CA2335125C

CA2335125C - System and method for auditing network applications

Info

Publication number: CA2335125C
Application number: CA002335125A
Authority: CA
Inventors: Robert Wenig; Igor Tsyganskiy; Kenneth Landry
Original assignee: SAP SE
Current assignee: SAP SE
Priority date: 1998-07-10
Filing date: 1999-07-10
Publication date: 2007-06-05
Anticipated expiration: 2019-07-10
Also published as: WO2000003323A3; WO2000003323A2; US6286030B1; USRE41903E1; AU772016B2; ATE219586T1; IL140167A0; EP1097428B1; EP1097428A2; DE59901813D1; CA2335125A1; DE19981276D2; DK1097428T3; AU6077299A

Abstract

A system and a method for auditing network applications captures transmissions between a client (110) and a server (140) during a user session (130, 170) . An audit data capture filter (150) captures and stores each request (134) from the client (110) and each response (132) from the server (140) to each request (134) in an audit memory (160). An auditing analyst can use the captured requests (134) and the captured responses (132) to recreate the user session (130, 170) visually for the purpose of analyzing what has happened during the user session (130, 170).

Description

SYSTEM AND METHOD FOR AUDITING NETWORK APPLICATIONS
The present invention relates to a system and to a method for auditing network applications. In particular, the present invention relates to a system and to a method for visually recreating a user session for analyzing various aspects of the network application.
In a network application, which is also called client/server application, a client requests information from a server. The server supplies information to the client as a response to each request. A typical server is able to respond to more than one hundred clients at the same time, while the client can access a plurality of servers intermittently and over a very short period of time. The very dynamic nature of such applications makes it difficult to isolate, reproduce and/or diagnose problems associated with the application. Furthermore, it is difficult to attribute such problems either to the server or to the client.

Another problem linked to network applications, in particular to those handling electronic commerce (e-commerce), is that the exact behavior of the purchaser when concluding a transaction is difficult to ascertain and is even more difficult to evaluate or to understand. By way of example, it may be that the developer of a website wishes to understand how a particular purchaser using an e-commerce application navigates through the website in order to buy an article. In view of the nature of conventional network applications, such understanding is difficult to obtain.

There are also further problems with network applications, a few of which are discussed in more detail below. Some of these can be attributed to the fact that there is an enormous amount of information available in a network, e.g. in commerce, and that different data formats and application languages are used. There is a need for a system and a method for auditing network applications which solves the problems discussed here.

The present invention is therefore aimed at a system and a method for auditing network applications.

One aspect of the invention relates to a method for visually recreating a user session in a computer environment including a client and a server, the method comprising the steps of: receiving a request from the client at the server; determining automatically first environmental data associated with the computer environment; capturing at the server the request and the first environmental data associated with the computer environment; determining, by the server, a response to the request; sending the response from the server to the client; determining automatically second environmental data associated with the computer environment; capturing at the server the response to the request and the second environmental data associated with the computer environment; and visually recreating at the server the user session based on the captured request and the captured response.

Another aspect of the invention relates to a system for visually recreating a user session in a computer environment including a client and a server comprising: a communication link between the client and the server; a memory; an auditor capture filter capable of determining automatically first environmental data associated with the computer environment at the time of a request between the client and the server, capturing the request and the first environmental data associated with the computer environment and storing the request and the first environmental data in the memory, determining automatically second environmental data associated with the computer environment at the time of a response to the request, and capturing the response to the request and storing the request and the second environmental data in the computer environment; and a display for visually recreating the user session based on the captured request and the captured response.

In one particularly advantageous embodiment, the present invention captures requests and/or responses transmitted to and fro between a client and a server during a particular user session on a network application. The embodiment, stores the request and the responses in an audit memory. The embodiment then retrieves the requests and the responses from the audit memory in order to recreate the user session visually.

A user session in this context is not always the total activity between logging on and logging off, but may also be a screen display which changes on the basis of the activity of the client or user and on the basis of the current request. Such a request may also be an event, for example the movement of a cursor by the user. If the cursor is moved over particular screen fields, e.g.
a banner, then an event is triggered. =
Preferably, only visual information is stored. The later analysis of the session is performed on the basis of this information. The storage of visual information relates, for example to which screen areas the user has moved over with the mouse cursor. The user's mouse cursor movement is analyzed if, for example, particular screen contents are touched by the mouse cursor.
It is not necessary for the user to click on the mouse. In this case, the object of the invention is to establish which screen contents the user is interested in, without the user activating particular links or actions displayed on the screen.
Preferably, the only data which is stored is that which can be used to reconstruct the user's mouse movement and which can be used to reproduce the screen fields moved over by the mouse cursor visually in the later analysis or as a result of the later analysis.

Capture in the context of the embodiments of the invention is a process comprising of two stages. The first step comprises copying or storing the data. The second step comprises filtering the data. Storage is thus a method step of capture. The data is captured before it is evaluated.

One of the advantages of the embodiments of the present invention is that an analyst is able to locate a particular user session in the audit memory and to go through a particular user session step by step, observing the user session in the same way as the client or the user of the client observed the user session. This enables the analyst to track and understand the sequence of events which have occurred during a particular user session in exactly the same way as they occurred.

Another special feature of embodiments of the present invention is that the analyst is able to ascertain the exact sequence of events which took place before an error occurred in the network application. Such embodiments also store information which describes the state of the client/server environment during the user session, which means that the analyst may be able to attribute particular errors to the utilization level or to the data traffic on the server or the data transmission connection.

A further advantage of the embodiments of the present invention is that the analyst is able to observe data associated with sessions of a plurality of users, in order to analyze how different users have negotiated their way through a particular website. Such an analysis is useful to establish how particular websites can be improved to obtain a particular result.

A further special feature of embodiments of invention is that an OLAP
analysis can be carried out, e.g. in order to provide customers who make routine purchases with better response times by passing them on to a faster application server. In addition, such customers making routine purchases could be offered a direct path to a particular location in the website, thereby bypassing the path provided for other customers. Furthermore, the analyst is able to examine the benefit of advertising on the website by observing the number of purchases made before and after such advertising.

-4a-Further features and advantages of embodiments of the present invention are explained in the description below, some of them being apparent from the description or becoming apparent when the invention is put into practice.

The general description given above and the detailed description below are illustrative and explanatory and are intended to be used to explain the claimed invention further.

The appended drawings, which are intended to give a more extensive understanding of the invention and are incorporated in this application and form a part thereof, illustrate embodiments of the invention which, together with the description, serve to explain the principles of the invention.
Figure 1 illustrates an embodiment of the present invention which captures session data in a client/server environment.
Figure 2 illustrates an embodiment of the present invention which analyzes captured session data in an audit environment.
Figure 3 is a flowchart which illustrates the way in which an embodiment of the present invention works when capturing session data.
Figure 4 is a flowchart which illustrates the way in which an embodiment of the present invention works when visually recreating a user session.
Figure 5 is a flowchart which illustrates the way in which a preferred embodiment of the present invention works when performing the step of recreating and visually displaying the dynamically created screen content.
Figure 6 illustrates an analyzing device in accordance with a preferred embodiment of the present invention in more detail.
Figure 7 illustrates an analysis module in accordance with a preferred embodiment of the present invention in more detail.
Figure 8 is a flowchart which illustrates the step of storing data in the audit memory in accordance with an embodiment of the present invention.
Figure 9 illustrates, in accordance with an embodiment of the present invention, a star structure for storing OLAP data for an Internet-based environment.

Figure 10 illustrates, in accordance with an embodiment of the present invention, a star structure for storing OLAP data for an SAP R/3 environment.
Figure 11 illustrates the data structure of a presentation table for an Internet-based environment in accordance with an embodiment of the present invention.
Figure 12 illustrates the data structure of a presentation table for an SAP R/3 environment in accordance with an embodiment of the present invention.
Figure 13 illustrates the data structure of a dimension buffer memory in accordance with an embodiment of the present invention.

Detailed reference is now made to the preferred embodiments of the present invention, which are illustrated in examples in the appended drawings.
In a client/server environment 100, as shown in Figure 1, a client 110 communicates with a server environment 140 via a data transmission connection 125.
The server environment 140 can, of course, comprise a single network server or a plurality of servers running in conjunction with one another.

A particular set of related messages between the client 110 and the server environment 140 is called a user session 130. The user session 130 comprises a series of requests 134 from the client 110 to the server environment 140 and a series of responses 132 from the server environment 140 to the client 110 as reactions to the requests 134. A particular request 134 and the associated response 132 are in this case referred to as one hit 135 or as a request/response pair. During a user session 130, the client 110 can access the server environment 140 in various ways, as is known.

The client 110 accesses the server environment 140 using a dynamically created screen content 120 which indicates information originating from the server environment 140 to the client 110 or to a user (not shown) of a client 110 for a particular network application. Below, the term client 110 is used to represent a client or a user of a client. On the basis of requests 134 and responses 132, the server environment 140 supplies information for updating the dynamically created screen content 120.

In accordance with one embodiment of the present invention, the dynamically created screen content 120 is dynamically created by a client 110 workstation (not shown) on the basis of information contained in the response 132 from the server environment 140. In one embodiment of the present invention, the dynamically created screen content 120 is created by the workstation on the basis of a response 132 which uses a markup language, such as HTML
(Hypertext Markup Language), XML (Xtended Markup Language), SGML (Standard Generalized Markup Language) and so on, as used in various client/server environments 100.

In an alternative embodiment of the present invention, the dynamically created screen content 120 is created by a client 110 workstation on the basis of a response 132 containing information which is compatible with formats used in a dedicated online environment or network, e.g. an Internet or Intranet environment or an environment of a system for personnel placement management, a financial system, a logistical system, a business system, a personnel system, an organization system, a logging system, a time management system or a personnel development system, in particular an SAP R/3 environment.

The discussion below is based on a client/server environment 100 working in an Internet-based or Web-based environment. However, the present invention naturally also relates to a system in which the client 110 is hardwired directly to the server environment 140, as is the case in the SAP R/3 environment, for example. It is evident to a person skilled in the art how the discussion below applies to such hardwired or "dedicated" systems.

In accordance with one advantageous embodiment of the present invention, an audit data capture filter 150 monitors the data transmission connection 125 in order to capture messages (i.e. requests 134 and responses 132) between the client 110 and the server environment 140. In particular, the audit data capture filter 150 captures the request 134 from the client 110 to the server environment 140 and the response 132 from the server environment 140 to the client 110. The audit data capture filter 150 takes the data and stores it.
The filter is in any form. Preferably, the only data stored is that which is required in order to be able to reproduce the user session visually.

In one embodiment of the present invention, the audit data capture filter 150 captures the request 134 from the data transmission connection 125 after the server environment 140 has received the request 134, but before the server environment 140 has processed the request 134. In this embodiment of the present invention, the audit data capture filter 150 captures the response 132 after the server environment 140 has processed the request 134 and has ascertained the response 132, but before the server environment 140 transmits the response 132. Of course, the capture function of a preferred audit data capture filter 150 should not disrupt or interrupt communication between the client 110 and the server environment 140.

In the embodiment of the present invention just described, the server environment 140 has the modifications which are necessary in order to permit the audit data capture filter 150 to access the requests 134 and the responses 132. In other words: the server environment 140 provides, in a known manner, the hooks for the session data for the audit data capture filter 150. In this embodiment, the audit data capture filter 150 captures the requests 134 and the responses 132 in collaboration with the server environment 140, and possibly with the aid of its active participation.
In one alternative embodiment of the present invention, the audit data capture filter 150 does not require the modifications to the server environment 140 which are discussed above. In this alternative embodiment of the present invention, the audit data capture filter 150 captures the requests 134 and the responses 132 directly from the data transmission connection 125, and the server environment 140 operates without regard to the presence of the audit data capture filter 150.

The audit data capture filter 150 stores the captured request 134 and the captured response 132 in an audit memory 160. In one preferred embodiment of the present invention, a captured request 134 and a captured response 132 are stored as one hit 135. The audit memory 160 naturally has a memory apparatus, for example a disk drive, an RAM, a database device or another such memory device. The storage of data in a database format is advantageous in the context of the invention.

In some preferred embodiments of the present invention, the audit memory 160 stores all the hits 135 in a particular user session 130 as stored hits 175 for a stored user session 170. In other words: in these embodiments of the present invention, the sequences of captured requests 134 and captured responses 132 contained in a particular user session 130 are stored altogether as a stored user session 170.

In one embodiment of the present invention, the user session 130 is conducted via an Internet. In this case, the client 110 and the server environment 140 are not actively connected (i.e. the connection between the client 110 and the server environment 140 is effectively broken) after each transmission (i.e. after each request 134 from the client 110 to the server environment 140 and after each response 132 from the server environment 140 to the client 110) . In such an application, a unique identification of the session (also called status identification in this case) is usually used to identify a particular client 110 each time it accesses the server environment 140. The identification of the session is transmitted with each request 134 in order to determine the user context unambiguously. Owing to the fact that the server environment 140 uses the identification of the session to assign each request 134 to a particular client 110, the server environment 140 is able to handle the client 110 over the Internet as if the client 110 were constantly connected to the server environment 140.

In a second embodiment of the present invention, the client 110 and the server environment 140 are constantly connected via a dedicated data transmission connection 125. In this embodiment of the present invention, identification of the session is not necessary for each request 134; instead, the session is identified implicitly with each transmission between the client 110 and the server environment 140, since the connection is effected by the dedicated data transmission connection 125.

As discussed above, a series of requests 134 and responses 132 in a user session 130 between the client 110 and the server environment 140 is stored in the audit memory 160 as stored hits 175 in the stored user session 170. As discussed with regard to Figure 2, an analyzing device 220 enables an analyst 210 to analyze the user session 170.

The analyst 210 can, by way of example, evaluate the user session 170 to establish how the client 110 moves through a particular network application to arrive at a particular result. Such evaluation is useful, for example, in the case of commercial or e-commerce Internet applications. In the context of such applications, application developers are interested in understanding how a client 110 moves through a particular application to arrive at a particular result, such as making a purchase. It is evident that the present invention permits the analyst 210 to evaluate the particular application for various clients 110 at different times etc.

In another example, the analyst 210 can evaluate the user session 170 to isolate errors which have arisen during the user session 130. In this example, when attempting to identify and to isolate a problem which has arisen for a particular network application, the analyst 210 is able to recreate and reconstruct the entire user session 130.

As Figure 2 shows, the analyst 210 uses the analyzing device 220 to access the audit memory 160. In particular, the analyst 210 is able to access a particular user session 170 and to recreate it visually. In other words: the analyst 210 is able to run through the particular user session 170 step by step and to evaluate each request 134 and each response 132 individually, as they occurred during the user session 170.

In one preferred embodiment of the present invention, the analyzing device 220 reproduces the user session 170 by creating the various screen contents 120 which were presented to the client 110 during the user session 130 by the server environment 140. In this way, the analyst 210 is able to look at the same screen contents 120 as the client 110 observed during the user session 130. The analyst 210 is also able to evaluate each request made by the client 110 and each subsequent response 132 from the server environment 140.

It is clear that the analyst 210 can evaluate the user session 130 offline, i.e. after the user session 170 has ended, or in almost real time, i.e.
while the user session 170 is taking place. In this latter embodiment, the analyzing device 220 can retrieve hits 175 either from the audit memory 160 or, by bypassing the audit memory 160, directly from the audit data capture filter 150.

Since the components of the present invention have been described here, the way in which the present invention works is now discussed. Figure 3 is a flowchart which, in accordance with one embodiment of the present invention, illustrates an operating cycle 300 of the audit data capture filter 150 when capturing requests 134 and responses 132 during a user session 130. In a step 310, the server environment 140 receives a request 134 from the client 110. In a step 320, the audit data capture filter 150 captures the request 134.

In one embodiment of the present invention, the audit data capture filter 150 captures the request 134 in the server environment 140. In particular, in this embodiment, the audit data capture filter 150 captures the request 134 from the server environment 140 after the server environment 140 receives the request 134, but before the server environment 140 processes the request 134.

In one alternative embodiment of the present invention, the server environment 140 can forward the request 134 to the audit data capture filter 150. In addition, further mechanisms exist which permit the audit data capture filter 150 to obtain access to the request 134. In every case, the capture of the request 134 does not disrupt or interrupt communication between the client 110 and the server environment 140.

In one alternative embodiment of the present invention, the audit data capture filter 150 captures the request 134 directly from the data transmission connection 125 without the collaboration or participation of the server environment 140.

In one preferred embodiment of the present invention, the capture of the request 134 includes capturing or determining particular environment data (not shown) which was associated with the client 110 and with the server environment 140 at the time or around the time at which the request 134 was transmitted or captured.

This environment data contains parameters such as utilization level, extent of data traffic, status or other such information which is available on the data transmission connection 125 and is well known in the client/server environment 100. Such environment data or data about environment factors may, for example, be the type of (web) browser, the IP address of the client 110, the instant of the request 134 or the designation of the portal used (e.g. Yahoo, Excite). Figure 9 shows a specific illustrative embodiment with DBA.DIM-Env, and Figure 10 shows a further illustrative embodiment.
As discussed below, the environment data permits the analyzing device 220 to evaluate the influence of the client/server environment 100 on a particular user session 170.

In a step 330, the server environment 140 determines a response 132 to the request 134 from the client 110. In a step 340, the server environment 140 transmits the response 132 to the client 110. In a step 350, in accordance with one embodiment of the present invention, the audit data capture filter 150 captures the response 132 from the server environment 140 to the client 110.
In one alternative embodiment, the server environment 140 can forward the response 132 to the audit data capture filter 150. In a further alternative embodiment of the present invention, the audit data capture filter 150 captures the response 132 directly from the data transmission connection 125. As discussed above with regard to capture of the request 134, in one preferred embodiment of the present invention, capturing the response 132 also comprises capturing environment data linked to the response 132.

Finally, the audit data capture filter 150 stores the captured request 134 and the captured response 132 as a hit 175 in the audit memory 160 in a step 360. In particular, each hit 175 (or each request/response pair) is stored in the audit memory 160 together with other hits associated with a particular user session 170.

In one alternative embodiment of the present invention, the audit data capture filter 150 stores the captured request 134 in the audit memory 160 as soon as it has been captured, instead of waiting for an associated captured response 132. The captured request 134 and the captured response 132 are thus each stored as soon as they are captured.

In accordance with one embodiment of the present invention, the audit data capture filter 150 captures or receives requests 134 and/or responses 132 from the server environment 140. In a real implementation, the audit data capture filter 150 can be resident in the server environment 140 and can work in conjunction with it. In this implementation and in accordance with the present invention, the client 110, in connection with the audit data capture filter 150, requires neither software, hardware or a combination of software and hardware nor any modification to its software or hardware.

In one alternative embodiment of the present invention, the audit data capture filter 150 captures the requests 134 and the responses 132 directly from the data transmission connection. In this embodiment of the present invention, in connection with the audit data capture filter 150, software, hardware or a combination of software and hardware are required neither in the client 110 nor in the server environment 140.

Figure 4 is a flowchart which, in accordance with one embodiment of the present invention, illustrates the manner of operation 400 of the analyzing device 220, which, in accordance with one embodiment of the present invention, makes it possible to analyze a user session 170. In a step 410, the analyzing device 220 locates a particular user session 170 in the audit memory 160. In an alternative embodiment operating without an audit memory 160, the analyzing device 220 specifies to the audit data capture filter 150 a particular user session 170 which is to be analyzed.

The user session 170 can be located using a multiplicity of mechanisms. Such mechanisms can permit the analyzing device to access the audit memory 160 on the basis of the date associated with a particular user session 170 being sought, and/or on the basis of the session number associated with a particular user session 170 being sought. However, the date and the session number may not be known in every case. It is evident to the person skilled in the art that the analyzing device 220 can therefore provide other mechanisms for locating the user session 170, e.g.
searching the audit memory 160 for keywords, for identifiers etc., or any other manner of searching the audit memory 160.

Once a user session 170 has been located, the analyzing device 220 retrieves the request 134 from the audit memory 160 in a step 420. The required data is thus retrieved or found out from the audit memory 160 in order to recover or recreate the request 134.
Equally, the analyzing device 220 retrieves the response 132, corresponding to the request 134, from the audit memory 160 in a step 430. As discussed above, in one alternative embodiment of the present invention, the analyzing device 220 can retrieve the request 134 and the response 132 directly from the audit data capture filter 150.
In one preferred embodiment of the present invention, when retrieving the request 134 and the response 132, the analyzing device 220 also retrieves associated environment data which may have been stored with each request 134 and response 132, as discussed above.

In a step 440, the analyzing device 220 uses the retrieved request and the retrieved response, and also the retrieved environment data associated with each of them in the preferred embodiment, to recreate and present the dynamically created screen content 120.
In this way, the analyzing device 220 is able to present to the analyst 210 a dynamically created screen content 120 which is the same as that observed by the client 110 during the user session 130.

Using the dialog data, the analyzing device 220 creates the screen content 120. The original client/server application need not be running for this, i.e. the analysis can take place without the application running. The full session need not be stored.

Figure 5 illustrates the manner of operation of a preferred embodiment of step 440 in more detail. In a step 510, the analyzing device 220 examines the environment data and other factors associated with the retrieved request 134 and with the retrieved response 132. In a step 520, the analyzing device 220 creates a screen content on the basis of the retrieved request 134 and of the retrieved response 132 and thus restores the dynamically created screen content 120. In a step 530, the analyzing device 220 displays the analyzed environment data and the created screen content to the analyst 210. This permits the analyst 210 to examine the restored screen content in connection with the environment factors which may have influenced the particular user session 170.

In one preferred embodiment of the present invention, the recreated screen content is updated in a step 540 in order to reproduce the data entered by the user of the client 110. This data is obtained from a subsequent request 134 from the client 110 to the server environment 140 in the particular user session 170.

The analyzing device 220 is now discussed in more detail with reference to Figure 6. The analyzing device 220 comprises an analysis module 620, an analysis database 630 and an import module 640. The import module 640 retrieves significant information from the unprocessed data stored for the user session 170 in the audit memory 160 so that the analyst 210 can use said information. In one preferred embodiment of the present invention, the import module 640 retrieves information comprising hits 175 in the user session 170 from the audit memory 160 and stores it in the analysis database 630 in a particular format unique to the analysis database 630.

By way of example, in one application, the import module 640 retrieves information comprising hits 175 which have been captured in an Internet environment, whereas, in another application, it retrieves information comprising hits 175 which have been captured in an SAP R/3 environment. This allows the import module 640 to retrieve session data associated with a multiplicity of clients 110 and server environments 140 and to combine it in a central, standardized database, such as the analysis database 630. This means that analysis tools (e.g. the analysis module 620) used subsequently can analyze the session data regardless of the format of the captured hits 175.
Owing to the fact that they use the common format of the analysis database 630, analysis tools used subsequently can additionally carry out useful comparisons of the session data available from various clients 110, server environments 140, applications etc.
In one preferred embodiment of the present invention, the data stored in the analysis database 630 contains relevant data, comprising the request 134 and the response 132, and the associated environment data.
This data contains information which is linked to the client 110 and to the server environment 140 and is derived from these, and also the communication protocols used and further relevant information familiar to a person involved with different network protocols.

In one preferred embodiment of the present invention, the analysis database 630 has two sets of tables for each application in the client/server environment 100. The first tables are called OLAP
(Online Analysis Program or Online Analytical Processing) analysis tables. OLAP methods are known from the literature, for example from P. Gray and H.J.
Watson, Decision Support In The Data Warehouse, Prentice Hall 1998, New Jersey, where the so-called twelve Codd's rules for OLAP are explained in appendix 1.

The OLAP analysis tables are designed and optimized for provisional OLAP analysis. In one preferred embodiment of the present invention, the OLAP
analysis tables have a star structure and are fully indexed. Figure 9 illustrates a preferred embodiment of a star structure for hits which were captured in an Internet environment or in a web-based environment, while Figure 10 illustrates a preferred embodiment of a star structure for hits which were captured in an SAP
R/3 environment.

The second tables in the database 630 are called session presentation/analysis tables. The session presentation/analysis tables are designed and optimized for visually recreating the user session 130 and carrying out session-specific analysis. The session presentation/analysis tables contain all the information for the hits and also information about the recreation of available sessions and information retrieved from the identification of the session.
Figure 11 illustrates a preferred embodiment of a presentation table for hits which were captured in the Internet environment or in the web-based environment, while Figure 12 illustrates a preferred embodiment of a presentation table for hits which were captured in an SAP R/3 environment.

Figure 13 illustrates a data structure of a dimension buffer in accordance with an embodiment of the present invention. It is evident that the dimension buffer data structure is useful for accelerating the OLAP analysis.

In one embodiment of the present invention, the import module 640 also stores information from the audit memory 160 in an archive (not shown). The archive is preferably a more permanent memory device. The information stored in the archive can be unprocessed data, as stored in the audit memory 160, or it can be data from the audit memory 160 which has been freed of unessential information not linked to the function or the manner of operation of the analyzing device 220. In every case, the information stored in the archive is indexed on the basis of the session identification number associated with each user session 130. Since the identification of each session is unique and is not repeated, the archive can store user sessions 170 from a multiplicity of sources and from a multiplicity of applications without there being any risk of a conflict entailing the loss of data.

The analysis module 620 is now described in more detail with reference to Figure 7. The analysis module 620 comprises a global analysis module 710 and a presentation module 720. The presentation module 720 comprises a module for specific analysis 730, an intelligent parser 740 and a presentation component 750.

The global analysis module 710 permits the analyst 210 to carry out dynamic analysis of user sessions 170 which are stored in the analysis database 630 and originate from various clients 110, server environments 140 and various applications running in the client/server environment 100. By way of example, the global analysis module 110 permits the analyst 210 to analyze user sessions 170 for all the clients 110 which have accessed a particular site in the server environment 140.

In another example, the global analysis module 710 permits the analyst 210 to analyze user sessions 170 for a particular client 110 which has accessed a multiplicity of sites in various server environments 140. In a further example, the global analysis module 710 permits the analyst 210 to analyze all user sessions 170 for all clients 110 in all server environments 140 which have resulted in goods being purchased on a particular day. These are merely examples of how the global analysis module 710 could access the analysis database 630, the only restriction being the scope of information available in the analysis database 630 itself.

The presentation module 720 is responsible for recreating a particular user session 130 visually, for carrying out session level analysis and for presenting the user session to the analyst 210. As mentioned above, the presentation module 720 comprises a component for specific analysis 730, an intelligent parser module 740 and a presentation component 750. The component for specific analysis 730 is responsible for the constant provision of statistical information associated with a particular dynamically created screen content 120, and of the environment data which was associated with this screen content at the instant of its being created and/or displayed for the client 110.
In one preferred embodiment of the present invention, the component 730 for specific analysis also calculates overloads in the client/server environment 100 on the server 140 or on the data transmission line 125 for the instant at which the screen content 120 was made available to the client 110 by the server environment 140.
The presentation component 750 is responsible for physically presenting the user session 170. In particular, the presentation component 750 provides the analyst 210 with means for going through the user session 170 and displaying the statistical data provided by the component for specific analysis 730.

In one preferred embodiment of the present invention, a dedicated presentation component 750 exists for each client/server application. For HTML and XML, the presentation component 750 comprises a web browser. For SAP R/3, the presentation component 750 is a constituent part of a modified version of a user interface used by SAP R/3. It is clear that, for other applications, the presentation component 750 comprises a suitable presentation program. In other words: the specific presentation component 750 is used on the basis of a particular client/server application.

The intelligent parser component 740 scans the analysis database 630 to establish whether it contains HTML. If this is the case, the intelligent parser component 740 establishes whether the HTML contains fields which permit the intelligent parser component 740 to change the value of the fields securely when there is a subsequent user request 134. In this way, the analyst 210 is able to observe data which has been entered by the client 110 on the basis of the dynamically created screen content 120, as it occurred during the user session 130. In one preferred embodiment of the present invention, the intelligent parser component 740 does not implement this function for password fields, for security reasons.

As just described, the present invention stores all requests 134 and responses 132 taking place between the client 110 and the server environment 140. However, this approach is not necessary in all client/server environments 100, and is perhaps also not desirable. In alternative embodiments of the present invention, the audit data capture filter 150 is able to store requests 134 and responses 132 in the audit memory 160 only when a significant event occurs. In this context, a significant event preferably comprises at least one request 134 and one response 132.

By way of example, in one embodiment of the present invention, requests 134 and responses 132 are stored in the audit memory 160 only when a purchase has been made. In this example, the purchase is a significant event. In another embodiment of the present invention, significant events can be subdivided further. For example, a set of session data is stored for those clients 110 purchasing goods with a value of 10 million dollars or more, while another set of session data is stored for those clients 110 purchasing goods with a value of less than 10 million dollars.
This embodiment of the present invention eliminates from the audit memory 160 a large part of the data which is linked to "surfing" or "browsing" or to other insignificant events and could otherwise be stored. In other embodiments of the present invention, such data associated with "surfing" or "browsing" can be useful, however, for establishing particular behavior patterns (e.g. while shopping), and it may be desirable to store this data in the audit memory 160.
The specific significant events triggering the storage of session data in the audit memory 160 may vary from application to application.

In embodiments of the present invention which use such significant events as a criterion for storing session data, the requests 134 and the responses 132 are preferably temporarily stored in a temporary memory until the significant event occurs. As soon as the significant event occurs, the requests 134 and the responses 132 are transferred from the temporary memory to the audit memory 160. This process of transferring the requests 134 and the responses 132 from the temporary memory to the audit memory 160 is called "entering" the requests 134 and the responses 132 into the audit memory 160.

In addition, other mechanisms for entering the session data (i.e. the requests 134 and the responses 132) into the audit memory 160 may be available. By way of example, session data could be stored in the audit memory 160 before the significant event and marked as temporary or not entered, or labeled in another way. As soon as the significant event occurs, this data is labeled as entered. If the significant event does not occur, this data is subsequently erased or made illegible.

Against this background, the storage procedure 360 is now described with reference to Figure 8 in accordance with this embodiment of the present invention. In a step 810, the audit data capture filter 150 stores a request/response pair in a temporary database or in a temporary memory. In a decision step 820, the audit data capture filter 150 establishes whether a significant event has occurred. If the significant event has occurred, the audit data capture filter 150 enters the request/response pairs stored in the temporary database or in the temporary memory into the audit memory 160 in a step 830. If there has been no entry into the temporary database or the temporary memory at a particular point in the cycle, the audit data capture filter 150 erases the temporary database or the temporary memory.
In summary, aspects of the invention can be described more simply in other words as follows: a system or a method for auditing network applications captures transmissions between a client 110 and a server 140 during a user session 130. An audit data capture filter 150 captures and stores each request 134 from the client 110 and each response 132 from the server 140 to each request 132 in an audit memory 160 in a form which permits an analyst 210, i.e. a person wishing to analyze the user session 130, to recreate the user session 130 in the manner in which it was originally presented to the client 110. Preferably, the system also provides the analyst 210 with environment data.
An auditing analyst 210 can use the captured requests 134 and the captured responses 132 to recreate the user session 130 visually for the purpose of analyzing what has happened during the user session 130. In this way, it is possible, by way of example, to carry out technical analyses, e.g. regarding the cause of a malfunction, or commercial analyses, e.g. analysis of the purchaser behavior or of a client 110 visiting a website. For storage, capture or analysis, necessary measures to retain anonymity can naturally be taken for reasons of data protection.

Since the invention has been described in detail and with reference to specific embodiments, it is obvious to a person skilled in the art that various changes and modifications can be made without departing from the sense and from the scope of protection of the invention. The present invention therefore also relates to modifications and variations of the invention, provided that these modifications and variations lie within the scope of protection of the appended claims and their equivalents.

Claims

Claims:

1. A method for visually recreating a user session in a computer environment including a client and a server, the method comprising the steps of:

receiving a request from the client at the server;

determining automatically first environmental data associated with the computer environment;

capturing at the server the request and the first environmental data associated with the computer environment;

determining, by the server, a response to the request;
sending the response from the server to the client;

determining automatically second environmental data associated with the computer environment;

capturing at the server the response to the request and the second environmental data associated with the computer environment; and visually recreating at the server the user session based on the captured request and the captured response.

2. The method of claim 1, wherein the first environmental data is captured when the request is captured.

3. The method of claim 2, wherein the first environmental data includes at least one of information on load, traffic volume and status.

4. The method of claim 2, wherein the second environmental data is captured when the response is captured.

5. The method of claim 4, wherein the second environmental data includes at least one of information on load, traffic volume and status.

6. The method of any one of claims 1 to 5, wherein capturing the request comprises receiving session identification information associated with the client.

7. The method of any one of claims 1 to 6, wherein visually recreating the user session comprises:

locating the user session;
retrieving the request;
retrieving the response; and displaying the retrieved request and response on a dynamically generated screen.

8. The method of claim 4 or 5, further comprising:
retrieving the request;

retrieving the response; and displaying the retrieved request and response on a dynamically generated screen based on the first and second environmental data.

9. The method of claim 8, further comprising:

analyzing the first and second environmental data; and displaying the analyzed environmental data.

10. A system for visually recreating a user session in a computer environment including a client and a server comprising:

a communication link between the client and the server;
a memory;

an auditor capture filter capable of determining automatically first environmental data associated with the computer environment at the time of a request between the client and the server, capturing the request and the first environmental data associated with the computer environment and storing the request and the first environmental data in the memory, determining automatically second environmental data associated with the computer environment at the time of a response to the request, and capturing the response to the request and storing the request and the second environmental data in the computer environment; and a display for visually recreating the user session based on the captured request and the captured response.

11. The system of claim 10, wherein the auditor capture filter is further able to capture the first environmental data when the request is captured.

12. The system of claim 11, wherein the auditor capture filter is further able to capture the second environmental data when the response is captured.

13. The system of any one of claims 10 to 12, wherein the auditor capture filter is further able to receive session identification information associated with the client.

14. The system of any one of claims 10 to 13, further comprising:

a processor for analyzing the first and second environmental data; and wherein the display is further able to display the analyzed environmental data.