Abstract: When a computer as a logical connection destination which detected a search objective user issues a search request to first one of computers which established logical connections associated with the search objective user, the first computer selects users who used my computer in a use time of the search objective user, and executes the search request over the computers which established the logical connections associated with the selected users. The same search request is sequentially carried out over m candidates of the logical connection originator computer of my computer down to an m-th computer. Search results (a computer identifier of my computer and user identifiers of the selected users) obtained by the m computers are collected in the respective computers and returned to the logical connection destination computer in an order opposite to the search request order.

Abstract: A computer for gathering log data includes a device for normalizing the log data by cutting out values corresponding to pre-defined data items from log data in log files of respective computers on the alert and re-arranging the values of data items defined, and storing the normalized log data therein and a device for gathering the stored normalized log data into a computer having a manager function. Further, when the normalized log data have log data output times corrected on the basis of a time of the computer having the manager function, the normalized log data are stored in order of the corrected log data output times.

Abstract: When a computer as a logical connection destination which detected a search objective user issues a search request to first one of computers which established logical connections associated with the search objective user, the first computer selects users who used a searched computer in a use time of the search objective user, and executes the search request over the computers which established the logical connections associated with the selected users. The same search request is sequentially carried out over m candidates of the logical connection originator computer of the searched computer down to an m-th computer. Search results (a computer identifier of the searched computer and user identifiers of the selected users) obtained by the m computers are collected in the respective computers and returned to the logical connection destination computer in an order opposite to the search request order.