WebServer setup suggestions?

August 14, 2005 12:52 PM

W2k3 Server Gurus - best practices for setting up a dedicated Web server and recommended log analyzer software (more inside)

Our electronic planroom is changing software to a version that now requires Microsoft 2003Server and SQL - our ISP has set up a new dedicated web server but has made some basic setup decisions that I am not particularly comfortable with ( 1 partition only, data and O/S intermixed). Their reasoning is not particularly believable but I don't have anything but my misgivings to counter with. As well we are looking for a web log analyzer to parse and report on the access stats but they don't seem particularly helpful in suggesting anything.

Can anyone suggest a "Best Practices" guide, online or published for server setup and possibly some suggestions on the "best" web log analyzer/reporting packages out on the street (price is only sort of an issue - $100-$500 OK, $10k not so OK).

posted by gsquared to computers & internet (8 comments total)

Hey, I just did a hell of a lot of pricing on web analytics, so here's what I can share: at your price range, WebTrends ($895 standalone, $35/m ASP) is the way to go. Running them locally might eat up too much of your server resources, though...can you do a hosted version?

There are some free products out there, but WebTrends 7.5 is about as good as you can get without spending $100-$500/month.
posted by paul_smatatoes at 4:47 PM on August 14, 2005

Microsoft has a number of white papers online that you can find pretty easily covering this sort of thing. The ISP may simply want to stick to a standard, easily recovered "ghost" that it can reinstall in the shortest time possible. If you want something different that makes you more responsible for it.

Without knowing what you're doing with it, recommending a "best" log analyzer is problematic. There are so many options out there.
posted by dhartung at 4:51 PM on August 14, 2005

I posted an answer to a prior question about web-server setup/security in Windows Server 2003 (and IIS6).

I second WebTrends. It doesn't get any better than that.
posted by purephase at 5:41 PM on August 14, 2005

there are plenty of freeware log analyzers if you don't need something fancy. If you need all sorts of crazy stats, particularly those that sales/marketing/whoever are gonna be interested in, WebTrends might be a good pick.

my favorite Windows server books are written by Mark Minasi. He does a good job of covering everything in great detail -- it's a fantastic desk reference -- however, if you just need an overview, i'd go with something else.

I have no real problems with running things on a single partition -- sometimes this avoids space problems later on (oh crap we only alloted 10 gigs for our boot drive and this process/function needs more space than we have). As long as the server's got raid/managed backups, i wouldn't worry too much about it.
posted by fishfucker at 8:36 PM on August 14, 2005

I have no real problems with running things on a single partition -- sometimes this avoids space problems later on (oh crap we only alloted 10 gigs for our boot drive and this process/function needs more space than we have). As long as the server's got raid/managed backups, i wouldn't worry too much about it.

This is very true. I've inherited some mindlessly partitioned systems subsquently requiring more space in one partition while the other has heaps of space free. Meanwhile, if either partition actually fills up, the server is effectively off-line until the problem can be fixed. I now advocate a single partition with mirroring and a decent nightly backup system.
posted by krisjohn at 10:38 PM on August 14, 2005

Logging analysis tools

I don't have any experience with Webtrends, but I'll assume (perhaps wrongly) that it suffers from the limitations of most boxed products: it's not terribly flexible, and tends to offer a pre-determined "view" or set of interfaces that may not always be what you need.

As a long time IIS admin, let me presume to state unequivocally that the single best log analyzer for Windows, especially for IIS, is logparser (this is a link to an unofficial fansite/forum which has a link to the official MS download location). Some of the many, many benefits:

• Completely free!
• Has a decent user-community at logparser.com for usage and tips and example common queries
• Comes from MS (so maybe not a benefit to some! :) )
• Entirely self-contained, no messy install- the logparser.exe is ALL you need to begin logparsing!
• Command line based utility, easily batchable. Here is an example of the results of a batch output job directly to graph format.
• Runs against remote systems' log files or event logs, can even multiplex remote systems.
• Also has a COM module (.dll) that makes it usable in vbscript for yet more advanced scripting and batching
• Utilizes a SQL-like syntax of incredible flexibility. The power of this cannot be overstated- it basically limits logparser to your own imagination; you can do some really complex analysis and pivots, as well as more simple "hits per hour" analysis.
• Really quite fast! This includes a built-in feature of making checkpoint files; as a result, you can have logparser check your IIS log every N minutes, reading in tail-like fashion only the most recent lines to improve performance greatly.
• Can natively support numerous formats for input, such as perf logs, event logs, IIS logs of all formats, trace logs, csv/tsv/xml/txt files, file system (analyze the files in a directory structure as easily as you analyze lines in an IIS log file), registry, Active Directory objects, netmon traces, etc. You could easily produce not only canned reports on your web traffic, but also your server capacity and utilization and errors, to better understand how your web application behaves and performs.
• Can natively support output formats of csv, txt, xml, etc, or directly into a SQL database or syslog server, even graphical formats (pie/bar charts, datagrids, etc)
• Supports multiplexing of both input and output. For example: you can say "give me the top 20 cs-uri-stems for all the files ex200508*.log, grouped by host header, in descending order, and output each set of top 20 by host header into their own separate bargraph image file". Naturally, you could have that as a scheduled task, and host a simple .htm file to display those images (see the link a few lines above for an example)

Absolutely a phenomenal tool, incredibly flexible, just leaves the possibilities to you- makes it very easy to whip up another datamine in very short time, without reinventing the wheel.

The guy who wrote it, Gabrielle Guiseppini, is something of a hero to windows systems engineers. When I worked at MSN, all the good Systems Engineers (yes, there were a few of us!) would consider it the number one tool to have; we jokingly referred to it as the "Windows Longhorn Administrator's Shell". :)

Sure, boxed products might give you some features and a GUI (although I see from that logparser.com site that some people have taken to writing a GUI interface for it as well), but a little elbow grease and an afternoon with logparser can whip up a set of reports/analysis that will compete with any boxes product, at the wonderful price of free! :)
posted by hincandenza at 12:10 AM on August 15, 2005

whoa. great suggestion hincandenza. I've never seen that before, but I plan on trying that out right away.
posted by fishfucker at 11:17 AM on August 15, 2005

krisjohn writes "This is very true. I've inherited some mindlessly partitioned systems subsequently requiring more space in one partition while the other has heaps of space free. Meanwhile, if either partition actually fills up, the server is effectively off-line until the problem can be fixed. I now advocate a single partition with mirroring and a decent nightly backup system."

If at all possible you should never have web content on the system partition. I try to keep the system drive small with very little installed (basic system needs) and a content partition for pretty much everything else. Lucky for me, I have the luxury of clearly defined roles per server so it makes it a lot easier. All system drive installations are the same (cookie cutter) while each content partition is a myriad of file/print, web, application etc. roles. It does work if you do it correctly. However, depending on budget and/or resources, some people cannot afford multiple servers, operating systems etc.

I already seconded WebTrends (and you can customize it quite a bit), but logparser is great (and you can't beat the price). It will require a little more work initially, but there's nothing wrong with getting your hands dirty.
posted by purephase at 4:09 PM on August 15, 2005