Abstract: The present invention efficiently displays in a tree structure form a file operation history. A file storage identifier, an operation identifier, and a count are stored as additional meta-information in an alternate data stream with respect to each file stored in a client terminal file system. The operation identifier manages a number of operations (operation generations). The count manages copy frequencies. This meta-information is also sent to a management apparatus, and used for displaying the file operation history in a tree structure form.

Abstract: A log management system for analyzing and managing a log acquired in a computer is provided. The system generates log groups each formed of log records with reference to the log. The system identifies active periods, in each of which a display area is active, in the log groups, and compares a start-to-end period from a start time to an end time of a reference log group selected from the log groups with active periods of subject log groups other than the reference operation log group individually to identify one or more subject log groups having an active period included in the start-to-end period. The system individually determines whether to include the identified one or more subject log groups in the same first cluster as the reference log group, based on an active period length of each of the identified one or more subject log groups within the start-to-end period.

Abstract: An embodiment of the invention is a log management system analyzing and managing a log acquired in a computer. It generates log groups each formed of log records with reference to the log. It identifies active periods, in each of which a display area is active, in the log groups, and compares a start-to-end period from a start time to an end time of a reference log group selected from the log groups with active periods of subject log groups other than the reference operation log group individually to identify one or more subject log groups having an active period included in the start-to-end period. It individually determines whether to include the identified one or more subject log groups in the same first cluster as the reference log group, based on an active period length of each of the identified one or more subject log groups within the start-to-end period.

Abstract: In an embodiment, a client acquires an operation log of operations in the client. A management system acquires a first operation log group consisting of operation log records including an operation log record of an operation in which a first problem is generated from the operation log. The management system stores in advance problem examples associated with operation log groups each consisting of operation log records and with solutions. The management system searches the operation log groups associated with the stored problem examples for an operation log group determined to be similar to the first operation log group based on the operation log records of the first operation log group. The management system determines a solution to one of the problem examples that is associated with the operation log group determined to be similar to the first operation log group, as a solution candidate to the first problem.

Abstract: In an example of operation log management system, a storage device stores a plurality of operation log records obtained from an operation log in a client computer. The plurality of operation log records each contains an operation type of a corresponding operation and a group identifier for identifying a group to which the corresponding operation belongs. Each of at least a part of the plurality of operation log records contains at least one of identifiers of input data and output data of a corresponding operation. A processor groups the plurality of operation log records into groups by the group identifiers, identifies operation log records which belong to different groups and whose output data identifier and input data identifier match, and associates the different groups to which the identified operation log records belong as components of one integrated group. A display device displays information representing the integrated group.

Abstract: An embodiment of this invention detects an improper operation to a file in a computer of a monitoring target in a computer system including a plurality of computers connected via a network. The monitoring target computer receives a file. The computer receives acquisition source information on the file transmitted from a different computer. The computer refers to information on improper operation requirements to determine whether transmission of the file meets the improper operation requirements or not, based on a combination of the acquisition source of the file indicated by the acquisition source information and a transmission destination of the file and if the improper operation requirements are met, it determines that the transmission of the file is an improper operation.

Abstract: The present invention efficiently displays in a tree structure form a file operation history. A file storage identifier, an operation identifier, and a count are stored as additional meta-information in an alternate data stream with respect to each file stored in a client terminal file system. The operation identifier manages a number of operations (operation generations). The count manages copy frequencies. This meta-information is also sent to a management apparatus, and used for displaying the file operation history in a tree structure form.