KR100503772B1 - A monitoring system and method of auditing performanced work connected to database server by utility method - Google Patents

Abstract

In the present invention, when accessing the database server in console mode or when the client accesses the database server by application programs (Telnet, FTP, R-Command), this type of access is generally referred to as a terminal terminal and a local connection or a remote connection. The present invention relates to a monitoring system and a method for monitoring a task performed by connecting to a database server. More specifically, the present invention provides a method of connecting and disconnecting a utility to a database server. Sniffs, collects, extracts, and analyzes packets that are performed between them to remotely monitor user information and performance information in real time, and operates a separate server processor on the database server itself to access the database using a database-specific tool, and to use the database. Related to By monitoring the creation, deletion, modification, and execution of script files (Shell Script, user-defined source and executable files, etc.), the utility method provides local access to the database server for job execution information of all databases executed on the database server. Efficient monitoring and control of blocking and alerting clients are possible.

Description

A monitoring system and method of auditing performanced work connected to database server by utility method}

The present invention relates to a monitoring system and method for monitoring operations performed by accessing a database server in a utility manner, and more particularly, a database server using a utility among a plurality of database servers and client processes operating on a network. It accesses to the database server, extracts and analyzes all the job execution information performed in the database server and the changed information of the changed file when a change to the script file related to the database operation occurs among the files existing in the database server. By accessing the utility method by recording and storing the information, it monitors and monitors job execution information performed in the database server in real time and changes information on the script file executed at a specific point in time. As a utility method to confirm a monitoring system and method for monitoring the work done by connecting to the database server.

As the technology of the Internet and networks has evolved, data devices, including computers on the network, called ubiquitous computing technology (a cable introduced by Dr. Mark Weiser of the Xerox Palo Alto Research Institute and a wireless network connected to a computer) are connected. Regardless of where it is located, it's easy and easy to access all the information and transfer all the data to other data devices.

In general, most information processing systems are connected by Ethernet over a local area network (hereinafter referred to as "LAN"). In this method, by broadcasting to each device of the network to which it belongs, data transmission between a plurality of database operation servers and a plurality of client terminals provides a structure that can conveniently and easily process a large amount of data. Because of the problem that information leakage and illegal intrusion in the operating server can also occur easily and quickly, firewalls and intrusion detection systems have already been developed and used for intrusion detection and blocking to protect the information in the database server. There is a situation.

However, as mentioned above, detecting and blocking intruders by unauthorized outsiders and insiders alone cannot secure the database in many cases, and monitors all users who access the database with normal authority. There is a growing need for database-level solutions that can be done. In particular, when a utility is directly connected to a database server, there is no solution that can perform security maintenance of the database correspondingly.

The information protection in the existing information processing system solves the problem before connecting to the database by determining whether the user who connects to the firewall or intrusion detection system on the network is authenticated and taking measures to warn and block according to the determination result. It was focused on.

However, if a user connected to the internal network is not detected by the internal operator or intrusion detection, the user can use the utility to directly connect to the database operation server and write the user-defined script file recognized by the database-specific tool to access the data in the database. Or, create a shell script file and execute it as a tool for execution or database, and delete the file after execution.

Moreover, current database server manages basic access by using pre-authenticated and authenticated user ID and password. However, insider who has the intention to leak information of such database or has normal authority In case of direct access to the database server, there is a problem that cannot be checked or prevented even if secret information is leaked or it causes a fatal problem in the database server because there is no work execution information for accessing the database.

In addition, even if a file is deleted, moved, or changed in a normal server operating system, information about the file before and after the change is not left, so it is difficult to implement a log thereof. Occurs as

The present invention relates to a monitoring system and method for monitoring a task performed by accessing a database server in a utility manner. The present invention relates to sniffing and collecting packets performed by accessing a database using a utility. Extract and analyze user information and performance information remotely in real time, and operate the separate server processor on the database server itself to access the database with a tool dedicated to the database, and to perform script files related to database use (Shell Script, user) By monitoring the creation, deletion, modification, and execution information of custom sources and executables, etc., the utility method effectively monitors job execution information of all databases running on the database server and blocks and alerts clients. The purpose is to give you control.

In the monitoring system for monitoring the work performed by accessing the database server by the utility method according to the present invention for achieving the above object, the act of accessing the database server to the user server, the authorized and unauthorized client, the console using the database A database server provided with an FASA for monitoring the contents of the changed file and storing in a log file; A surveillance system server that accesses the database server as a utility and monitors all operations until the client logs in to the server and logs out, and stores them in a log file; Surveillance system client that monitors the log file and controls the database server and surveillance system server.

In addition, the database server according to an embodiment of the present invention is characterized in that a scheduler using a database at a specific time, characterized in that for monitoring the work performed by accessing the database server in a utility manner.

In a method for monitoring a task performed by accessing a server by a utility method according to another preferred embodiment of the present invention, a client logs in to a database server through an internet network in a utility method and performs all actions until logout. A first step; The monitoring system server includes a second step of monitoring all actions until the client logs in and logs out in the first step; A third step in which the database server monitors the behavior of the FASA and the SSC using the database and the contents of the change file in the first step; And a fourth step of monitoring the monitoring system server and the information monitored by the FASA and the SSC.

In addition, the FASA processing method according to an embodiment of the present invention comprises the steps of delivering a file event to the RTIC daemon while monitoring the change of the file after the RTIC daemon receives the pattern; Detecting, by the WTMP daemon, when the login or logout event occurs, and transmitting the event information to the RTIC daemon; The RTIC daemon is characterized in that the step consisting of receiving a login, logout event to generate a monitoring file.

In addition, the second step or the third step according to an embodiment of the present invention is a sniffing or SSC and FASA monitoring method to access the database by directly keying in the database server by accessing the Telnet from the client individually; A method of sniffing and monitoring SSC or FASA by accessing a database by executing SQL * PLUS script by uploading by FTP and accessing by telnet by writing SQL script in a client; Sniffing and FASA monitoring to access the database by FTP and uploading programmed information (Shell, Application) except SQL * PLUS in the client; SSC and FASA monitoring by accessing the database with a tool such as SQL * PLUS by connecting to the console or client via SSH (Secure Shell); SSH through the console or client to access any database other than SQL * PLUS, characterized in that the connection to any one of the FASA monitoring method.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of a monitoring system for monitoring a task performed by accessing a database server with a utility according to a preferred embodiment of the present invention. The monitoring system includes a console 10, a database server 20, and a user client ( 30, authorized and unlicensed clients 40, surveillance system server 50, surveillance system client 60, and the Internet 70. More specifically, the console 10, superuser The monitor device directly connected to the server in the computer room.) Is a monitor device physically connected directly to the database server 20. The monitor device is directly connected to the database server 20 in the console mode and then used to connect to the database 21 or the database 21. Change the files related to the database (which means create, change, delete, execute, and move, referred to as changes). This is to provide the cause of file change according to the action.

The database server 20 includes a SSC (22, Sever SQL capture) for storing all the actions performed by directly accessing the database using a database 21 dedicated tool (SQL * PLUS) and a user-defined program source. A file access server agent (FASA) 23 for storing changes in a script file for changing or executing a database or for using the database 21, and a database 21 for a user to use data. . The data stored by the SSC and FASA are stored in a common log file, and the SSC and FASA, a monitoring system, and a communication module are also commonly used.

In addition, the database server 20 is equipped with a scheduler (CRON) using the database 21 at a specific time to monitor the SSC 22 and FASA 23 to access the database 21.

The user client 30 accesses the database server 20 as a utility to create, change, delete, execute, and move files related to the database 21 for the purpose of using the database 21 and the database 21. It acts and provides the reason for the file change according to the action.

The authorized and non-licensed client 40 uses the authorized-licensed database 21 when the non-licensed client accesses the utility, and the database server 20 intercepts the unauthorized session, and when the authorized client accesses the utility. It is to perform the act of creating, modifying, deleting, executing, and moving files related to the database 21 for the purpose of using the act and the database 21, and providing the cause of the file change according to the act.

The surveillance system server 50 collects and analyzes all packets by sniffing packets when data packets are transmitted and received between the user client 30, the authorized and unauthorized client 40, and the database server 20. And storing and extracting and monitoring only information accessing the database server 20 by using a utility, and blocks unauthorized persons. The surveillance system client 50 controls the surveillance system server 40, the SSC 22, and the FASA 23 using the Internet network, and monitors and monitors users by using the stored log information. The log data stored in the SSC 22 and the FASA 23 may be moved to the surveillance system server 50 and used.

The Internet 30 is a communication network equipped with communication protocols such as TCP / IP, IPX, Token-Ring, and ATM for transmitting and receiving data on the web.

2 is an SSC processor processing configuration diagram according to the present invention, in which the SSC 22, Sever SQL Capture, is performed by the SSC capturer 24-1 using a database dedicated tool (SQL * PLUS) (directly executed or executed as a file). ) Is stored in the log file 25 and the data stored in the log file 25 communicates with the SSC interface 24-2 for monitoring and monitoring in the monitoring system client 30 to confirm the log data contents.

In addition, the lock file 25 can be confirmed by the monitoring system client 60 is connected locally according to the nature of the log file, log data can be stored in the monitoring system server 50, if necessary, the monitoring system The server 50 includes a processor 51 and communicates with the SSC interface 24 to store log data in the surveillance system server 50 and the surveillance system client 60 communicates with the surveillance system server 50 to log data. To check.

3 is a block diagram of a FASA processor according to the present invention, in which a FASA 23 constructed in a database server 20 includes a FA capture 23-1, an FA interface 23-1, and a log file 25. The FA capture 23-1 records the contents of the file and execution information changed by the client in accordance with the principle, namely, who, when, how, and how the file is changed and executed. 25), the process of the monitoring system client 60 to control, monitor and monitor is the same as the SSC (22). In other words, the FA interface 23-2 differs only from the name of the SSC interface 24-2, and its operation is the same.

4 is a flowchart showing a processor for a method for monitoring a task performed by accessing a database server with a utility according to a preferred embodiment of the present invention, in which a user client 30 performs a utility on the switching device 80 via the Internet. After the connection and local access in a manner to access the database server 20 to create, change, delete, execute and move files for the purpose of using the database 21 built in the database server 20, the monitoring system 50 And the SSC 22 and FASA 23 store the performance information in a log file. On the other hand, the database management system 90 is operated so that the client 30 uses the database 21. The monitoring system server 50 sniffs and monitors the matters processed by the component, and the monitoring system client 60 exemplifies a result of monitoring and monitoring the performed time periods as illustrated. The contents of the file are not checked. That is, it shows an example that the file content can be confirmed only if the log information of the SSC (22) and FASA (23).

On the other hand, the client 30 is connected to the database server (IP: 192.168.100.1) using the TCP / IP protocol, the illustrated packet connection is an example of a process that is processed by telnet 192.168.100.1 and ftp 192.168.100.1 Doing.

5 is a flowchart for forming an initial kernel according to the present invention, in which all operations performed by the database server 20 are basically monitored by the OS kernel, and use the OS kernel portion for double file execution and modification. 5A through 5B are for operating the RTIC daemon shown in FIG. 6 and are processed by the following operations.

Determining whether to hook (S10);

Setting a call intercept and a hook when the hook is performed in step S10, and proceeding to step S10 again;

Determining not to hook when not hooking in step S10 (S20);

If the hook is unhooked in step S20, re-storing the call, unsetting the hook, and proceeding to step S10 again (S21);

Determining the pantone update when not unhooked at step S20 (S30);

If the pattern is updated in step S30, updating the pattern and proceeding to step S10 again (S31);

Determining if the pattern is hooked if the pattern is not updated in step S30 (S40);

Determining whether a file has been opened when it is hooked in step S40 (S41);

When the file is opened in step S41, determining addition and modification, and then proceeding to step S10 again (S42);

Determining whether the file is closed when the file is not opened in step S41 (S43);

Determining whether the file is additionally flagged when the file is closed in step S43 (S44);

If it is flagged as an additional step in step S44, transmitting an additional event and proceeding to step S10 again (S45);

If it is not additionally flagged in step S44, determining whether it is flagged as a change (S46);

Transmitting a change event when the flag is changed in step S46 and proceeding to step S10 again, and immediately proceeding to step S10 when the flag is not flagged (S47);

Determining whether the file has been deleted if the file is not closed in step S43 (S48);

If the file is not deleted in step S48, transmitting a deletion event and proceeding to step S10 again (S49);

Determining whether the file is executed when the file is not deleted at step S48 (S50);

Transmitting the execution event when the file is executed in step S50 and transmitting to step S10, and if the file is not executed, directly transmitting to step S10 (S51);

If it is not hooked in step S40, the process proceeds to step S10 when it is loaded in step S60. If it is not loaded, the initial kernel formation for the RTIC daemon is terminated.

6 is a flowchart in which the RTIC daemon operates according to the present invention, and includes the following steps.

Reading an environment value (configuration) which is internally returned when the processor is operated (S70);

Sending an initial pattern (configuration) to the RTIC (FA capture of FASA) after step S70 (S80);

A backup initialization (files corresponding to the configuration) and a text file check step (S90) after step S80;

Determining if an event occurs in files defined in the configuration after step S90 (100);

Determining a timeout for the event after step S100 (S110);

After the step S110, if the time for the event is not exceeded, the step of determining whether to stop (end) or continue (S100) the RTIC daemon (S120).

In step S100, the processor performs the following process when an event occurs.

That is, if an event occurs, determining whether the file event (S101);

Analyzing a file content difference when a file event occurs after step S101 (S102);

Writing the monitoring file after step S102 and proceeding to step S110 (S103);

Determining a login / logout event rather than a file event in step S101 (S104);

If it is not the login / logout event in step S104, the process proceeds to step S110, and if it is an event, S105 (processing when an event occurs in the WTMP daemon) is performed.

In addition, the update process for the configuration file change when the timeout for the event in step S110 is similar to the steps S70 to S90 and consists of the following steps.

Checking the configuration file if the time for the event exceeds (S111);

If the configuration file is modified and not modified, proceed to step S120; and if the configuration file is modified, determining for proceeding to step S113 (S112);

Updating the pattern in the RTIC when the configuration file is modified in step S112 (S113);

On the basis of the information updated in the step S113 and check with a text file and proceeds to step S120 (S114).

7 is a flowchart in which the WTMP daemon operates according to the present invention, and includes the following steps.

The server systems have an event file for managing a user connection, wherein determining the update of the login / logout event file (S130);

Determining log in and log out through record analysis when a file update occurs in step S130;

Determining whether to log in (S132);

Sending a login event to the RTIC daemon if there is a login record in step S132;

In step S132, if there is no log recording, determining whether to log out or not (S134);

Sending a logout event to the RTIC daemon if there is a logout recording in step S134 (S135);

After the processing of steps S133, S134, and S135, it is determined whether the WTMP daemon is terminated (S136).

The actual operation process for the internal system configuration of the system and method of the present invention described above is as follows.

Each configuration of the system is connected to a database server (or internally operated by a server) through sniffing monitoring when connecting to a server through a network, agent monitoring by agents (FASA and SSC) on the server, and interlocking monitoring by sniffing and agent interworking. It monitors all the actions performed by accessing the database in the server directly.

The sniffing monitoring sniffs communication packets transmitted and received through a network between a client and a database server. There are various protocol standards such as TCP / IP, IPX, Token-Ring, and ATM, and the method of sniffing sniffs all packets, discarding all other packets except TCT / IP packets, and TCP / IP packets. There is a way to filter and sniff only.

In the method of sniffing by TCP / IP packet, the MAC address, IP (Internet Protocol) number and port number of the source and destination are recorded in the TCP / IP packet, and the packet is monitored by inspecting the IP of the packet for monitoring and sniffing. Only packets transmitted to the target database server to be monitored or packets transmitted from the database server to be monitored are selected. If it is determined that the packet is related to the database server, check whether the port number of the server side is a port number of Telnet, FTP, and R-Command, and discard the packet if it is not the corresponding port number.

If the corresponding port of the database server is confirmed, it can be used among system information such as application protocol name (Telnet, FTP, etc.), client IP number, client name, time, login user and user input string or server response string. Possible information is recorded in a file or available format.

Surveillance system client inquires the work done through network by using program that can inquire information of log file.

Sniffing monitoring can always check the name of a file or command entered by a user, but sometimes it is impossible to see the actual information (text) of a file or command.

The agent monitoring detects when an agent program installed in a database server generates, changes, deletes, moves, or executes a file to be monitored, and records each action in a log file.

The agent program is provided with a communication module for communication with a separate surveillance system client that wants to inquire information of a log file, and selects and transmits only the data requested by the client to the client.

In the interlock monitoring, a monitoring program of a monitoring system client may communicate with a monitoring processor of a monitoring system server to query log information stored as a sniffing monitoring in the monitoring system server. When inquiring the process performed by the user (accessor), if the contents of the file are checked, the surveillance program of the surveillance system client communicates with the communication module (SSC interface, FA interface) of the agent (SSC, FASA) of the database server to monitor the agent. You can check the file of interest (changes and details) from the saved log information.

In some cases, monitoring of access to the database by accessing the database server directly may overlap, but SSC (Server SQL Capture) executes a database-specific tool (SQL * PLUS) on the server regardless of the access type and operation type (file or SQL executed by direct key-in, and sniffing is an act of key-in on the keyboard by accessing the server by FTP or Telnet, and FASA (File Access Server Agent) uses SQL * PLUS on the server regardless of the access type and operation type. It monitors all actions except keying in SQL statements directly and accessing files other than monitoring patterns (monitor files in the monitoring area).

Next, accessing database by directly accessing database server and monitoring method are divided as follows.

Firstly, it is keyed in by accessing to telnet from client first, and there is a method to access database by program (SQL Script, Shell, Application) directly from database server, or to monitor SSC and FASA. Second, write SQL script in FTP There is a method of sniffing and monitoring SSC or FASA to access the database by executing SQL * PLUS Script by accessing Telnet and uploading the programmed information (Shell, Application) except SQL * PLUS in FTP by the third client. There is a method of sniffing and FASA monitoring accessing the database by telnet access, and the 4th method of SSC and FASA monitoring accessing the database with a tool such as SQL * PLUS by connecting to SSH (Secure Shell) from the console (CRON) or client. Finally, the fifth console (CRON) On the other applications to connect to SSH in gradient than the SQL * PLUS has FASA how to monitor access to the database.

As described above, the FASA is responsible for securing a part of the server by monitoring not only the access to the database but also other performed actions regardless of the access type to the server. In a broader sense, FASA includes SSC and sniffing, but SSC is only available if you directly key SQLs without executing file scripts in SQL * PLUS on the server, or execute SQL * PLUS as an input prompt in shell scripts.

Although the present invention has been described in detail so far, it should be apparent that the embodiments mentioned in the process are only illustrative, and not restrictive, and the present invention is provided by the following claims. Within the scope not departing from the scope of the present invention, changes in the components to the extent that they can be dealt with evenly will fall within the scope of the present invention.

 As described above, the monitoring system and method for monitoring operations performed by accessing a database server according to the present invention monitor and verify all operation information performed after accessing the database server locally and remotely using a utility. In this case, there is an effect of using a process of sniffing a packet, and using a utility to monitor in real time what is being done to the database.

In addition, the present invention is to perform a separate process in the database system itself to monitor the change information for the script file performed at a specific point in time, by monitoring all the operations performed by local and remote access to the database server and monitoring and confirming this operation The information can be checked efficiently, and there is an advantage to control to block and warn the client.

1 is a configuration of a monitoring system for accessing and monitoring a database server by a utility method according to the present invention

2 is a SSC (Sever SQL Capture) processor processing configuration according to the present invention

3 is a block diagram illustrating a process of processing a File Access Sever Agent (FASA) processor according to the present invention.

4 is a flow diagram illustrating a processor for a method for monitoring access to a database system in a utility manner over a network in accordance with the present invention.

5A-5B are flow charts for forming an initial kernel for the RTIC daemon in accordance with the present invention.

6 is a flowchart in which the RTIC daemon operates according to the present invention.

7 is a flowchart in which the WTMP daemon operates according to the present invention.

* Description of the main drawing codes *

10: console 20: database server

21: Database 22: SSC

23: FASA 23-1: FA capture

23-2: FA interface 24-1: SSC capture

24-2: SSC interface 25, 52: Lockfile

30: User Client

40: authorized and unauthorized client 50: surveillance system server

51 processor 60 surveillance system client

70: Internet 80: switching equipment

90: database management system

Claims (5)

A monitoring system for monitoring a database for transmitting and receiving data packets occurring between a plurality of client application processors and a plurality of database servers including a database server, The user client 30, authorized and unauthorized client 40, and console 10 access the database server 20 to monitor the behavior of the database 21 and the contents of the changed file, and to log file 25. A database server 20 having a FASA 23 for storing and an SSC 22; A monitoring system server (50) for accessing the database server (20) as a utility and monitoring all actions until the logout by the client (30, 40) logging in to the server and storing them in a log file (52); The operation performed by accessing the database server in a utility manner, characterized in that the monitoring system client 60 for monitoring the log files 25, 52 and controls the database server 20 and the monitoring system server 50. Monitoring system to monitor. The monitoring system according to claim 1, wherein the database server (20) further includes a scheduler using the database (21) at a specific time. A monitoring method for monitoring a database for transmitting and receiving data packets occurring between a plurality of client application processes and a plurality of database servers including a database server, the method comprising: A first step in which the clients 30 and 40 log in to the database server 20 via the internet in a utility manner and perform all actions until logout; The monitoring system server 50 includes a second step of monitoring all actions until the client logs out and logs out in the first step; A third step in which the database server 20 monitors the contents of the behavior and the change file contents of the FASA 23 and the SSC 22 using the database 21 with respect to the actions of the clients 30 and 40 in the first step; The monitoring method for monitoring the operation performed by accessing the database server in a utility method, characterized in that it comprises a fourth step of monitoring the information monitored by the monitoring system server 50, FASA (23) and SSC (22) . The method of claim 3, wherein the treatment by the FASA in the third step Forwarding the file event to the RTIC daemon while the RTIC daemon receives the pattern and monitoring the file for change; Detecting, by the WTMP daemon, when the login or logout event occurs, and transmitting the event information to the RTIC daemon; The RTIC daemon monitors operations performed by accessing a database server by a utility method, characterized in that the step of generating a monitoring file by receiving a login and logout event. 4. The method of claim 3, wherein the second or third step is a sniffing or SSC that accesses the Telnet from the clients 30 and 40, individually key-in, and directly programs the database server 20 to the database 21. How to monitor FASA; A method of sniffing and monitoring SSC or FASA to access the database 21 by executing an SQL * PLUS script by uploading by FTP and telnet by creating an SQL script in the clients 30 and 40; Client (30, 40) is a method of sniffing and FASA monitoring access to the database 21 by FTP and uploading the programmed information (Shell, Application) except SQL * PLUS; A SSC and FASA monitoring method in which the console 10 or the clients 30 and 40 access SSH and access the database 21 with the SQL * PLUS tool; Access to the database server by a utility method, characterized in that the connection to any one of the FASA monitoring method to access the database 21 by other applications except SQL * PLUS by connecting to the console or the client (30, 40) by SSH. Monitoring method to monitor the work being done.