Operating time determination system and operating time determination method

Abstract

Objectively determine the user's working time. [Solution] The operating time determination system 1 includes a terminal audit log acquisition unit 16 that acquires terminal audit logs 13 which are records of operations on the user's terminal, and an operating time determination unit 15 that extracts a combination of the start time and end time of a predetermined operation from the user's terminal audit logs 13 acquired by the terminal audit log acquisition unit 16 and determines the operating time in addition to the user's operating time.

Description

Technical Field

[0001] The present invention relates to an operating time determination system for determining a user's operating time and an operating time determination method.

Background Art

[0002] It is important for a company to properly manage the attendance of employees in order to comply with laws and regulations. Therefore, by mechanically obtaining the working hours of employees, underreporting of overtime work is suppressed. For example, Patent Document 1 describes an invention of a system and a working time determination device for determining and visualizing the actual working time of a worker.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] The client tool of the worker terminal described in Patent Document 1 includes a timer for counting the operating time, an operation storage means for receiving and storing an operation signal, and a transmission means for transmitting the results of the operating time and the operation storage means to a management server. And, the management server described in Patent Document 1 determines the effective working time of the worker. However, there is a problem that when the user maliciously stops the working time collection program, it becomes impossible to obtain the objective computer operating time. Furthermore, when the user uses a plurality of computers, consideration has not been given to obtaining the working time of this user.

[0005] Therefore, an object of the present invention is to objectively determine the operating time of a user.

Means for Solving the Problems

[0006] To solve the aforementioned problems, the operating time determination system of the present invention is characterized by comprising: a terminal audit log acquisition unit that acquires terminal audit logs which are records of operations of a user's terminal; and an operating time determination unit that extracts a combination of the start time and end time of a predetermined operation from the user's terminal audit logs acquired by the terminal audit log acquisition unit and determines the operating time in addition to the user's operating time.

[0007] The operating time determination method of the present invention is characterized by comprising the steps of: a terminal audit log acquisition unit acquiring a terminal audit log which is a record of the user's terminal operations; and an operating time determination unit extracting a combination of the start time and end time of a predetermined operation from the user's terminal audit log acquired by the terminal audit log acquisition unit, and determining the operating time in addition to the user's operating time. Other means will be described within the descriptions of embodiments for carrying out the invention. [Effects of the Invention]

[0008] According to the present invention, it becomes possible to objectively determine the user's working time. [Brief explanation of the drawing]

[0009] [Figure 1] This is a configuration diagram of the operating time determination system according to this embodiment. [Figure 2] This is a diagram showing the configuration of the event log collection unit. [Figure 3] This is a diagram showing the configuration of the operating time determination unit. [Figure 4] This is a time chart screen of working hours displayed by the attendance management system. [Figure 5A] This is a schematic flowchart of the operating time determination process. [Figure 5B] This is a schematic flowchart of the operating time determination process. [Figure 6A] This is a detailed flowchart of the operating time determination process. [Figure 6B] This is a detailed flowchart of the operating time determination process. [Figure 6C]It is a detailed flowchart of the operation time determination process. [Figure 6D] It is a detailed flowchart of the operation time determination process. [Figure 6E] It is a detailed flowchart of the operation time determination process. [Figure 6F] It is a detailed flowchart of the operation time determination process. [Figure 6G] It is a detailed flowchart of the operation time determination process. [Figure 6H] It is a detailed flowchart of the operation time determination process. [Figure 7] It is a diagram showing an example of a log file. [Figure 8] It is a diagram showing a user key table. [Figure 9] It is a diagram showing a terminal audit log intermediate table. [Figure 10] It is a diagram showing a log detail table. [Figure 11] It is a flowchart of a process for aggregating multiple log data. [Figure 12A] It is a diagram showing log data. [Figure 12B] It is a diagram showing log data. [Figure 12C] It is a diagram showing log data. [Figure 12D] It is a diagram showing log data. [Figure 13A] It is a diagram showing the cooperation data of the first computer. [Figure 13B] It is a diagram showing the cooperation data of the second computer. [Figure 14] It is a flowchart of a process for aggregating operation time. [Figure 15] It is a diagram showing a log detail table. [Figure 16] It is a diagram showing an operation time table. [Figure 17] It is a diagram showing the source code of a batch file for extracting the startup and shutdown times of a computer from a Windows event log. [Figure 18]This diagram shows the information output from the Windows event log. [Modes for carrying out the invention]

[0010] Hereafter, embodiments for carrying out the present invention will be described in detail with reference to the figures. Figure 1 is a diagram showing the configuration of the operating time determination system 1 according to this embodiment. The operating time determination system 1 comprises a computer operation management unit 10, event log collection units 12a and 12b, a terminal audit log acquisition unit 16, an entry / exit log acquisition unit 17, and an operating time determination unit 15. The operating time determination system 1 determines the user's operating time and transmits that operating time to the attendance management system 2.

[0011] The computer operations management unit 10 is, for example, MECM (Microsoft Endpoint Configuration Manager) or SCCM (System Center Configuration Manager). The computer operations management unit 10 performs various settings on computers 30a, 30b, etc., used by users.

[0012] The event log collection unit 12a collects event logs from computer 30a based on a Windows event log request 11a to the computer 30a to which the user logs in. The event log collection unit 12a then sends attendance information 121, which is a compilation of these event logs, to the working time determination unit 15 via HTTP (Hyper Text Transfer Protocol) POST. The event log collection unit 12a is a resident program installed on computer 30a. This event log collection unit 12a also collects error messages 122 from the attendance management system 2 using HTTP.

[0013] The event log collection unit 12b is a resident program installed on the computer 30b to which the user logs in. The event log collection unit 12b is triggered by a Windows event log request 11b and operates in the same manner as the event log collection unit 12a. When there is no particular distinction between the event log collection units 12a and 12b, they are simply referred to as the event log collection unit 12. When there is no particular distinction between the event log collection units 12a and 12b, they are simply referred to as the Windows event log request 11.

[0014] The terminal audit log acquisition unit 16 acquires terminal audit logs 13 when a terminal 31 owned by a user operates a virtual machine on a server such as Windows 365 (registered trademark), or accesses and operates other web services. The terminal audit log acquisition unit 16 acquires terminal audit logs 13 from, for example, a Windows 365 server or a server that provides other web services, but is not limited to these. The terminal audit log acquisition unit 16 transmits the acquired terminal audit logs 13 to the operating time determination unit 15.

[0015] The entry / exit log acquisition unit 17 acquires information on users entering and exiting their workspaces from, for example, a card reader installed at the gate of the workspace, and thus acquires an entry / exit log 14. The entry / exit log acquisition unit 17 transmits the acquired entry / exit log 14 to the operating time determination unit 15.

[0016] Figure 2 is a diagram showing the configuration of the event log collection unit 12a. The event log collection unit 12a comprises a collection unit 123, an event log processing unit 126, and a transmission unit 127. Based on a Windows event log request 11a, the event log collection unit 12a collects event logs from the computer 30a to which the user logs in and outputs attendance information 121 compiled from these event logs.

[0017] The collection unit 123 receives a Windows event log request 11a and executes a batch file intended for computer startup. This makes it possible to obtain Windows event log information 124. The event log processing unit 126 calculates attendance information by aggregating Windows event log information 124 based on the environment settings 125. The transmission unit 127 transmits the attendance information calculated by the event log processing unit 126 to the working time determination unit 15.

[0018] Figure 3 is a diagram showing the configuration of the operating time determination unit 15. The operating time determination unit 15 comprises a receiving unit 151, a linked data processing unit 154, and a transmitting unit 155. The operating time determination unit 15 integrates attendance information received from event log collection units 12a and 12b, terminal audit logs 13 received from terminal audit log acquisition unit 16, and entry / exit logs 14 received from entry / exit log acquisition unit 17. Based on the integrated operating time, the operating time determination unit 15 determines the operating time of each user and outputs the determined operating time to the attendance management system 2. The operating time determination unit 15 further outputs the combination of start and end times for each computer, the combination of start and end times for the terminal audit logs, and the combination of entry and exit times for the entry / exit logs to the attendance management system 2.

[0019] The receiving unit 151 receives data from the event log collection units 12a and 12b, the terminal audit log acquisition unit 16, and the entry / exit log acquisition unit 17, and outputs it to the linked data processing unit 154. Specifically, the receiving unit 151 receives attendance information, terminal audit logs 13, and entry / exit logs 14.

[0020] The linked data processing unit 154 converts the received data into linked data 152 and calculates the processing result log 153. The processing result log 153 includes working time information. The linked data processing unit 154 uses the transmission unit 155 to transmit the working time information to the attendance management system 2.

[0021] Figure 4 shows the time chart screen 3 of the working hours displayed by the attendance management system. This time chart screen 3 is displayed in five lines. The first line is the Windows event log for the first machine. This Windows event log records a login at 8:30 and a logout at 10:30. Furthermore, the Windows event log records a login at 16:30 and a logout at 17:30.

[0022] The second line is the Windows event log for the second machine. This Windows event log records a login at 10:30 and a logout at 14:00. Furthermore, the Windows event log records a login at 19:30 and a logout at 20:30.

[0023] The third line is the terminal audit log. This terminal audit log records the start of work at 7:00 and the end of work at 7:30. Furthermore, the terminal audit log records the start of work at 14:30 and the end of work at 16:30, and the start of work at 21:30 and the end of work at 22:00. The fourth line is the entry and exit log. This log records an entry at 8:00 AM and an exit at 2:30 PM.

[0024] The fifth line shows the operating time determined by the operating time determination system 1. The determined operating times are from 7:00 to 7:30, from 8:00 to 17:30, and from 19:30 to 21:00. The operating time determination system 1 can determine more accurate operating time by adding the start and end time combinations of the various logs from lines 1 to 4 to the operating time.

[0025] Figures 5A and 5B are schematic flowcharts of the operating time determination process. Initially, the operating time determination unit 15 determines whether there are any logs indicating only entry or exit within the last 24 hours (step S10). If there are logs indicating only entry or exit within the last 24 hours (Yes), the process proceeds to step S11. If the logs indicating only entry or only exit are deleted after 24 hours have elapsed, the process proceeds to step S12. If there are no logs indicating only entry or exit within the last 24 hours (No), the process proceeds to step S12. In step S12, the operating time determination unit 15 converts the entry and exit logs into an operating time start and end format. The start and end format refers to a combination of entry time and exit time.

[0026] The operating time determination unit 15 determines whether there are operation logs in the terminal audit log 13 that only show the start of work or only show the end of work within the last 24 hours (step S13). Here, terminal audit log 13 refers to the operation logs when terminal 31 accesses the Windows 365 (registered trademark) server. Here, Windows 365 is a cloud-based service that creates a new type of Windows virtual machine for end users. Note that terminal audit log 13 is not limited to Windows 365 logs, but may also be operation logs of any web service. Terminal 31 refers to devices such as smartphones and tablets. However, terminal audit logs 13 are not limited to these; logs from any web service may also be obtained.

[0027] If, among the terminal audit logs 13, there are operation logs that only show the start time or only show the end time within the last 24 hours (Yes), the process proceeds to step S14, deletes the operation logs that only show the start time or only show the end time after 24 hours have elapsed, and proceeds to step S15. If there are no operation logs that only show the start time of an operation within the last 24 hours, and no operation logs that only show the end time of an operation within the last 24 hours (No), the process proceeds to step S15. In step S15, the operating time determination unit 15 converts the terminal audit log 13 into an operating time start / end format. The start / end format refers to a combination of the start time and end time related to a particular operation.

[0028] Next, the operating time determination unit 15 uses the attendance information calculated from the Windows log as the operating time (step S16). The log acquired by the operating time determination unit 15 is not limited to any log from the operating system that manages the computer.

[0029] The operating time determination unit 15 then determines whether or not there are any combinations of start and end times for entry and exit logs that are not included in the operating time (step S20). If there are entry and exit logs that are not included in the operating time (Yes), the process proceeds to step S21, and if the combinations of start and end times for entry and exit logs are added to the operating time, the process proceeds to step S22. If there are no combinations of start and end times for entry and exit logs that are not included in the operating time (No), the process proceeds to step S22.

[0030] The operating time determination unit 15 determines whether or not there are any combinations of start and end times for terminal audit logs 13 that are not included in the operating time (step S22). If there are any combinations of start and end times for terminal audit logs 13 that are not included in the operating time (Yes), the process proceeds to step S23. In step S23, if the operating time determination unit 15 adds the combinations of start and end times for terminal audit logs 13 to the operating time, the process proceeds to step S24. If there are no combinations of start and end times for terminal audit logs 13 that are not included in the operating time (No), the process proceeds to step S24.

[0031] When the operating time determination unit 15 outputs the operating time information to the attendance management system 2, the process shown in Figure 5B is completed.

[0032] Figures 6A to 6H are detailed flowcharts of the operating time determination process. This flowchart explains the process for determining the contents of terminal audit log 13. Therefore, the linked items will be briefly explained. An ID is an identifier that uniquely identifies an audit record. RecordType refers to the type of operation indicated by the record. If the record type in the audit log is ExchangeItem, it refers to an event from the Exchange mailbox audit log, such as creating or receiving a single email message, which is an action performed on a single item. The record type SharePointFileOperation refers to a SharePoint file operation event. The record type "OneDrive" refers to a Skype for Business event. The record type "MicrosoftTeams" refers to a Microsoft Teams event.

[0033] CreationTime is the date and time, in Universal Time Coordinated (UTC), when the user performed the activity. Operation is the name of the user or administrator activity. In Exchange administrator activities, this property identifies the name of the cmdlet that was executed. In DLP events, this could be "DlpRuleMatch", "DlpRuleUndo", or "DlpInfo".

[0034] UserType indicates the type of user who performed the operation. UserKey is another ID for the user identified by the UserId property. This property stores the Passport Unique Identifier (PUID) for events performed by the user in SharePoint, OneDrive for Business, and Exchange.

[0035] For SharePoint and OneDrive for Business activity, the UserId is the fully qualified path name of the file or folder accessed by the user. For Exchange administrator audit logs, it is the name of the object modified by the cmdlet.

[0036] Email-related operations MailItemsAccessed indicates access to mailbox items. Create indicates the creation of mailbox items. Copy indicates the copying of messages to another folder. Move indicates the moving of messages to another folder. MoveToDeletedItems indicates the moving of messages to the Deleted Items folder. HardDelete indicates the deletion of messages from the mailbox. Send indicates sent messages. Update indicates the updating of messages.

[0037] File manipulation operations FileAccessed indicates that the file has been accessed. FileCheckedOut indicates that the file has been checked out. FileDownloaded indicates that the file has been downloaded. FileModified indicates that the file has been modified. FileUploaded indicates that the file has been uploaded. FileCheckedIn indicates that the file has been checked in.

[0038] Teams-related operations MeetingParticipantDetail indicates that information about the meeting participant has been added.

[0039] First, the operating time determination unit 15 determines whether the Usertype of the terminal audit log 13 is 0 or not (step S30). If the Usertype of the terminal audit log 13 is not 0 (No), the process proceeds to step S31, where the log for that terminal audit log 13 is deleted, and then the process proceeds to step S33. If the Usertype of the terminal audit log 13 is 0 (Yes), the process proceeds to step S32, where the UserID and UserKey are obtained as a set, and then the process proceeds to step S33.

[0040] In step S33 of Figure 6B, the operating time determination unit 15 determines whether or not RecordType is ExchangeItem. If RecordType is ExchangeItem (Yes), the process proceeds to step S34. If RecordType is not ExchangeItem (No), the process proceeds to step S40. The following processes from steps S34 to S39 concern the operation logs of the application specified as RecordType ExchangeItem.

[0041] In step S34, the operating time determination unit 15 determines whether the Operation is MailItemsAccessed, Create, Copy, Move, MoveToDeletedItems, Send, or Update. These Operations relate to the start of an operation of the application.

[0042] If this condition is not met (No), the process proceeds to step S35, where the log is deleted, and then the process proceeds to step S40. If this condition is met (Yes), the operating time determination unit 15 obtains Creationtime, ObjectID, UserID, and Operation (step S36).

[0043] The operating time determination unit 15 then determines whether there is information for MailItemsAccessed or Create for an Operation where the Operation is Copy or Move, MoveToDeletedItems, Send, or Update, the time difference of Creationtime is within 24 hours retrospectively, and the UserID and ObjectID match (step S37). These Operations relate to the termination of the operation of the application.

[0044] If the determination in step S37 is not true (No), the process proceeds to step S38, and the operating time determination unit 15 deletes this log. Then, the process proceeds to step S40. If the determination in step S37 is true (Yes), the process proceeds to step S39.

[0045] In step S39, the operational time determination unit 15 sets the start time to the latest creation time among those where Operation is MailItemsAccessed or Create. The end time is set to the creation time where Operation is Copy, Move, MoveToDeletedItems, Send, or Update, the address is set to UserID, and the logtype is set to office. Based on this, the operational time determination unit 15 extracts the start time and end time combinations for this application. Then the process proceeds to step S40.

[0046] In step S40 of Figure 6C, the operating time determination unit 15 determines whether the RecordType is SharePointFileOperation or OneDrive. If the determination in step S40 is successful, the process proceeds to step S59 of Figure 6G. The following processes from steps S40 to S45 concern the operation logs of applications where RecordType is specified as SharePointFileOperation or OneDrive.

[0047] In step S41, the operating time determination unit 15 determines whether the earliest Creation time is found among logs where Operation is FileAccessed, FileDownloaded, or FileCheckedOut, and where ObjectID and UserID match. If the determination in step S41 is true (Yes), the process proceeds to step S42. Then, the operating time determination unit 15 obtains Creationtime, ObjectID, UserID, and Operation, and proceeds to step S46 in Figure 6D. If the determination in step S41 is not true (No), the process proceeds to step S43.

[0048] In step S43, the uptime determination unit 15 determines whether Operation is FileModified, FileModifiedExtended, FileUploaded, or FileCheckedIn. If the determination in step S43 is not true (No), the uptime determination unit 15 deletes the log. Then the process proceeds to step S46 in Figure 6D. If the determination in step S43 is true (Yes), the uptime determination unit 15 obtains Creationtime, ObjectID, UserID, and Operation, and then proceeds to step S46 in Figure 6D.

[0049] In step S46 of Figure 6D, the operating time determination unit 15 determines whether Operation is FileCheckedIn or not. If the determination in step S46 is not true (No), the process proceeds to step S50 of Figure 6E. If the determination in step S46 is true (Yes), the process proceeds to step S47.

[0050] In step S47, the operational time determination unit 15 determines whether information exists in the intermediate table where the UserID and ObjectID match, the Operation is FileCheckedOut, and the time difference in Creationtime is within 24 hours prior. If the determination in step S47 is not true (No), the operational time determination unit 15 deletes the log in step S48. After that, the process proceeds to step S50 in Figure 6E. If the determination in step S47 is true (Yes), the operational time determination unit 15 sets the start time Start in step S49 to the latest Creationtime among those with Operation FileCheckedIn. The operational time determination unit 15 then sets the end time End to the latest Creationtime where Operation is FileCheckedOut, Address is UserID, and LogType is office. After that, the process proceeds to step S50 in Figure 6E.

[0051] In step S50 of Figure 6E, the operating time determination unit 15 determines whether Operation is FileUploaded or not. If the determination in step S50 is not true (No), the process proceeds to step S54 of Figure 6F. If the determination in step S50 is true (Yes), the process proceeds to step S51.

[0052] In step S51, the operational time determination unit 15 determines whether information exists in the intermediate table where the UserID and ObjectID match, the Operation is FileDownloaded, and the time difference in Creationtime is within 24 hours prior. If the determination in step S51 is not true (No), the operational time determination unit 15 deletes the log, and the process proceeds to step S54 in Figure 6F. If the determination in step S51 is true (Yes), the start time Start is set to the latest time within the Creationtime for Operation FileUploaded. The end time End is set to the Creationtime for Operation FileDownloaded, with Address being UserID and Logtype being office. The process then proceeds to step S54 in Figure 6F.

[0053] In step S55 of Figure 6F, the operating time determination unit 15 determines whether Operation is FileModified or FileModifiedExtended. If the determination in step S55 is not true (No), the process in Figure 6F is terminated. If the determination in step S55 is true (Yes), the process proceeds to step S56.

[0054] In step S56, the operating time determination unit 15 determines whether information exists in the intermediate table where the UserID and ObjectID match, the Operation is FileAccessed, and the time difference in Creationtime is within 24 hours prior. If the determination in step S56 is not true (No), the operating time determination unit 15 deletes the log and then terminates the process shown in Figure 6F. If the determination in step S56 is true (Yes), the start time Start is set to the latest time within the Creationtime for Operation FileAccessed. The end time End is set to the Creationtime for Operation FileModified or FileModifiedExtended, with Address being UserID and Logtype being office. Then, the process shown in Figure 6F is terminated.

[0055] In step S59 of Figure 6G, the operating time determination unit 15 determines whether or not RecordType is MicrosoftTeams. If the determination in step S59 is not true (No), the process proceeds to step S65 of Figure 6H. If the determination in step S59 is true, the process proceeds to step S60.

[0056] In step S60, the operating time determination unit 15 determines whether Operation is MeetingParticipantDetail. If the determination in step S60 is not true (No), the process proceeds to step S61, where the operating time determination unit 15 deletes the log. After that, the process proceeds to step S65 in Figure 6H. If the determination in step S60 is true (Yes), the process proceeds to step S62.

[0057] In step S62, the operational time determination unit 15 obtains the time of joining and leaving the Teams meeting and the UserKey. Then, the operational time determination unit 15 obtains the UserID from the UserKey (step S63). The operational time determination unit 15 sets the start time as the joining time, the end time as the leaving time, the Address as the UserID, and the Logtype as office (step S64).

[0058] In step S65, the operating time determination unit 15 determines whether or not an entry / exit log exists. If the determination in step S65 is not true (No), the operating time determination unit 15 deletes the log (step S66) and terminates the process shown in Figure 6H. If the determination in step S65 is true (Yes), the process proceeds to step S67.

[0059] In step S67, the operational time determination unit 15 saves the history date and time, personal ID, and message content to the temporary entry / exit table. Then, the operational time determination unit 15 determines whether the message content is for exit and the personal ID matches the previous history date and time log, and whether the difference between the entry and exit log dates and times is within 24 hours (step S68). If the determination in step S68 is not true (No), the operational time determination unit 15 deletes the log (step S69) and terminates the process in Figure 6H. If the determination in step S68 is true (Yes), the start time Start is set as the history date and time of entry, the end time End is set as the history date and time of exit, LDAP (Lightweight Directory Access Protocol) is set as the personal ID, and Logtype is set as gate (step S70). Then, the process in Figure 6H is terminated.

[0060] Figure 7 shows an example of a log file. This log file contains the following fields: UserType, Userkey, User, Record Type, Activity, and Objectid (in two different ways).

[0061] Figure 8 shows the user's key table. The user key table records the correspondence between UserID and Userkey.

[0062] Figure 9 shows the terminal audit log intermediate table. This terminal audit log intermediate table consists of UserID, Operation, Objectid, and Date columns. This allows for easy processing of each user's audit log. In this example, FileCheckedOut and FileCheckedIn are stored as Operation entries in the records of this terminal audit log intermediate table.

[0063] Figure 10 shows the log details table. This log details table consists of an LDAP column, an Address column, and a Start column. From the aforementioned terminal audit log intermediate table, combinations of start and end times are extracted and written to this log details table.

[0064] Figure 11 is a flowchart of the process for aggregating multiple log data. When processing begins, the operating time determination unit 15 obtains the Date of event ID=7001, which is obtained together with the previous start-up end time, as the Starttime, and obtains the Date of event ID=7002 as the Endtime (step S80). Next, the operating time determination unit 15 combines the Mailaddress and LDAPID entered in the environment settings into Starttime and Endtime, and transmits this information to the operating time determination unit 15 (step S81). Finally, the operating time determination unit 15 deletes logs that are older than one month (step S82) and terminates the process shown in Figure 11.

[0065] Figures 12A to 12D show examples of log data. The log data in Figure 12A contains LDAP fields, Mail fields, two Date fields, and their child field, the Event ID field. By collecting this type of log data, linked data can be obtained from each terminal.

[0066] Figure 13A shows the linked data of the first computer. This linked data consists of an LDAP field, an Address field, a Start field, and an End field. The Address field stores the email address that uniquely identifies the user. The Start field stores the start time. The End field stores the end time.

[0067] Figure 13B shows the linked data for the second computer. This linked data, like the linked data in Figure 13A, consists of an LDAP field, an Address field, a Start field, and an End field. The Address field stores the email address that uniquely identifies the user. The Start field stores the start time. The End field stores the end time.

[0068] Figure 14 is a flowchart of the process for summing up operating hours. Initially, the operating time determination unit 15 retrieves the Start, End, LDAP, and Address of the record with Logtype "win" from the log details table and sets them in the Start, End, LDAP, and Address fields of the operating time table (step S90).

[0069] Next, the uptime determination unit 15 determines whether the Start and End times in the Logtype of the log details table are included within the Start and End of the data with the same LDAP in the uptime table (step S91). If the determination in step S91 is true (Yes), the process proceeds to step S93. Then, in step S93, the uptime determination unit 15 adds the time not included in the uptime table to the uptime table, and if the record is split... Once LDAP and Address have been set to the same values ​​as other times in the operating time table, the process shown in Figure 14 will terminate. If the determination in step S91 is not true (No), the process proceeds to step S92.

[0070] In step S92, the operating time determination unit 15 determines whether the Start and End times in the Log details table where Logtype is office are included in the Start and End of the data with the same Address in the operating time table. If the determination in step S92 is true (Yes), the process proceeds to step S93. If the determination in step S92 is false (No), the process proceeds to step S94. Then, in step S94, the operating time determination unit 15 deletes the log and terminates the process shown in Figure 14.

[0071] Figure 15 shows the log details table. This log details table consists of an LDAP column, an Address column, a Start column, an End column, and a LogType column. The Address column stores the email address that uniquely identifies the user. The Start column stores the start time. The End column stores the end time. The LogType column stores the type of log. When the LogType column contains "office", it stores the start and end times based on terminal audit log 13. When the LogType column contains "gate", it stores the start and end times based on entry / exit log 14.

[0072] Figure 16 shows the operating time table. This uptime table consists of an LDAP column, an Address column, a Start column, and an End column. The Address column stores the email address that uniquely identifies the user. The Start column stores the start time. The End column stores the end time.

[0073] Figure 17 shows the source code of a batch file that extracts the computer's startup and shutdown times from the Windows event log. This batch file has `backday`, which is the number of days for which logs will be collected, set to 30. Next, to convert from GMT to JST, the log collection start time is set to 15:00 on the first day.

[0074] Then, the first part of the filename is created and combined with the destination folder name, and a date string "x days ago" is created, and the file is saved in EVTX and TXT formats.

[0075] Figure 18 shows the information output from the Windows event log. Here, Event[0] and Event[1] are shown. Event[0] and Event[1] contain the following fields, respectively: Log Name, Source, Date, Event ID, Task, Level, Opcode, Keyword, User, User Name, Computer, and Description.

[0076] (Effects of this embodiment) The first embodiment described above has the following effects (A) to (B). (A) Even if a user maliciously stops the tool corresponding to the event log collection unit, the computer operation management unit 10 will appropriately instruct the tool to stop and restrict tampering. As a result, the system of this embodiment can reliably acquire computer operation logs.

[0077] (B) Even if the work is done using a smartphone or tablet, this work time can be added to the working hours. This makes it possible to more reliably prevent underreporting of overtime. Therefore, the company can establish sound management, prevent legal violations, and prevent damage to the company's image.

[0078] The configuration and effects of the present invention will be described below.

[0079] [1] A terminal audit log acquisition unit (16) acquires terminal audit logs, which are records of the user's terminal operations, The terminal audit log acquisition unit (16) extracts a combination of the start time and end time of a predetermined operation from the user's terminal audit log and determines the working time in addition to the user's working time, and the operating time determination unit (15) An operating time determination system characterized by comprising the following features.

[0080] This allows for an objective determination of user working hours.

[0081] [2] The operating time determination unit (15) shall not add to the user's operating time any operation logs from the user's terminal audit logs acquired by the terminal audit log acquisition unit (16) whose start and end times do not correspond within a 24-hour period. The operating time determination system according to feature 1.

[0082] This allows for a relatively accurate determination of operating time even if one of the operation logs (start or end) is incorrectly not recorded.

[0083] [3] The terminal audit log is a log of when the user operated the web service. The operating time determination system according to feature 1.

[0084] This allows the time spent operating web services to be included in the working hours.

[0085] [4] The aforementioned terminal audit log is a log of when the user operated a virtual machine on the server. The operating time determination system according to feature 1.

[0086] This allows the time spent by users operating virtual machines on the server to be included in the uptime.

[0087] [5] The facility further includes an entry / exit log acquisition unit (17) that acquires logs of the user's entry and exit, The operating time determination unit (15) further extracts combinations of start and end times from the user's entry and exit logs acquired by the entry and exit log acquisition unit (17) and adds them to the user's operating time information. The operating time determination system according to feature 1.

[0088] This allows the time it takes for users to enter and exit each work area to be added to the working time.

[0089] [6] The operating time determination unit (15) does not add to the user's operating time any user entry and exit logs acquired by the entry and exit log acquisition unit (17) that do not correspond to an entry and exit within a 24-hour period. The operating time determination system according to feature 5.

[0090] This allows for a relatively accurate determination of operating time even if one of the logs (entry or exit) is incorrectly not recorded.

[0091] [7] The system further comprises one or more collection units (event log collection units 12, 12a, 12b) that collect event logs from the computer to which the user logs in. The operating time determination unit (15) calculates a combination of the start and end times of a predetermined event from the event logs collected by each of the collection units (event log collection units 12, 12a, 12b), and makes a determination in addition to the user's operating time. The operating time determination system according to claim 1, characterized by comprising the following:

[0092] This allows the time users spend operating each computer to be added to the operating time.

[0093] [8] The operating time determination unit (15) does not add logs of predetermined events from the user's event logs acquired by the collection unit (event log collection units 12, 12a, 12b) where the start and end of work do not correspond within a 24-hour period to the user's operating time. The operating time determination system according to feature 7.

[0094] This allows the time it takes for a user to log in to and log out of each computer to be added to the uptime.

[0095] [9] The operating time determination unit (15) outputs the user's operating time to the attendance management system (2). The operating time determination system according to feature 1.

[0096] This allows the determined working hours to be reflected in attendance records.

[0097]

[10] The operating time determination unit (15) outputs to the attendance management system (2) a combination of the start and end times of the user's predetermined operation and the user's operating time in a manner that allows for comparison. The operating time determination system according to feature 9.

[0098] This allows the data, along with the basis for the determined working hours, to be output to the attendance management system.

[0099]

[11] The terminal audit log acquisition unit (16) acquires a terminal audit log, which is a record of the user's terminal operations. The operating time determination unit (15) includes the step of extracting a combination of the start time and end time of a predetermined operation from the terminal audit log of the user acquired by the terminal audit log acquisition unit (16), The steps include determining the user's working hours in addition to the user's working hours, A method for determining operating time, characterized by comprising the following:

[0100] This allows for an objective determination of user working hours.

[0101] Variant form The present invention is not limited to the embodiments described above, and includes various modifications. For example, the embodiments described above are described in detail to make the present invention easier to understand, and are not necessarily limited to those having all the configurations described. It is possible to replace parts of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add configurations from other embodiments to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0102] Each of the above configurations, functions, processing units, and processing means may be implemented in part or in whole by hardware, such as an integrated circuit. Each of the above configurations and functions may also be implemented in software by a processor interpreting and executing a program that implements each function. Information such as programs, tables, and files that implement each function can be stored in a recording device such as memory, a hard disk, or an SSD (Solid State Drive), or on a recording medium such as a flash memory card or a DVD (Digital Versatile Disk).

[0103] In each embodiment, the control lines and information lines shown are those deemed necessary for explanation and do not necessarily represent all control lines and information lines in the actual product. In practice, it can be assumed that almost all components are interconnected. [Explanation of Symbols]

[0104] 1. Operating time determination system 10. Computer Operations Management Department 12,12a,12b Event Log Collection Unit (Collection Unit) 16 Terminal Audit Log Acquisition Unit 17. Entry / Exit Log Acquisition Unit 15 Operating time determination unit 2. Attendance Management System 30a, 30b Computer 11,11a,11b Windows Event Log Request 12 Event Log Collection Department 13 Terminal Audit Logs 14. Entry / Exit Log 123 Collection Department 126 Event Log Processing Unit 127 Transmitter 124 Windows Event Log Information 125 Environment Settings 151 Receiving Unit 154 Data Integration Processing Unit 155 Transmitter 152 Linked Data 153 Processing Result Log

Claims

1. A terminal audit log acquisition unit acquires terminal audit logs, which are records of the user's terminal operations, The terminal audit log acquisition unit extracts a combination of the start and end times of a predetermined operation from the user's terminal audit log acquired by the terminal audit log acquisition unit, and determines the working time by adding it to the user's working time. An operating time determination system characterized by comprising the following features.

2. The operating time determination unit shall not add to the user's operating time any operation logs from the user's terminal audit logs acquired by the terminal audit log acquisition unit whose start and end times do not correspond within a 24-hour period. The operating time determination system according to feature 1.

3. The aforementioned terminal audit log is a log of when the user operated the Web service. The operating time determination system according to feature 1.

4. The aforementioned terminal audit log is a log of when the user operated a virtual machine on the server. The operating time determination system according to feature 1.

5. The facility further includes an entry / exit log acquisition unit that acquires logs of the user's entry and exit. The operating time determination unit further extracts combinations of start and end times from the user's entry and exit logs acquired by the entry and exit log acquisition unit, and adds them to the user's operating time information. The operating time determination system according to feature 1.

6. The operating time determination unit does not add to the user's operating time any user entry and exit logs acquired by the entry and exit log acquisition unit that do not correspond to an entry and exit within a 24-hour period. The operating time determination system according to feature 5.

7. The system further comprises one or more collection units for collecting event logs from the computer to which the user logs in. The operating time determination unit calculates a combination of the start and end times of a predetermined event from the event logs collected by each of the collection units, and makes a determination by adding it to the user's operating time. The operating time determination system according to claim 1, characterized by comprising the following:

8. The operating time determination unit shall not add to the user's operating time logs any predetermined events from the user's event logs acquired by the collection unit where the start and end of work do not correspond within a 24-hour period. The operating time determination system according to feature 7.

9. The operating time determination unit outputs the user's operating time to the attendance management system. The operating time determination system according to feature 1.

10. The operating time determination unit outputs to the attendance management system, in a manner that allows comparison between the start and end times of the user's predetermined operation and the user's operating time. The operating time determination system according to feature 9.

11. The terminal audit log acquisition unit acquires terminal audit logs, which are records of the user's terminal operations. The operating time determination unit includes the step of extracting a combination of the start time and end time of a predetermined operation from the terminal audit log of the user acquired by the terminal audit log acquisition unit, The steps include determining the user's working hours in addition to the user's working hours, A method for determining operating time, characterized by comprising:

Images