JPH10224349A - Network access analysis system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To identify a specific client from which the relevant access is received when the access is performed via a Proxy server by accumulating the information on the access situations of both Web and Proxy servers. SOLUTION: A request is issued to a Web server 1 from a client via a Proxy server 2. A Web server log accumulation processing module 11 is contained in the server 1 to accumulate the contents of a Web server log 10. Meanwhile, a Proxy server log accumulation processing module 21 contained in the server 2 accumulates the contents of a Proxy server log 20. These accumulated contents are sent to a general accumulation processing module 30 of a management terminal 3. The module 30 accumulates the access situations of both servers 1 and 2 in an integrated way based on the received information and then outputs these accumulated access situations in an easy-to-see way.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to a network access analysis system.

[0002]

2. Description of the Related Art As a method of checking the access status of a computer network, there is a method of capturing packets flowing on the network and performing statistical processing by counting the number of packets. For example, in a known example described in Japanese Patent Application Laid-Open No. 7-231317, statistical processing is performed based on packets (frames) flowing on a network.

In addition, there is another method of checking the access status based on an access log of a server. For example, see “BYT” on page 305-310 of the April 1996 issue of Nikkei Byte.
"E Magazine's Internet Project (8) Analyzing Visitors to WWW Servers" analyzes web server access logs to determine which clients accessed the servers, when and how often. It is suggested that it can be calculated.

[0004]

There are some problems in the method of analyzing the access log of the Web server. In particular, a problem occurs when a client accesses a Web server across a proxy server that has a function to perform access from the client.

[0005] The first problem is that the address of a client becomes unknown when accessed via a proxy server. When a proxy server is used, it is not the client that directly communicates with the web server, but the proxy server address is entered in the client address column in the web server access log. For this reason, it is difficult to know which client accesses.

[0006] The second problem is the problem of caching the proxy server. The proxy server has a function to cache access from clients. That is, when data on the Web server is received from the Web server based on a request from the client, a copy of the received data is stored in the proxy server, and the next time a request for the same data comes from the client, It is a function to return the data stored in the proxy server to the client. This eliminates the need to access the Web server every time to acquire the same data, thereby reducing network traffic and increasing the response speed to a request from a client.

[0007] However, when caching is used, there is a difference between the number of accesses to the Web server and the number of requests from the client. For example, the proxy server accesses the web server only once,
In fact, there could be 100 requests from clients. In order to grasp the needs of the client, it is necessary to know the exact number of requests from the client.

[0008]

[Means for Solving the Problems] Based on the information on the access status of the Web server and the information on the access status of the proxy server, the two are correlated and counted.

FIG. 1 shows the module configuration. Here, the information on the access status is obtained by referring to the access log. However, the access log need not be an access log as long as the mechanism knows the access status. FIG.
Shows only one Web server 1 and one proxy server 2, respectively, but the principle of the present invention can also be applied to a plurality of Web servers 1 and a plurality of proxy servers 2.

The Web server 1 has a Web server log tallying module 11, and the contents of the Web server log 10 are tallyed and sent to the total tallying module 30 in the management terminal 3. Further, the proxy server 2 has a proxy server log totaling module 21 so that the contents of the proxy server log 20 are read, totaled, and sent to the total totaling module 30 in the management terminal 3. The total tabulation module 30 calculates the access status of the web server 1 and the proxy server 2 based on the information received from the web server log tabulation module 11 and the proxy server log tabulation module 21.

As an alternative, the Web server log tallying module 11 does not perform the tallying process, but simply sends the contents of the access log of the Web server to the total tallying module 30. May be totaled. Similarly, the same applies to the proxy server log totaling module 21.

The integrated processing module 31 is connected to the management terminal 3
Instead, it may be in another processing device such as the Web server 1 or the proxy server 2.

The present method is applicable not only to a Web server but also to an FTP server and other information providing mechanisms.

If a record of the access remains on the client receiving the information, the access status may be checked based on the record.

[0015]

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 2 shows the flow of data when accessing a normal Web server.

The client 4 accesses the Web server 1 via the proxy server 2. First, a request is issued from the client 4 to the proxy server 2. In response, the proxy server 2 issues a request to the Web server 1. Processing is performed on Web server 1,
Send the result to proxy server 2. Proxy server 2 passes it to client 4. When Web server 1 and proxy server 2 return the result to the request source,
Keep a record of the results returned.

FIG. 3 shows a data flow when investigating an access situation according to the present invention. The Web server 1 and the proxy server 2 send the results totaled from the respective access log files to the management terminal 3.

The management terminal 3 further performs a totaling process based on the totaled results of the collected Web server log totaling module 11 and proxy server log totalizing module 21 and outputs the data in an easily viewable form. This processing is shown in FIG. Web server log aggregation processing module 11,
The detailed processing contents of the proxy server tallying module 21 and the total tallying module 31 will be described later.

The present invention is centered on the access log tallying process. Each time the Web server 1 or the proxy server 2 responds to the request, the record is added to the one record access log. FIG. 4 shows an example of the format of the access log. The access log is a series of records 100. The contents of one record further include a request source field 1001, a date and time field 1002,
It consists of a request content field 1003, a status code field 1004, and a byte count field 1005.
The request content field 1003 further includes a command type field 10031, a request destination field 10032, a file name field 10033, and a protocol field 10034.
Composed of

FIG. 5 shows an example of one record of the access log. The content of the request source field 1001 is Cli1, which indicates the name of the request source. Note that the request source is not limited to the client 4 but may be the proxy server 2. At that time, the name of the proxy server 2 is entered in the request source field 1001. Datetime field 100
The content of 2 indicates the date and time of responding to the request, 1996
It shows 12:22:04 on June 6, 2009. +09 next to it
00 indicates a time difference from Greenwich Mean Time. The command field 10031 is “GET”, indicating that the client wants to acquire data. Next is a request destination field 10032. The request destination field 10032 is specified as an option,
It indicates the service provider. This is specified when requesting the proxy server 2 to relay the request to the Web server 1. Here, the content of the request destination field 10032 is “http: // w3s1”. "Ht
“tp: //” indicates the protocol, and “w3s1” indicates the name of the server. When making a direct request to Web server 1, request destination field 10032
Is omitted. The file name field 10033 indicates the content of the requested data. Here, "/readme.htm
l ", indicating that the request is for acquiring data named" /readme.html ". A protocol 10034 indicates a protocol for transferring data. Here, it is "HTTP / 1.0". The next status code field 1004 is an error code indicating the result of the request. Here it is 200. The byte number field 1005 indicates the length of data, that is, the length of data sent by the server in response to a request from a request source. Here, it is 560 bytes.

Next, the Web server log totaling module 11 and the proxy server log totalizing module 21 in FIG.
The processing performed in the step will be described. Basically, both processes are the same, and the flow of that process is as shown in FIG. First, a counter for counting the number of requests is initialized (2001). And open the access log file
(2002), and then check whether or not the access log file ends (2003). If not, read one record from the access log file (200
Four). Next, it is determined whether the read one record is the target data (2005). This is to determine whether the data is currently the data to be totaled. In the case of the access log of proxy server 2, another proxy server 2
It performs a relay function for Web server 1, but sifts through the access log records according to which proxy server 2 and Web server 1 are targeted. For example, a Web server named “Web server 1” is the target of aggregation processing
If 1, only records related to the Web server 1 are extracted. If it is determined that the record is a target record, the counter is incremented by one (2006). The counter is counted for each request source. For example, "Client 1" is three times, "Client 2" is twice, and so on. Then, the read position of the access log file is moved to the next record (2007). Then, the file end determination processing 20
Return to the process of 03. If the end of file is determined in the file end determination process 2003, the access log file is closed (200
8). Then, the name of the request source and the number of requests are transmitted for each request source of the count result (2009).
The contents to be transmitted are as shown in Tables 1 to 3.

Table 1 shows the contents of "Web" via "Proxy server 1".
It is an example 3100 of the totalization result of access to “server 1”.

[0023]

[Table 1]

The request source "Client 1",
It shows how many requests have been made to "Web server 1" from "Client 2" and "Client 3" via "Proxy server 1". "Client 1" is 5 times (31001) and "Client 1" 2 ”is 13 times (3100
2), "Client 3" indicates that the access has been made 27 times (31003). Similarly, Table 2 is a table (3200) showing the number of accesses to “Web server 1” via “Proxy server 2”.

[0025]

[Table 2]

Table 3 is also a table (3300) showing the number of requests to "Web server 1".

[0027]

[Table 3]

Next, the total tabulation process 30 in FIG. 3 will be described. In this embodiment, three examples of the total tabulation process will be described. Each is an example of a system with one Web server and two proxy servers, but similar processing can be performed for multiple Web servers and a single proxy server.

The first example is an example of counting requests by client. FIG. 7 is a flowchart thereof. First, receive the aggregation result from the proxy server 2 (4
001). What is received is the contents shown in Tables 1 and 2. From these aggregation results, the request source is the client
Extract from 400 (4002) and exclude access from proxy server 2. This is to limit the target of aggregation to the client 4. Next, the totalization result is received from the Web server 1 (4003). What is received is the contents shown in Table 3. Request source is client from received content
Extract 4 things (4004). Subsequently, the data via the proxy server 2 is totaled for each client (4005). If there is access from the same request source in the data from the proxy server 2, the total number of requests is calculated. Then, a total for each client source, a total for only direct access to the Web server, and a total sum are obtained (4006). Then, the contents are output in a table format (4007). FIG. 8 shows a screen image 410 when the data in Tables 1 to 3 are processed.

The second example is an example of counting the number of requests in each section. The flowchart is shown in FIG. First,
First, receive the aggregation result from proxy server 2 (500
1). The contents received here are shown in the examples of Tables 1 and 2. Next, receive the aggregation result from Web server 1 (50
03). The contents received here are shown in Table 9.
Subsequently, the received totaling results are rearranged based on the hierarchical structure of the network connection state. In this hierarchical structure, the web server 1 is a node at the top of the hierarchy, the proxy server 2 and the client 4 directly connected to the web server 1 are its lower nodes, and the proxy server 2 and the client 4 connected to the proxy server 2 immediately below the web server are the nodes. It is a lower node. Then, a graph showing the number of requests of each node in the tree structure of each node is displayed (5005).

FIG. 1 shows a display example 700 of the number of requests in each section.
0 is shown. A tree structure display area 7001 displays a tree structure indicating a network hierarchy. "Web server 1" (70011)
Is a node at the top, and immediately below it are “proxy server 1” (70012), “proxy server” (70013), “client 7” (70014), and “client 8” (7001).
5) is located. "Proxy server 1" (70012)
Below this, “Client 1” (70016) and other nodes are arranged. At this time, "Client 1" (70016)
Indicates that a request has been issued to “Web server 1” (70011) via “proxy server 1” (70012) (the same applies to other nodes). In the right half of the display example 700 of the number of requests in each section, a graph 7002 of the number of requests of each node is displayed (a numerical value may be displayed instead of a graph). This indicates how many requests each node has issued to the node immediately above it. For example,
"Client 1" (70016) has issued about five requests to "proxy server 1" (70012), which is the node immediately above. See “Client 1” for details.
(70016) issues five requests to “Web server 1” (70011) via “proxy server 1” (70012). The same applies to other nodes.

Further, the number of requests in each section can be displayed on a map. FIG. 11 is a flowchart thereof. First, the counting result is received from the proxy server 2 (5011). The contents received here are shown in the examples of Tables 1 and 2. Next, the counting result is received from the Web server 1 (5013). Then, the nodes are arranged on a plane based on the hierarchy (5014). The arrangement method may be such that the nodes are arranged in order from the left end, starting from the lowest node on the hierarchy to the top of the hierarchy (of course, it is sufficient if the nodes are easy to see from the right end or from above and below). Then, connect each node with an arrow from the request source to the request destination (50
15). The thickness of the arrow may be changed according to the number of requests between nodes. For example, a section with a large number of requests may be indicated by a thick arrow, and a section with a small number of requests may be indicated by a thin arrow. Instead of the thickness of the arrow, color coding may be used.

FIG. 12 shows a map display example 80 of the number of requests in each section. A map of the network is displayed in the map display area 801. The contents of the map are from “Client 1” (8011), “Client 2” (8012), and “Client 3” (8013) to “Proxy server 1” (8013).
It can be seen that a request has been issued to “Web server 1” (8017) via 15). The number of requests 8014 issued from “client 1” (8011) to “proxy server 1” (8015) is smaller than the number of requests 8018 issued from “client 2” to “proxy server 1”. The thickness is displayed thin.

The third example is the calculation of the cache efficiency of the proxy server 2. As described in the section of “Problems to be Solved by the Invention”, the proxy server 2 has a caching function. By analyzing the access log of the Web server 1 and the access log of the proxy server 2, the effect of the cache can be calculated.

The cache effect of the proxy server 2 can be calculated based on the number of requests from the client 4 to the proxy server 2 and the number of requests from the proxy server 2 to the Web server 1. That is, as a result of the request from the client 4 to the proxy server 2, when the request is issued to the Web server 1, the cache of the proxy server 2 does not hit. If a request was not issued to Web server 1 even though a request was issued from client 4 to proxy server 2, it means that proxy server 2 responded to the request from client 4 using the contents of the cache. And the cache is hit. From these facts, the caching effect of the proxy server 2 is obtained by Equation 1. In the formula, "Proxy server to Web
The “number of requests to the server” can be calculated from the access log total result of the Web server 1, and the “number of requests from the client to the proxy server” can be calculated from the access log total result of the proxy server 2.

[0036]

(Equation 1)

FIG. 13 is a flowchart for obtaining the cache effect of the proxy server 2 based on the equation (1). First, the totalization result is received from the proxy server 2 (5501), and the total number of requests to the proxy server 2 is obtained (5502). Then, the result of the aggregation is received from Web server 1 (5503), and proxy server 2
The request for is extracted (5504). And 55
Divide the number obtained in 04 by the number obtained in 5502 (550
5) can calculate the cache efficiency.

Actually, the cache effect of the “proxy server 1” will be calculated based on the total results of Tables 1 and 3 based on Equation 1. In Table 1, the number of requests from “Client 1” is “5” (31001), and “Client 2” is “1”.
3 ”(31002),“ Client 3 ”is“ 27 ”(31003)
It has become. Calculating these sums gives us "5 + 13 + 2
"7" becomes "45". This “45” is the number of requests for “proxy server 1”. On the other hand, in Table 3, the number of requests for “proxy server 1” is “17” (330
01). If the cash effect is calculated using Equation 1 based on these two numbers, it will be approximately 0.38 (38%) at "17/45".

In the above-described embodiment, the calculation of the number of requests is described in order to grasp the access status of the proxy server 2 to the Web server 1 from the client 4. By the way, the record of the access log also includes information on the number of bytes of data, and the amount of data transferred (the number of bytes)
Can be calculated similarly to the number of requests.

[0040]

【The invention's effect】

(1) Even when the Web server 1 is accessed via the proxy server 2, the name (address) of the client 4 can be detected.

(2) Even when the Web server 1 is accessed via the proxy server 2, the access status (the number of requests, the amount of data transfer, etc.) from the client 4 can be derived.

(3) The effect of the caching of the proxy server 2 can be calculated.

[Brief description of the drawings]

FIG. 1 is an explanatory diagram of a module.

FIG. 2 is an explanatory diagram of an example of access from a client to a Web server.

FIG. 3 is an explanatory diagram of a data flow during the operation of the present invention.

FIG. 4 is an explanatory diagram of a format example of an access log file.

FIG. 5 is an explanatory diagram of an example (for one access) of an access log file.

FIG. 6 is a flowchart of Web server log totalization processing and proxy server log totalization processing.

FIG. 7 is a flowchart for calculating the number of requests for each client.

FIG. 8 is an explanatory diagram of a display example of the number of requests from a client.

FIG. 9 is a flowchart for displaying a request number tree structure in each section.

FIG. 10 is an explanatory diagram of a display example of a request number tree structure in each section.

FIG. 11 is a flowchart of a request number map display for each section.

FIG. 12 is an explanatory diagram of a request number map display example of each section.

FIG. 13 is a flowchart for calculating a proxy server cache effect.

[Explanation of symbols]

1… Web server, 10… Web server log, 11… Web server log total processing module, 2… proxy server, 20… proxy server log, 21… proxy server log total processing, 3…
Management terminal, 30 ... Comprehensive total processing.

──────────────────────────────────────────────────の Continuing on the front page (51) Int.Cl. ⁶ Identification symbol FI H04L 29/14 (72) Inventor Ryuji Hayashi 5030 Totsukacho, Totsuka-ku, Yokohama-shi, Kanagawa Pref. Hitachi, Ltd. Software Development Division (72) Inventor Junji Inaba 5030 Totsuka-cho, Totsuka-ku, Yokohama-shi, Kanagawa Prefecture, Japan Software Development Division, Hitachi, Ltd.

Claims (10)

[Claims] Claims: 1. In a network system for transmitting information in a unidirectional or mutual manner between information communication mechanisms, information on the communication status of information transmitted between a specific information communication mechanism and another information communication mechanism. Issue individual communication information issuing means for issuing individual communication information, and issue individual relay information, which is information on the relay status of an information relay mechanism that relays transmission between a specific information communication mechanism and another information communication mechanism Receiving the individual relay information transmitted from the individual relay information issuing means, the individual communication information issued by the individual communication information issuing means, and the individual relay information totalizing means,
A network access analysis system, comprising: a total tabulation processing unit that performs a tabulation process by associating the received individual communication information with the individual relay information. 2. In a network system for transmitting information in one direction or mutually between information communication mechanisms, information on the communication status of information transmitted between a specific information communication mechanism and another information communication mechanism. A network access analysis system comprising: an individual communication information issuing unit for issuing individual communication information; and a total tabulation processing unit for performing a tabulation process by associating a plurality of the individual communication information issued from the individual communication information issuing unit. 3. A network system for transmitting information unidirectionally or mutually between information communication mechanisms in an information relay mechanism for relaying transmission performed between a specific information communication mechanism and another information communication mechanism. An individual relay information issuing unit that issues individual relay information that is information relating to relay status; and a total tabulation that receives the individual relay information transmitted from the individual relay information tabulation unit, and correlates and processes the received plurality of individual relay information. A network access analysis system having processing means. 4. The method according to claim 1, wherein the contents of the access status are totaled by said individual communication information issuing means and said individual relay information issuing means, or by said individual communication information issuing means or said individual relay information issuing means. A network access analysis system having a tallying mechanism. 5. The request or response issued by the information communication mechanism and the information relay mechanism according to claim 1, wherein the number of requests or responses of the individual information communication information and the number of requests or responses of the individual relay information are determined. An access status analysis system that obtains a caching effect amount of a relay device by obtaining a ratio or a ratio of the number of requests or responses of a plurality of the individual relay information. 6. A process according to claim 1, wherein said total summation processing means divides a communication between said specific information communication mechanisms into an access state via said information relay mechanism and an access state without passing through said information relay mechanism. Access status analysis system to aggregate data. 7. The communication with the communication target according to claim 1, wherein the information communication mechanism or the information relay mechanism as a communication target is a vertex node based on the contents of the individual communication information and the individual relay information. The information relay mechanism corresponding to the path at the time of the above, and the information communication mechanism communicating with the communication target is a lower node of the vertex node, and a communication path with the communication target is a tree configured by the vertex node and the lower node. Network access analysis system expressed by structure. 8. The network according to claim 7, further comprising information indicating the status of communication between the lower node and the lower node and the node immediately above the lower node in a tree structure hierarchy. Access analysis system. 9. The communication path according to claim 1, wherein said information communication mechanism, said information relay mechanism, and said communication target are communicated based on the contents of said individual communication information and said individual relay information. The information relay mechanism above, and the information communication mechanism for communicating with the communication target are arranged on an expression area for outputting or expressing information, and the information communication mechanism and the relay arranged on the expression area. A network access analysis system that connects mechanisms with connection expression means. 10. The network access analysis system according to claim 9, wherein said connection expression means has an attribute indicating an access status.