Systems and methods for recording and visually recreating sessions in a client-server environment

Abstract

A system and method for auditing network applications captures transmissions during a user session between a client and a server. An auditor capture filter captures and stores each request from the client and each response by the server to each request in an auditor storage. An auditor analyzer may use the captured requests and the captured responses to visually recreate the user session to thereby analyze what transpired during the user session.

1. A method executing on a hardware computer system for visually recreating a user session in a computer environment including a client and a server, the method comprising the steps of:
 receiving a request from the client at the server;  
 capturing at the server the request and first environmental data associated with the computer environment;  
 determining, by the server, a response to the request;  
 sending the response from the server to the client;  
 capturing at the server the response to the request and second environmental data associated with the computer environment; and  
 visually recreating at the server the user session based on the captured request and the captured response.  
 
     
     
       2. The method of  claim 1 , wherein the first environmental data is captured at or about when the request is captured. 
     
     
       3. The method of  claim 2 , wherein the second environmental data is captured at or about when the response is captured. 
     
     
       4. The method of  claim 3 , further comprising:
 retrieving the request;  
 retrieving the response;  
 displaying the retrieved request and response on a dynamically generated screen based on the first and second environmental data.  
 
     
     
       5. The method of  claim 4 , further comprising:
 analyzing the first and second environmental data; and  
 displaying the analyzed environmental data.  
 
     
     
       6. The method of  claim 3 , wherein the second environmental data includes information on load, traffic volume, status, and other system data. 
     
     
       7. The method of  claim 2 , wherein the first environmental data includes information on load, traffic volume, status, and other system data. 
     
     
       8. The method of  claim 1 , wherein capturing the request comprises receiving session identification information associated with the client. 
     
     
       9. The method of  claim 1 , wherein visually recreating the user session comprises:
 locating the user session;  
 retrieving the request;  
 retrieving the response; and  
 displaying the retrieved request and response on a dynamically generated screen.  
 
     
     
       10. A hardware system for visually recreating a user session, which includes a request and a response to the request, in a computer environment including a client and a server comprising:
 a communication link between the client and the server,  
 a memory,  
 an auditor capture filter capable of 
 capturing the request and a first environmental data associated with the computer environment and storing the request and the first environmental data in the memory;  
 capturing the response to the request environment  and storing the request and the  a second environmental data in the memory environment ; and  
 
 a display for visually recreating the user session based on the captured request and the captured response.  
 
     
     
       11. The system of  claim 10 , wherein the auditor capture filter is further able to capture the first environmental data at or about when the request is captured. 
     
     
       12. The system of  claim 11 , wherein the auditor capture filter is further able to capture the second environmental data at or about when the response is captured. 
     
     
       13. The system of  claim 10 , wherein the auditor capture filter is further able to receive session identification information associated with the client. 
     
     
       14. The system of  claim 10 , further comprising:
 a processor for analyzing the first and second environmental data; and  
 wherein the display is further able to display the analyzed environmental data.  
 
     
     
       15. The system of  claim 10 , wherein the auditor capture filter is capable of storing the response to the request. 
     
     
       16. The system of  claim 15 , wherein the first environmental data includes a loading parameter. 
     
     
       17. The system of  claim 15 , wherein the second environmental data includes a loading parameter. 
     
     
       18. The system of  claim 15 , wherein the first environmental data includes a traffic volume parameter. 
     
     
       19. The system of  claim 15 , wherein the second environmental data includes a traffic volume parameter. 
     
     
       20. The system of  claim 15 , wherein the first environmental data includes a status parameter. 
     
     
       21. The system of  claim 15 , wherein the second environmental data includes a status parameter. 
     
     
       22. The system of  claim 15 , wherein the first environmental data includes data available on the communication link. 
     
     
       23. The system of  claim 15 , wherein the second environmental data includes data available on the communication link. 
     
     
       24. The system of  claim 15 , wherein the first environmental data includes data known by the client. 
     
     
       25. The system of  claim 15 , wherein the second environmental data includes data known by the client. 
     
     
       26. The system of  claim 15 , wherein the first environmental data includes data known by the server. 
     
     
       27. The system of  claim 15 , wherein the second environmental data includes data known by the server. 
     
     
       28. The system of  claim 15 , wherein the first environmental data includes data that identifies a date. 
     
     
       29. The system of  claim 15 , wherein the second environmental data includes data that identifies a date. 
     
     
       30. The system of  claim 15 , wherein the first environmental data includes data that is derived from the client. 
     
     
       31. The system of  claim 15 , wherein the second environmental data includes data that is derived from the client. 
     
     
       32. The system of  claim 15 , wherein the first environmental data includes data that is derived from the server. 
     
     
       33. The system of  claim 15 , wherein the second environmental data includes data that is derived from the server. 
     
     
       34. The system of  claim 15 , wherein the first environmental data includes data that identifies a communication protocol. 
     
     
       35. The system of  claim 15 , wherein the second environmental data includes data that identifies a communication protocol. 
     
     
       36. The system of  claim 15 , wherein the first environmental data includes data that indicates if an error occurred. 
     
     
       37. The system of  claim 15 , wherein the second environmental data includes data that indicates if an error occurred. 
     
     
       38. The system of  claim 15 , wherein the first environmental data includes data that indicates if a problem occurred. 
     
     
       39. The system of  claim 15 , wherein the second environmental data includes data that indicates if a problem occurred. 
     
     
       40. The system of  claim 15 , wherein the first environmental data includes data that indicates if a purchase occurred. 
     
     
       41. The system of  claim 15 , wherein the second environmental data includes data that indicates if a purchase occurred. 
     
     
       42. The system of  claim 15 , wherein the first environmental data includes data that indicates if a purchase over a predetermined value occurred. 
     
     
       43. The system of  claim 15 , wherein the second environmental data includes data that indicates if a purchase over a predetermined value occurred. 
     
     
       44. The system of  claim 15 , wherein the first environmental data includes data related to congestion in the computer environment. 
     
     
       45. The system of  claim 15 , wherein the second environmental data includes data related to congestion in the computer environment. 
     
     
       46. The system of  claim 15 , wherein the first environmental data includes data related to congestion in the communication link. 
     
     
       47. The system of  claim 15 , wherein the second environmental data includes data related to congestion in the communication link. 
     
     
       48. The system of  claim 15 , wherein the request includes a markup language statement. 
     
     
       49. The system of  claim 15 , wherein the request includes an HTML tag. 
     
     
       50. The system of  claim 15 , wherein the request includes an XML tag. 
     
     
       51. The system of  claim 15 , wherein the request includes an SGML tag. 
     
     
       52. The system of  claim 15 , wherein the request includes information utilized by an SAP R/ 3  computer environment. 
     
     
       53. The system of  claim 15 , wherein the auditor capture filter is capable of monitoring the communication link to capture the request and the response. 
     
     
       54. The system of  claim 15 , wherein the auditor capture filter is capable of capturing the request after the server has received the request but before the server has processed the request. 
     
     
       55. The system of  claim 15 , wherein the auditor capture filter is capable of capturing the response to the request after the server has processed the request and determined the response to the request but before the server outputs the response to the request. 
     
     
       56. The system of  claim 15 , wherein the server provides the auditor capture filter with access to the request. 
     
     
       57. The system of  claim 15 , wherein the server provides the auditor capture filter with hooks to session data. 
     
     
       58. The system of  claim 15 , wherein the auditor capture filter is capable of capturing the request with active participation of the server. 
     
     
       59. The system of  claim 15 , wherein the auditor capture filter is capable of capturing the request directly from the communication link. 
     
     
       60. The system of  claim 15 , wherein the server passes the request to the auditor capture filter. 
     
     
       61. The system of  claim 15 , wherein the auditor capture filter captures the request directly from the communication link without cooperation from or participation by the server. 
     
     
       62. The system of  claim 15 , wherein the auditor capture filter is capable of storing the request on a disk drive. 
     
     
       63. The system of  claim 15 , wherein the auditor capture filter is capable of storing the request in RAM. 
     
     
       64. The system of  claim 15 , wherein the auditor capture filter is capable of storing the request in a database. 
     
     
       65. The system of  claim 15 , wherein the auditor capture filter is capable of storing a series of requests and responses that comprise the user session. 
     
     
       66. The system of  claim 15 , wherein the auditor capture filter is capable of storing a series of requests and responses. 
     
     
       67. The system of  claim 15 , wherein the system is capable of storing a plurality of user sessions and the system is capable of locating a user session from the plurality of stored user sessions. 
     
     
       68. The system of  claim 15 , wherein the system is capable of storing a plurality of user sessions and the system is capable of searching for a user session from the plurality of stored user sessions based upon a search parameter. 
     
     
       69. The system of  claim 15 , wherein the system is capable of storing a plurality of user sessions and the system is capable of searching for a user session from the plurality of stored user sessions based upon a date. 
     
     
       70. The system of  claim 15 , wherein the system is capable of storing a plurality of user sessions and the system is capable of searching a user session from the plurality of stored user sessions based upon a session number. 
     
     
       71. The system of  claim 15 , wherein the system is capable of storing a plurality of user sessions and the system is capable of searching for a user session from the plurality of stored user sessions based upon a keyword. 
     
     
       72. The system of  claim 15 , wherein the system is capable of storing a plurality of user sessions and the system is capable of searching for a user session from the plurality of stored user sessions based upon an identifier. 
     
     
       73. The system of  claim 15 , wherein the system is configured to extract data from the response and store the extracted data in a database. 
     
     
       74. The system of  claim 15 , wherein the system is configured to extract data from a plurality of clients and store the data in a database. 
     
     
       75. The system of  claim 15 , wherein the system is capable of storing the request into a data structure that is indexed according to session identification numbers. 
     
     
       76. The system of  claim 15 , wherein the auditor capture filter is capable of committing the request in an auditor storage only if a specified event occurs. 
     
     
       77. The system of  claim 15 , wherein the auditor capture filter is capable of committing the request in an auditor storage only if a purchase occurs. 
     
     
       78. The system of  claim 15 , wherein the auditor capture filter is capable of committing the request in an auditor storage only if a purchase over a predetermined value occurs. 
     
     
       79. The system of  claim 15 , wherein the auditor capture filter is capable of storing the request in the memory regardless of whether a specified event occurs and the auditor capture filter is capable of storing the request in a second memory only if the specified event occurs. 
     
     
       80. The system of  claim 15 , wherein the communication link is a part of the Internet. 
     
     
       81. The system of  claim 15 , wherein the client is identified to the server with a session identification identifier. 
     
     
       82. The system of  claim 15 , wherein the request includes a session identification identifier. 
     
     
       83. The system of  claim 15 , wherein session identification data is implicit, but not express, in the request. 
     
     
       84. The system of  claim 15 , wherein the system is configured to allow an analyst to determine how the client moves through a network application. 
     
     
       85. The system of  claim 15 , wherein the system is configured to display how the client moves through a network application. 
     
     
       86. The system of  claim 15 , wherein the system is configured to allow an analyst to determine how the client moves through an e- commerce Internet application.   
     
     
       87. The system of  claim 15 , wherein the system is configured to display how the client moves through an e- commerce Internet application.   
     
     
       88. The system of  claim 15 , wherein the system is configured to allow an analyst to determine how the client moves through an e- commerce network application.   
     
     
       89. The system of  claim 15 , wherein the system is configured to display how the client moves through an e- commerce network application.   
     
     
       90. The system of  claim 15 , wherein the system is configured to allow an analyst to determine how the client moves through a network application in order to make a purchase. 
     
     
       91. The system of  claim 15 , wherein the system is configured to display how the client moves through a network application in order to make a purchase. 
     
     
       92. The system of  claim 15 , wherein the system is configured to allow an analyst to isolate an error. 
     
     
       93. The system of  claim 15 , wherein the system is configured to allow an analyst to recreate the user session in an effort to identify a problem with a network application. 
     
     
       94. The system of  claim 15 , wherein the system is configured to allow an analyst to step through a plurality of requests and responses in the time sequence that the requests and responses occurred. 
     
     
       95. The system of  claim 15 , wherein the system is configured to generate a plurality of screens that were displayed during the user session. 
     
     
       96. The system of  claim 15 , wherein the system is configured to allow an analyst to evaluate any request made by the client and to evaluate any response to any request. 
     
     
       97. The system of  claim 15 , wherein the system is configured to allow an analyst to evaluate the request after the user session is complete. 
     
     
       98. The system of  claim 15 , wherein the system is configured to allow an analyst to evaluate the request while the user session is occurring. 
     
     
       99. The system of  claim 15 , wherein the system includes an analyzer that retrieves a plurality of requests from an auditor storage. 
     
     
       100. The system of  claim 15 , wherein the system includes an analyzer that retrieves a plurality of requests from the auditor capture filter. 
     
     
       101. The system of  claim 15 , wherein the system is configured to perform an analysis based at least in part upon either the first environmental data or the second environmental data. 
     
     
       102. The system of  claim 15 , wherein the system is capable of visually recreating a user session based at least in part upon data entered by a user. 
     
     
       103. The system of  claim 15 , wherein the system is configured to compare data obtained from different clients. 
     
     
       104. The system of  claim 15 , wherein the system is configured to compare data obtained from different servers. 
     
     
       105. The system of  claim 15 , wherein the system is configured to compare data obtained from different network applications. 
     
     
       106. The system of  claim 15 , wherein the system is configured to perform a session- specific analysis.   
     
     
       107. The system of  claim 15 , wherein the system is capable of allowing an analyst to dynamically analyze a plurality of user sessions from a plurality of clients. 
     
     
       108. The system of  claim 15 , wherein the system is capable of displaying a plurality of user sessions from a plurality of clients. 
     
     
       109. The system of  claim 15 , wherein the system is capable of allowing an analyst to dynamically analyze a plurality of user sessions from a plurality of servers. 
     
     
       110. The system of  claim 15 , wherein the system is capable of displaying a plurality of user sessions from a plurality of servers. 
     
     
       111. The system of  claim 15 , wherein the system is capable of allowing an analyst to dynamically analyze user sessions from all clients that accessed a particular Web site. 
     
     
       112. The system of  claim 15 , wherein the system is capable of allowing an analyst to dynamically analyze user sessions from all clients that accessed a particular Web site during a specific time period. 
     
     
       113. The system of  claim 15 , wherein the system is capable of displaying user sessions from all clients that accessed a particular Web site during a specific time period. 
     
     
       114. The system of  claim 15 , wherein the system is capable of allowing an analyst to analyze user sessions for a client that accessed multiple Web sites hosted on different servers. 
     
     
       115. The system of  claim 15 , wherein the system is capable of displaying user sessions for a client that accessed multiple Web sites hosted on different servers. 
     
     
       116. The system of  claim 15 , wherein the system is capable of allowing an analyst to analyze all user sessions that resulted in a purchase of goods. 
     
     
       117. The system of  claim 15 , wherein the system is capable of displaying all user sessions that resulted in a purchase of goods. 
     
     
       118. The system of  claim 15 , wherein the system is capable of allowing an analyst to analyze all user sessions that resulted in a purchase of goods during a specific time interval. 
     
     
       119. The system of  claim 15 , wherein the system is capable of displaying all user sessions that resulted in a purchase of goods during a specific time interval. 
     
     
       120. The system of  claim 15 , wherein the system includes a database that contains data that indicates whether a user session resulted in a purchase of goods. 
     
     
       121. The system of  claim 15 , wherein the system is capable of calculating congestion in the computer environment. 
     
     
       122. The system of  claim 15 , wherein the system is capable of calculating congestion in the communication link. 
     
     
       123. The system of  claim 15 , wherein the system is capable of displaying congestion in the computer environment. 
     
     
       124. The system of  claim 15 , wherein the system is capable of displaying congestion in the communication link. 
     
     
       125. The system of  claim 15 , wherein the system is capable of scanning a database to determine if the database includes a field that could be changed by a request from the client. 
     
     
       126. The system of  claim 15 , wherein the system is capable of displaying data entered by a user of the client. 
     
     
       127. The system of  claim 15 , wherein the system is capable of displaying data entered by a user of the client in the same sequence that the data was entered by the user during a user session. 
     
     
       128. The system of  claim 15 , wherein the system is capable of displaying some but not all data entered by a user of the client. 
     
     
       129. The system of  claim 15 , wherein the system is capable of displaying all data entered by a user of the client except user- entered passwords.   
     
     
       130. The system of  claim 15 , wherein the auditor capture filter is capable of monitoring the communication link to capture the request and the response, the auditor capture filter is capable of storing the response to the request on a disk drive only if a specified event occurs, the first environmental variable is a loading parameter, and the request includes an HTML tag.