Server monitor program, server monitor device, and server monitor method

• US 20070162596A1
• Filed: 04/14/2006
• Published: 07/12/2007
• Est. Priority Date: 01/06/2006
• Status: Abandoned Application

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Sekiguchi, Atsuji
• Application Number:
  US11/403,825
• Publication Number:
  US 20070162596A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Disclosed is a medium, server monitor device, and server monitor method which are capable of obtaining an audit trail even if an administrator authority of a server leaks. The server monitor program is to be executed by a computer of an ATP 3 connected between a client machine 2 and a server machine 1. The server monitor program comprises: a relay step that relays between the client machine 2 and the server machine 1, and manages information concerning the relay by a relay information management table 32; and a server state monitor step that determines whether the server machine 1 works abnormally or not, based on communication between the ATP 3 and the server machine 1, and records, in a relay log 33, information included in relay information corresponding to relay to the server machine 1 and included in the relay information management table 32 if the server machine 1 is determined as working abnormally.

Claims

1. A computer-readable recording medium having a server monitor program recorded thereon, said program adapted to execute on a computer of a server monitor device connected between a client and a server, the program comprising:

a relay step that relays between the client and the server, and manages information concerning the relay as relay information; and

a server state monitor step that determines whether the server works abnormally or not, based on communication between the server monitor device and the server, and records, in a log, information included in relay information corresponding to relay to the server if the server is determined as working abnormally.

2. The medium according to claim 1, wherein if a server-normal notification as a notification given when the server works normally cannot be received, the server state monitor step determines the server as working abnormally.

3. The medium according to claim 2, wherein

the server-normal notification is transmitted to the server monitor device from the server at predetermined timing, and

if the server monitor device cannot receive the server-normal notification for a predetermined period, the server state monitor step determines the server as working abnormally.

4. The medium according to claim 1, wherein if a server-abnormal notification indicating that the server is working abnormally is received, the server state monitor step determines the server as working abnormally, and records information included in the server-abnormal notification in a log, with correspondence established with relay information.

5. The medium according to claim 1, wherein if the server is determined as working abnormally, the server state monitor step further terminates relay to the server.

6. The medium according to claim 5, wherein

only while relaying, the relay step manages relay information concerning the relay, and

if the server is determined as working abnormally, the server state monitor step deletes relay information corresponding to the server, thereby to terminate relay to the server.

7. The medium according to claim 1, wherein the relay information includes an IP address and a port number of each of the client, the server and the server monitor device.

8. A server monitor device connected between a client and a server, comprising:

a relay section that relays between the client and the server, and manages information concerning the relay as relay information; and

a server state monitor section that determines whether the server works abnormally or not, based on communication between the server monitor device and the server, and records, in a log, information included in relay information corresponding to relay to the server if the server is determined as working abnormally.

9. A server monitor method using a server monitor device connected between a client and a server, comprising:

a relay step that relays between the client and the server, and manages information concerning the relay as relay information, in the server monitor device; and

a server state monitor step that determines whether the server works abnormally or not, based on communication between the server monitor device and the server, and records, in a log, information included in relay information corresponding to relay to the server if the server is determined as working abnormally, in the server monitor device.

10. The server monitor method according to claim 9, wherein after the relay step, the server executes a server state notification step that determines whether the server works abnormally or not and transmits server-abnormal notification as a notification including information of abnormality if the server is determined as working abnormally, to the server monitor device.

11. The server monitor method according to claim 10, wherein

during normal operation, the server state notification step transmits a server-normal notification to the server monitor device at predetermined timing, the server-normal notification being a notification indicating that the server works normally, and

the server state monitor step monitors the notification from the server state notification step, and determines the server as working abnormally if the server-normal notification cannot be received for a predetermined period.

12. The server monitor method according to claim 10, wherein if the server-abnormal notification is received, the server state monitor step determines the server as working abnormally, and records, in a log, information of abnormality included in the server-abnormal notification.

13. The server monitor method according to claim 9, wherein if the server is determined as working abnormally, the server state monitor step further terminates relay to the server.

14. The server monitor method according to claim 13, wherein

only while relaying, the relay step manages relay information concerning the relay, and

if the server is determined as working abnormally, the server state monitor step deletes relay information corresponding to the server, thereby to terminate relay to the server.

15. The server monitor method according to claim 10, wherein

after the relay step, the server executes an unauthorized access monitor step that, if unauthorized access to the server is detected, outputs information of the detected unauthorized access as unauthorized access information, and

the server state notification step obtains an output from the unauthorized access monitor step, and determines whether the server works abnormally or not, based on the output from the unauthorized access monitor step.

16. The server monitor method according to claim 15, wherein

during normal operation, the unauthorized access monitor step outputs normal information at predetermined timing, the normal information indicative of being normal, and

if the normal information cannot be obtained from the unauthorized access monitor step, the server state notification step determines the server as working abnormally, and transmits a server-abnormal notification including information of the abnormality, to the server monitor device.

17. The server monitor method according to claim 15, wherein if unauthorized access to the server is detected, the unauthorized access monitor step establishes correspondence between information of manipulation concerning the unauthorized access and information of communication, and takes a result thereof as unauthorized access information.

18. The server monitor method according to claim 15, wherein if unauthorized access information is outputted by the unauthorized access monitor step, the server state notification step determines the server as working abnormally, and transmits a server-abnormal notification including the unauthorized access information to the server monitor device.

19. The server monitor method according to claim 10, wherein

during normal operation, the server state notification step outputs, at predetermined timing, normal information indicative of being normal, and

after the server state notification step, the server further executes a server state notification monitor step that obtains an output from the server state notification step, determines the server as working abnormally if the normal information from the server state notification step cannot be obtained for a predetermined period, and records information of the abnormality, in a log.

20. The server monitor method according to claim 9, wherein the relay information includes an IP address and a port number of each of the client, the server, and the server monitor device.