Web Server Administration

1. Web Server Administration Chapter 11 Monitoring and Analyzing the Web Environment

2. Overview • Monitor operating systems • Monitor Web servers • Monitor other Web applications • Learn about some analysis tools for Web servers

3. Monitoring Operating Systems • Typically you analyze log files • They contain information regarding certain events • Logs are used to detect problems • OS, application, or security problems • Various tools can monitor performance • Should create baseline at beginning of OS lifecycle for comparison purposes

4. Monitoring Windows • Performance monitoring allows you to compare system performance over time • You can set multiple counters and watch them in real-time • Windows Task Manager highlights CPU and memory usage • You can modify services to notify you if a service fails

5. Windows Event Viewer • The event viewer contains six event types shown in the left pane

6. Windows Event Logs • System and application events display three levels of messages • Information • Warning • Error • Because many messages can be generated, a filter focuses on what you want to see • Over time, the logs fill up so you should clear them or save them

7. Monitoring Linux • Logging is controlled by the syslogd daemon • Facilities represent daemons that used syslogd • Most facilities are listed below • Apache uses local7

8. Eight Levels of Message Priorities in syslogd

9. Monitoring IIS • IIS has specific counters for use in the Performance Monitor • The System event viewer provides specific information • If IIS did not start, you can find out why • IIS has extensive logging capabilities • Default log format used by various third-party applications that analyze logs • You can create custom logs

10. Sample IIS Log

11. Monitoring ApacheError Logs • By default, syslogd sends Apache messages to /var/log/boot.log • Location of the error log • ErrorLog logs/error_log • logs refers to /var/log/httpd • You can create a different error log for each virtual host

12. Monitoring ApacheTransfer Logs • Transfer logs tell you about the use of your Web site • Default log based on combined format • Determined by the CustomLog directive in httpd.conf • There are a number of sample formats or you can create your own • By default, they are stored in /var/log/httpd/access_log

13. Monitoring DNS • BIND uses a logging statement that you configure in named.conf • Define logging in two parts • Channel defines where logging is sent • Category defines what will be sent • If the channel is going to a file, use the versions option to define the number of backups • Size option sets maximum size of the file • print-time adds the date and time to the file

14. BIND Categories

15. BIND Logging Entry logging { channel "techno_channel" { file "named.log" versions 4 size 10m; print-time yes; }; category "resolver" { "techno_channel"; }; };

16. Monitoring Exchange 2000 • Uses Application portion of Event viewer • Should filter out informational messages because there are over 50 just when it starts • You can enable four types of logs • audit – access to mailboxes • protocol – commands used for SMTP, etc • message tracking – senders and receivers • diagnostic – analyze detailed problems

17. Analysis Tools for the Web Server • Analysis tools extract system data from logs and format the data • For IIS, one of the popular tools is WebTrends from NetIQ • Helps you determine the source of Web traffic • Determines which pages are most popular • Nearly 50 different reports • 123LogAnalyzer is available for both IIS and Apache • Many reports are similar to WebTrends • However, you cannot compare reports over time

18. Summary • Monitoring operating systems typically involves performance monitor graphics and analyzing log files • When monitoring systems, start with a baseline • In Windows, Event Viewer is the primary utility • BIND 9 DNS has extensive logging capability • Analysis tools take data in logs and help you make sense of it in an easy to read format