KR101356809B1 - Window server monitoring - Google Patents

Abstract

The present invention relates to a method for monitoring a window server, which is capable of preventing the risk of hacking and quickly dealing with hacking by transmitting monitoring information from the window server to a management server. A method for receiving monitoring information from a window server is provided, the method comprising the steps of: if a user logging in to the window server creates a predetermined administrator event, periodically receiving capture information, in which the screen of the window server is captured, from the window server; receiving additional information associated with the capture information from the window server; connecting the capture information to create a video; creating metadata on the video using the additional information; and connecting and storing the video and the metadata. [Reference numerals] (100) Internet; (110) Window Server; (120) Management server; (130) Administrator terminal

Description

Windows Server Monitoring {WINDOW SERVER MONITORING}

The present invention relates to a technique for monitoring a window by transmitting monitoring information from a window server to a management server.

With the spread of high speed communication networks and changes in network environments, the types of services using servers are becoming more diverse and wider. Accordingly, the importance of server management is increasing due to server overload or error. However, in managing a server, it is difficult to monitor and manage the status of the server in real time as well as the space constraints in which an administrator resides on a computer and periodically manages the server.

Korean Patent Laid-Open No. 2010-1258324 relates to a server management device and a server management terminal for remotely managing a target server, and a method for managing a server using the same. An administrator uses a server management device and a server management terminal. It is proposed a technology that can monitor the target server in real time, and can immediately respond to a problem in the target server. Accordingly, there is a need for a technology capable of capturing and managing a screen of a window server periodically.

The present invention provides a method for monitoring a window server by periodically turning on the screen of the window server and transmitting the screen to the management server.

In a method for transmitting monitoring information from a window server to a management server according to an embodiment of the present invention, when a user logs in to the window server, login information regarding the login is sent to an administrator in a predetermined method. Notifying; Monitoring usage of the logged-in user on the window server; Periodically capturing a screen of the window server when the logged-in user generates a predetermined administrator event; And transmitting the captured screen information to the management server from the window server.

According to one side, when the logged-in user generates a predetermined administrator event, the logged-in user executes the configuration of the Internet Information Service (IIS); When the logged-in user executes configuration of the window server; When the logged-in user accesses the management system of the window server; And a case in which the logged-in user accesses a system file of the window server, and transmits monitoring information from the window server to the management server.

The predetermined manager event may be predefined by the manager and may include a user event of a mouse or a keyboard.

According to another aspect of the present invention, the transmitting of the captured screen to the management server may include determining whether the login is a remote login or a local login; If the login is a remote login, transmitting the login ID of the login and the IP address of the terminal remotely logged in to the window server together with the captured screen to the management server; And if the login is a local login, transmitting the login information of the login along with the captured screen to the management server.

According to another aspect, the step of transmitting the captured screen to the management server, the monitoring information from the window server to the management server comprising the step of transmitting the name of the top window of the screen of the window server to the management server Provides a way to transfer.

According to another aspect of the present invention, the transmitting of the captured screen to the management server may include monitoring, by the window server, a text typed by the logged-in user to the management server from the window server to the management server. Provides a method for transmitting information.

In the method for receiving monitoring information from a window server according to an embodiment of the present invention, when a user logged in to the window server generates a predetermined administrator event, the capturing information of the screen of the window server is periodically captured. Receiving from a window server; Receiving additional information associated with the capture information from the window server; Connecting the capture information to generate a video; Generating metadata of the video using the additional information; And storing the video information and the metadata in association with the video server.

According to one side, receiving the additional information associated with the capture information from the window server, if the login is a remote login, the login ID of the login and the IP address of the terminal remotely logged in to the window server the additional information Receiving by; And If the login is a local login, it provides a method for receiving monitoring information from the window server comprising the step of receiving the login ID of the login as the additional information.

According to another one side, the additional information, the name of the top-level window of the screen of the window server; Text typed by the logged-in user in the window server; And at least one of a login time when the user logs in to the window server.

A window server according to an embodiment of the present invention, comprising: a login monitor configured to monitor whether a user logs in to the window server; A notification unit for notifying an administrator of login information regarding the login when the user logs in to the window server; A controller configured to monitor usage of the logged-in user on the window server and to periodically capture a screen of the window server when the logged-in user generates a predetermined administrator event; And a communication unit configured to transmit the captured screen to the management server.

A management server for managing a window server according to an embodiment of the present invention, comprising: a communication unit configured to receive capture information and additional information associated with the capture information from the window server; A video generating unit which connects the capture information to generate a video; A metadata generator configured to generate metadata of the video using the additional information; And a storage unit for storing the video and the metadata in association with each other, wherein the capture information includes a management server including a screen of the window server captured when a user logged in to the window server generates a predetermined administrator event. to provide.

The present invention can generate a video by connecting the capture information received from the window server, and by storing the generated video can quickly alert when a window hack occurs and can support window recovery.

1 is a view showing the operation of the window server and the management server according to an embodiment of the present invention.
2 is a block diagram showing the configuration of a window server according to an embodiment of the present invention.
3 is a flowchart illustrating a method of transmitting monitoring information from a window server to a management server according to an embodiment of the present invention.
4 is a block diagram showing the configuration of a management server according to an embodiment of the present invention.
5 is a flowchart illustrating a method of receiving monitoring information from a window server according to an embodiment of the present invention.
6 is a diagram illustrating an example of associating and storing video and metadata in a management server according to an embodiment of the present invention.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a view showing the operation of the window server and the management server according to an embodiment of the present invention.

The monitoring information may be transmitted from the window server to the management server, and the management server may receive the monitoring information from the window server. The function of monitoring the Windows server and transmitting the monitoring information to the management server may be implemented as a daemon program. The daemon program thus implemented is installed in the Windows server, and the daemon program is set to run when the Windows server is booted. Then, the daemon program is always running while the Windows server is running, and while the Windows server is running, the daemon program can be monitored and the monitoring information can be transmitted to the management server.

When the user logs in to the window server, the window server 110 may notify the administrator of login information regarding the login in a predetermined manner. In this case, the login information may be information about login, and may include, for example, information on whether there is a login, a login time, an ID of a logged in user, and the like. In addition, the predetermined method may include, but is not limited to, SMS, E-mail, voice call, messaging service, and the like. For example, an app program dedicated to the present invention may be created and installed on an administrator's smartphone, and when a user logs in to a Windows server, login information about login may be transmitted to an app program installed on the administrator's smartphone. . Then, the app program can deliver the login information to the user using vibration, text message and / or audio output.

The window server 110 may monitor the use of the logged in user of the window server 110. The window server 110 may periodically capture a screen of the window server 110 when the logged-in user generates a predetermined administrator event. The predetermined administrator event is an event predetermined by the administrator. For example, when the logged-in user executes the environment setting of Internet Information Service (IIS), the logged-in user executes the environment setting of the window server 110. In this case, the logged-in user may access the management system of the window server 110, and the logged-in user may access the system file of the window server 110. For example, if the logged-in user executes the configuration of Internet Information Services (IIS), a predetermined administrator event. If the logged-in user executes the configuration of Internet Information Services (IIS), the daemon program The screen of the window server 110 may be periodically captured.

In addition, the predetermined manager event may be predefined by the administrator and may include a user event of a mouse or a keyboard. For example, the daemon program provides an interface through which an administrator can input an administrator event to be monitored, and the administrator can add, modify, and / or delete an administrator event using the interface. The manager event may include a user input using a mouse or a keyboard.

Accordingly, the window server 110 may transmit the captured screen to the management server 120. The window server 110 determines whether the login is a remote login or a local login, and when the login is a remote login, the login ID of the login and the IP address of the terminal remotely logged in to the window server 110 together with the captured screen. The management server 120 may transmit. In addition, when the login is a local login, the window server 110 may transmit the login ID of the login to the management server 120 together with the captured screen.

In this case, the window server 110 may display a login time when the user logs in to the window server 110, a top-level window name of the screen of the window server 110, and / or text typed by the user logged in from the window server 110. The management server 120 may transmit. For example, if a Microsoft "Microsoft Word" program is running at the top of the screen of the Windows server 110, and a document called "Samples" is opened, the top-level window name is "Sample-Microsoft Word". do. The uppermost window name of the screen of the window server 110 may be obtained by using window programming. In addition, if a user executes a "Microsoft Word" program of Microsoft Corporation and types text, the typed text may be transmitted to the management server 120. In this case, the text may be cut into a predetermined time unit (for example, 2 seconds), and the text input during the time unit may be collected and transmitted to the management server 120, or the text may be input until there is an input such as "enter". After the collection, when the input of a specific key such as "enter" occurs, the collected text may be transmitted to the management server 120 at once.

When the user logged in to the window server 110 generates a predetermined administrator event, the management server 120 may periodically receive capture information from which the screen of the window server 110 is captured from the window server 110. . If the login is a remote login, the management server 120 may receive the login ID of the login and the IP address of the terminal remotely logged in to the Windows server as additional information. If the login is a local login, the login ID of the login is additional information. Can be received.

The management server 120 may receive additional information associated with the capture information from the window server 110, and connect the capture information to generate a video. In this case, for example, the additional information associated with the capture information may include the top-level window name of the screen of the window server 110, the text typed by the user logged in the window server 110, and the user logged in to the window server 110. Time and the like. In addition, as a method of generating a video by connecting the capture information, for example, the screen captured by the window server 110 can be periodically connected in a unit of 1 second to generate a video. Since the management server 120 receives the screen captured periodically from the window server 110, it is possible to connect the received screens to make a video. For example, when the window server 110 captures the screen of the window server 110 at an interval of 1 second, the video may be a video which is a screen capture of the window server 110 at an interval of 1 second. In this way, if the video is provided to the administrator by using the video, the administrator can easily check what has happened in the window server 110 through video playback without looking at each capture screen.

The management server 120 may generate metadata of the video using the additional information associated with the capture information, and store the video and the metadata in association with each other.

When the user logs in to the window server 110, the manager terminal 130 may be notified of information about the login. For example, the administrator terminal 130 may be notified of information on whether there is a login, a login time, a logged in user ID, and the like. In this case, the notification method may be notified through SMS, E-mail, and the corresponding app.

2 is a block diagram showing the configuration of a window server according to an embodiment of the present invention.

The window server 200 is a server using a window as an operating system, and may include a login monitoring unit 210, a notification unit 220, a control unit 230, and a communication unit 240.

The login monitoring unit 210 may monitor whether the user logs in to the Windows server.

When the user logs in to the window server, the notification unit 220 may notify the administrator of login information regarding the login in a predetermined manner. The login information is information about login, and may include, for example, information on whether there is a login, a login time, a logged in user ID, and the like. In this case, the login information regarding the login may be notified to the administrator through SMS, E-mail, and the corresponding app.

The controller 230 monitors the use of the logged-in user's window server and periodically captures the screen of the window server when the logged-in user generates a predetermined administrator event. At this time, when the logged-in user executes the configuration of the Internet Information Service, when the logged-in user executes the configuration of the Windows server, when the logged-in user accesses the management system of the Windows server and the logged-in user If it includes at least one of the case of accessing the system file of the server, it is possible to periodically capture the screen of the Windows server.

The communicator 240 may transmit the captured screen to the management server. At this time, it may be determined whether the login is a remote login or a local login. If the login is a remote login, the login ID of the login and the IP address of the terminal remotely logged in to the Windows server may be transmitted to the management server along with the captured screen. For example, abc1, a login ID, and 192.01.2.195, an IP address of a remotely logged in terminal, may be transmitted to the management server along with the captured screen.

In addition, when the login is a local login, the login ID of the login may be transmitted to the management server along with the captured screen. For example, when the login is a local login, the login ID abc2 may be transmitted to the management server along with the captured screen. In addition, the time when the user logged in to the window server, the name of the top-level window of the screen of the window server, and the text typed by the user logged in from the window server may be transmitted to the management server.

The window server according to an exemplary embodiment may efficiently manage the capture information and the capture screen by periodically capturing the window screen and transmitting the captured window screen to the management server.

3 is a flowchart illustrating a method of transmitting monitoring information from a window server to a management server according to an embodiment of the present invention.

When the user logs in to the window server in step 310, the administrator may be notified of the login information about the login in a predetermined manner. For example, information about login may be notified to the administrator through SMS, E-mail, and the corresponding app.

In operation 320, the window server may monitor usage of the logged in user's window server.

In operation 330, the window server may periodically capture the screen of the window server when the logged-in user generates a predetermined administrator event. For example, if a predetermined administrator event is generated, the logged-in user executes the configuration of the Internet Information Service. If the logged-in user executes the configuration of the Windows server, the logged-in user executes the configuration of the Windows server. When accessing the management system, the logged-in user may include at least one of accessing the system file of the Windows server.

In operation 340, the window server may transmit the captured screen to the management server. For example, when the login is a remote login, the login ID of the login and the IP address of the terminal remotely logged in to the window server may be transmitted to the management server along with the captured screen. In addition, when the login is a local login, the login ID of the login may be transmitted to the management server along with the captured screen. In addition, at least one of a time when the user logs in to the window server, a top-level window name of the screen of the window server, and text typed by the user logged in from the window server may be transmitted to the management server.

4 is a block diagram showing the configuration of a management server according to an embodiment of the present invention.

The management server is a server that manages the window server, and may include a communication unit 410, a video generation unit 420, a metadata generation unit 430, and a storage unit 440.

The communication unit 410 may receive capture information and additional information associated with the capture information from the window server. In more detail, when the login is a remote login, the login ID of the login and the IP address of the terminal remotely logged in to the Windows server may be received as additional information. When the login is a local login, the login ID of the login may be additional information. Can be received. In this case, the additional information may be additional information, and may be a top-level window name of the screen of the window server, text typed by a user logged in the window server, and a login time when the user logs in to the window server.

The video generator 420 may connect the capture information to generate a video. For example, if the screen of the Windows server is captured in one second unit, the video can be generated by connecting the captured screen in one second unit.

The metadata generator 430 may generate metadata of the video using the additional information. The metadata generator 430 may generate metadata of the video using a login ID, a login time, a terminal IP address, a top-level window name, and text typed by the user.

The storage unit 440 may associate and store the video and the metadata. For example, in the metadata for video 1, the login ID is abc1, the login time is September 25, 2013 08:45, the terminal IP address is 192.01.2.195, the top-level window name is server monitored, and the user typed text is You can enter a server surveillance confirmation and associate and store metadata for video 1 and video 1.

The management server according to an embodiment may generate a video by connecting the capture information received from the window server, and store the generated video to quickly alert when a window hack occurs and support window recovery.

5 is a flowchart illustrating a method of receiving monitoring information from a window server according to an embodiment of the present invention.

In operation 510, when a user logged in to the window server generates a predetermined administrator event, the management server may periodically receive capture information of a screen of the window server from the window server.

In operation 520, the management server may receive additional information associated with the capture information from the window server. In this case, the additional information may be information including at least one of a top-level window name of a screen of the window server, text typed by a user logged in the window server, and a login time when the user logs in to the window server.

In operation 530, the management server may connect the capture information to generate a video.

In operation 540, the management server may generate metadata of the video using the additional information. The management server may generate the metadata of the video by using the login ID, the login time, the terminal IP address, the uppermost window name, and the text typed by the user.

In operation 550, the management server may associate and store the video and the metadata.

6 is a diagram illustrating an example of associating and storing video and metadata in a management server according to an embodiment of the present invention.

The management server may receive additional information associated with the capture information from the window server, and connect the capture information to generate a video. In this case, for example, the additional information associated with the capture information may include a top-level window name of a screen of the window server, text typed by a user logged in the window server, and a login time when the user logs in to the window server. The management server may generate the metadata of the video by using the additional information associated with the capture information, and store the video and the metadata in association.

The management server may be divided into the video field 610 and the metadata fields 620, 621, 622, 623, and 624 and stored in the form as shown in FIG. 6. The metadata field may include a login ID field 620, a login time field 621, a terminal IP address field 622, a top-level window name field 623, and a text field 624 typed by a user. In this case, if at least one of a login ID, a login time, a terminal IP address, a top-level window name, and text is input in the field, metadata may be generated.

For example, assuming that the user logged in remotely, the metadata was logged in through the ID abc1, and the login time may be 08:45 minutes on September 25, 2013, and the IP address of the terminal is 192.01. May be .2.195. In this case, the video may be generated by capturing and connecting the screen in units of 1 second from 8:45 on September 25, 2013, and the metadata according to the video 1 and the video 1 may be stored together.

When a hack occurs in the Windows server, the management server according to an embodiment may search later through the generated video and metadata to quickly cope with the hack and recover.

Operations described above are implemented as a daemon program, and the daemon program may be installed in a Windows server. In addition, when the Windows server is booted, the daemon program is set to be executed so that the daemon program is always running while the Windows server is running.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable array (FPA) A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

100: Internet
110: Windows server
120: management server
130: user terminal

Claims (11)

In the method for transmitting monitoring information from the Windows server to the management server,
When a user logs in to the window server, notifying the administrator of login information regarding the login in a predetermined method;
Monitoring usage of the logged-in user on the window server;
Periodically capturing a screen of the window server when the logged-in user generates a predetermined administrator event; And
Transmitting the captured screen to the management server
Lt; / RTI >
If the logged-in user generates a predetermined administrator event,
When the logged-in user executes an environment setting of an Internet information service (IIS);
When the logged-in user executes configuration of the window server;
When the logged-in user accesses the management system of the window server; And
When the logged in user accesses the system file of the window server
At least one of
How to transmit the monitoring information from the Windows server to the management server comprising a. delete The method of claim 1,
The predetermined manager event,
And pre-specified by the administrator and transmitting the monitoring information from the window server to the management server. The method of claim 1,
The transmitting the captured screen to the management server,
Determining whether the login is a remote login or a local login;
If the login is a remote login, transmitting the login ID of the login and the IP address of the terminal remotely logged in to the window server together with the captured screen to the management server; And
If the login is a local login, transmitting a login ID of the login along with the captured screen to the management server;
How to transmit the monitoring information from the Windows server to the management server comprising a. The method of claim 1,
The transmitting the captured screen to the management server,
Transmitting the name of the uppermost window of the screen of the window server to the management server
How to transmit the monitoring information from the Windows server to the management server comprising a. The method of claim 1,
The transmitting the captured screen to the management server,
Transmitting text typed by the logged-in user to the management server in the window server
How to transmit the monitoring information from the Windows server to the management server comprising a. In the method for receiving monitoring information from the window server,
Periodically receiving, from the window server, capture information captured by a screen of the window server when a user logged in to the window server generates a predetermined administrator event;
Receiving additional information associated with the capture information from the window server;
Connecting the capture information to generate a video;
Generating metadata of the video using the additional information; And
Associating and storing the video and the metadata
Lt; / RTI >
If the logged-in user generates a predetermined administrator event,
When the logged-in user executes an environment setting of an Internet information service (IIS);
When the logged-in user executes configuration of the window server;
When the logged-in user accesses the management system of the window server; And
When the logged in user accesses the system file of the window server
At least one of
How to receive monitoring information from the Windows server comprising a. The method of claim 7, wherein
Receiving additional information associated with the capture information from the window server,
If the login is a remote login, receiving the login ID of the login and the IP address of the terminal remotely logged in to the window server as the additional information; And
If the login is a local login, receiving a login ID of the login as the additional information
How to receive monitoring information from the Windows server comprising a. The method of claim 7, wherein
The additional information,
The name of the top-level window of the window server's screen;
Text typed by the logged-in user in the window server; And
Login time when the user logs in to the window server
Receiving surveillance information from a Windows server comprising at least one of. In Windows Server,
A login monitoring unit configured to monitor whether the user logs in to the window server;
A notification unit for notifying an administrator of the login information about the login when the user logs in to the window server;
A controller configured to monitor usage of the logged-in user on the window server and to periodically capture a screen of the window server when the logged-in user generates a predetermined administrator event; And
Communication unit for transmitting the captured screen to the management server
Lt; / RTI >
If the logged-in user generates a predetermined administrator event,
When the logged-in user executes an environment setting of an Internet information service (IIS);
When the logged-in user executes configuration of the window server;
When the logged-in user accesses the management system of the window server; And
When the logged in user accesses the system file of the window server
At least one of
Windows server comprising a. In the management server for managing the Windows server,
A communication unit configured to receive capture information and additional information associated with the capture information from the window server;
A video generating unit which connects the capture information to generate a video;
A metadata generator configured to generate metadata of the video using the additional information; And
A storage unit to associate and store the video and the metadata
Lt; / RTI >
The capture information,
Screen of the window server captured when a user logged in to the window server generates a predetermined administrator event
/ RTI >
If the logged-in user generates a predetermined administrator event,
When the logged-in user executes an environment setting of an Internet information service (IIS);
When the logged-in user executes configuration of the window server;
When the logged-in user accesses the management system of the window server; And
When the logged in user accesses the system file of the window server
At least one of
Management server comprising a.

Images