in the client terminal 2A (step S101), the operation log source file related to step S101 is “C: \ a”, the destination file is “C: \ c”, and the operation classification Becomes "copy". Further, when the file b is copied to the USB memory 6 as the file b in the client terminal 2A (step S102), the client terminal 2A recognizes the USB memory 6 as the F drive. At this time, the original file of the operation log related to step S102 is “C: \ b”, the destination file is “F: \ b”, and the operation classification is “copy”.

  Further, when the client terminal 2B copies the file b copied in the USB memory 6 as the file e (step S103), the client terminal 2B recognizes the USB memory 6 as the G drive. At this time, the original file of the operation log related to step S103 is “G: \ b”, the destination file is “C: \ e”, and the operation classification is “copy”.

  When the client terminal 2B prints the file a (step S104), the original file of the operation log related to step S104 is “C: \ a”, and the operation classification is “print”. Further, when the client terminal 2B copies the file a as the file d (step S105), the operation log source file related to step S105 is “C: \ a”, the destination file is “C: \ d”, and the operation classification. Becomes "copy".

  For example, when the management server 3 executes the file locus of the specified file e from the management console 4, the management server 3 compares the comparison target file of the original file “G: \ b” corresponding to the destination file “C: \ e” of the specified file e. The operation log in step S103 is extracted. Further, the management server 3 extracts the operation log in step S102 of the comparison target file of the destination file “F: \ b” that is partially similar to the original file “G: \ b” of the designated file. As a result, the management server 3 selects “C: \ e” → “G: \ b” → “F: \ b” based on the trace result relating to the operation log in step S102 and step S103 as the file locus of the designated file e. → “C: \ b” is presented on the display screen of the management console 4 as a trace result.

  That is, even when the same file is copied by changing the drive, the operation log of the comparison target file including the file path of the destination file partially similar to the file path of the original file in the specified file can be extracted. Even if the USB memory 6 is straddled, the file trace between the designated file and the comparison target file can be realized using the file path and the data size.

  FIG. 10 is an explanatory diagram showing an example when the same file in the shared folder in the file server is copied to a plurality of client terminals 2. The client terminal 2A recognizes the shared folder as “\\ 192.168.0.3 \ aaa”. On the other hand, the client terminal 2B recognizes the shared folder as “\\ FileSV3 \ aaa”. Assume that the client terminals 2A and 2B copy the file a stored in the shared folder in the file server 7 as the file b.

  At this time, since the file b of the client terminal 2A and the file b of the client terminal 2B have different shared folder recognition names, the file paths are different even though the file contents are the same. However, in the first embodiment, the file path of the client terminal 2A and the file path of the client terminal 2B are partially similar, and the file size between the files can be realized by using the data size.

  In the first embodiment, even when the drive letter of the same file is changed and the file is copied in the same client terminal 2, the file tracking between files can be realized using the file path and the data size.

  In the first embodiment, even when the file is transferred from the client terminal 2 to a portable external recording medium such as the USB memory 6 and the drive letter of the file is changed, the file path and the data size are used. File tracking can be realized.

  In the first embodiment, even when the file in the client terminal 2 is copied to a portable external recording medium and the file on the external recording medium is copied to another client terminal 2 and the drive letter of the file is changed, the file File tracking between files can be realized using the path and data size.

  In the first embodiment, the accuracy of the file identity between the specified file and the comparison target file is calculated based on the accuracy of the file path and the accuracy of the data size. However, since the accuracy in estimating the accuracy of the file identity can be improved, update date / time information such as file update date / time may be considered in addition to the file path and data size.

  Therefore, an embodiment in this case will be described. The same components as those in the log management system 1 according to the first embodiment are denoted by the same reference numerals, and the description of the overlapping configuration and operation is omitted. FIG. 11 is a flowchart illustrating the processing operation of the server-side control unit 13 related to the accuracy calculation processing according to the second embodiment.

  In FIG. 11, the server-side control unit 13 acquires the accuracy of the file path and the accuracy of the data size by executing the processing operations in steps S21 to S24. Furthermore, the server-side control unit 13 compares the file update date and time of the original file of the designated file with the file update date and time of the destination file of the comparison target file through the comparison unit 52 (step S31). The server-side control unit 13 acquires the accuracy of the file update date and time corresponding to the comparison definition corresponding to the comparison result between the file update dates and times from the update date and time table (not shown) through the calculation unit 53 (step S32). The update date / time table is managed, for example, in the server-side storage unit 12, and when the file update date / time completely matches, for example, the accuracy “1” is managed.

  The server-side control unit 13 adds the accuracy of the file path, the accuracy of the data size, and the accuracy of the file update date and time through the calculation unit 53, and calculates the accuracy of the file identity that matches the files (step S33). The processing operation shown in FIG. 11 ends.

  In the accuracy calculation process shown in FIG. 11, the accuracy of the file identity is calculated based on the accuracy of the file path between the specified file and the comparison target file, the accuracy of the data size, and the accuracy of the file update date and time. As a result, the accuracy in estimating the accuracy of file identity can be greatly improved.

  In the accuracy calculation process shown in FIG. 11, the file update date / time comparison is performed after the data size comparison process is executed, but the order is not limited to this. Alternatively, the accuracy may be calculated by comparing only the file update date and time without performing the data comparison process.

  In the second embodiment, the file identity accuracy between the specified file and the comparison target file is calculated based on the file path accuracy, the data size accuracy, and the file update date and time among the plurality of operation logs related to the file. As a result, the accuracy related to the accuracy of file identity can be greatly improved.

  Note that the calculation unit 53 of the second embodiment, for example, determines the file identity when the file path accuracy is “4”, the data size accuracy is “0.5”, and the file update date / time accuracy is “1”. The accuracy of the file identity was calculated by simply adding the accuracy as “4 + 0.5 + 1 = 5.5”. However, if the data size is “complete match”, the accuracy is “0.5”, the file update date is “complete match”, and the accuracy is “1”, it is determined that the accuracy of the file identity is high, and the addition is simply performed. Then, “1.5” is not used, but “+1” may be added for weighting to “2.5”.

  In the first embodiment, when calculating the accuracy of the file identity, the accuracy of the data size is considered in addition to the accuracy of the file path. However, the accuracy of the file update date is considered instead of the data size. You may make it do.

  In the first embodiment, when calculating the accuracy of the file identity, the accuracy of the data size is acquired after acquiring the accuracy of the file path, but the accuracy of the file path is acquired after acquiring the accuracy of the data size, or The data size and the file path accuracy may be acquired at the same time. That is, the order of accuracy acquisition can be changed as appropriate.

  In the above embodiment, the management server 3 automatically collects operation logs related to the files of the client terminal 2 and records the collected operation logs in the operation log database 41.

  In the above embodiment, the accuracy of the file path, data size, or file update date / time is set for each comparison definition, but the definition and the numerical value of the accuracy can be appropriately changed.

  In addition, each component of each part illustrated does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each part is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed / integrated in arbitrary units according to various loads and usage conditions. Can be configured.

  Furthermore, various processing functions performed in each device are performed on a CPU (Central Processing Unit) (or a microcomputer such as an MPU (Micro Processing Unit), MCU (Micro Controller Unit), etc.) in whole or in part. You may make it perform. Various processing functions may be executed entirely or arbitrarily on a program that is analyzed and executed by a CPU (or a microcomputer such as an MPU or MCU) or hardware based on wired logic. Needless to say.

  By the way, the various processes described in the present embodiment can be realized by executing a prepared program on a computer. In the following, an example of a computer that executes a program having the same function as that of the above embodiment will be described with reference to FIG. FIG. 12 is an explanatory diagram of a computer that executes a log management program.

  As shown in FIG. 12, a computer 200 as a log management program is configured by connecting a hard disk drive (HDD) 210, a random access memory (RAM) 220, a read only memory (ROM) 230, and a CPU 240 via a bus 250. The

  The ROM 230 stores in advance a log management program that exhibits the same function as in the above-described embodiment. As shown in FIG. 12, the log management program includes a reception program 231, a first extraction program 232, a second extraction program 233, a first comparison program 234, a second comparison program 235, and a calculation program 236. Note that the programs 231 to 236 may be appropriately integrated or distributed in the same manner as each component of the management server 3 shown in FIG.

  Then, the CPU 240 reads these programs 231 to 236 from the ROM 230 and executes them. As shown in FIG. 12, the programs 231 to 236 function as a reception process 241, a first extraction process 242, a second extraction process 243, a first comparison process 244, a second comparison process 245, and a calculation process 246. It becomes like this.

  CPU 240 receives identification information for identifying a file. For each operation on a plurality of files including the file, the CPU 240 receives the operation log having the received identification information from the HDD 210 storing the operation log including the identification information and size information indicating the data size of the file. Extract. The CPU 240 extracts another operation log different from the operation log from the HDD 210. The CPU 240 compares the identification information included in the operation log with other identification information included in the other operation log. The CPU 240 compares the size information included in the operation log with other size information included in the other operation log. Further, the CPU 240 calculates the accuracy indicating the degree of association between the file indicated by the identification information and the other file indicated by the other identification information based on the comparison result between the identification information and the comparison result of the size information. To do. As a result, it is possible to improve accuracy when estimating the degree of association, for example, the accuracy of file identity.

DESCRIPTION OF SYMBOLS 1 Log management system 2 Client terminal 3 Management server 4 Management console 41 Operation log database 42 File path accuracy table 43 Data size accuracy table 44 Trace result storage part 51 Extraction part 52 Comparison part 52A File path comparison part 52B Data size comparison part 53 Calculation Part 54 Control part

Claims (8)

On the computer,
It accepted the identification information that identifies the file,
For each operation on file, by referring to the storage unit that stores the operation log and a size information indicating the data size of the identification information and the file that identifies the file, the operation log has the identification information received and, Extracting another operation log different from the operation log having the identification information ;
Extracted for comparison with the identification information included in the identification information and the previous SL other operation log contained in the operation log results and the size information included in the size information and the previous SL other operation log contained in the operation log based on the comparison results, it calculates the likelihood of identity with the file identified by the identification information included in the file and before Symbol another operation log indicated by the identification information received,
A log management program for executing a process of associating and outputting information relating to the operation log and the other operation log when the calculated accuracy is equal to or greater than a threshold value . In the process of calculating the accuracy ,
Referring to the identification information included in the operation log and degree of coincidence between the identification information included in the other operation log, the storage unit which stores in association with each value in the matching degree, it included in the operation log Obtaining the value according to the comparison result between the identification information and the identification information included in the other operation log ;
Referring the degree of coincidence between the size information included in the other operation log and size information included in the operation log, the storage unit which stores in association with other values in the matching degree, included in the operation log Obtain the other value according to the result of the comparison between the size information and the size information included in the other operation log ,
Based on the said other value and the value, log management program according to claim 1, characterized in that to calculate the likelihood. When the end of the operation on the file is detected, the process includes storing the data size of the file at the end of the operation as the size information in the operation log and storing the operation log in the storage unit. The log management program according to claim 1 or 2 . In the computer,
Before receiving the identification information , receive the operation log from a client device that communicates with the computer ,
Receiving the other operation log from another client device different from the client device ;
Storing the operation log in the storage unit ;
That stores the another operation log in the storage unit
The log management program according to any one of claims 1 to 3 , wherein the process is executed. The operation log includes an update date and time for updating the file,
In the process of calculating the accuracy,
And update date and time information included in the operation log, based on the other operations of comparison of the update date and time information included in the log result, any claim 1-4, characterized in that to calculate the probability A log management program according to any one of the above. On the computer,
It accepted the identification information that identifies the file,
The operation log including the update date information indicating modification date and time of the identification information and the file that identifies the file, by referring to the storage unit that stores for each operation on the file, the operation log has the identification information received and , Extracting another operation log different from the operation log having the identification information ,
Extracted for comparison with the identification information included in the identification information and the previous SL other operation log contained in the operation log results and, further contained in the update date and time information and the previous SL other operation log contained in the operation log based on the results of comparison between the new time and date information, it calculates the likelihood of identity with the file identified by the identification information included in the file and before Symbol another operation log indicated by the identification information received,
When the calculated accuracy is equal to or greater than a threshold value, the operation log and information related to the other operation log are output in association with each other.
A log management program for executing a process . For each operation for files, a storage unit for storing the operation log including the size information indicating the data size of the identification information and the file that identifies the file,
When accepting the identification information, and wherein by referring to the storage unit, the manipulation log and having said identification information received, extracting unit that extracts different other operation log from the operation log with the identification information,
Extracted for comparison with the identification information included in the identification information and the previous SL other operation log contained in the operation log results and size included in the size information and the previous SL other operation log contained in the operation log based on the result of comparison with the information, a calculation unit for calculating an accuracy of identity with the identification information indicating a file before Notations showing identification information included in the other operation log Airu accepted,
A log management apparatus comprising: an output unit that outputs information relating to the operation log and the other operation log in association with each other when the calculated accuracy is equal to or greater than a threshold value . Computer,
Accept identification information that identifies the file,
For each operation on file, by referring to the storage unit that stores the operation log and a size information indicating the data size of the identification information and the file that identifies the file, operations log having the identification information received and the issue extract other different operation log from the operation log with identification information,
Extracted for comparison with the identification information included in the identification information and the previous SL other operation log contained in the operation log results and size included in the size information and the previous SL other operation log contained in the operation log based on the result of comparison with the information, it calculates the likelihood of identity with the file indicated by the identification information included in the file and before Symbol another operation log indicated by the identification information received,
When the calculated accuracy is equal to or greater than a threshold value, the operation log and information related to the other operation log are output in association with each other.
A log management method characterized by executing processing .

Images