1. Chapter 11 Monitoring and Analyzing the Web Environment

2. Overview  Monitor operating systems  Monitor Web servers  Monitor other Web applications  Learn about some analysis tools for Web servers

3. Chapter Overview Monitoring OS/ Application Analyzing log files/ GUI interface Performance: Workload / Resources / Performance Monitoring the OSWeb Applications DNSEMAIL / FTP Security: Tripwire (files being Monitored) Start with a baseline

4. Monitoring Operating Systems  Typically you analyze log files They contain information regarding certain events  Logs are used to detect problems OS, application, or security problems  Various tools can monitor performance  Should create baseline at beginning of OS lifecycle for comparison purposes

5. Monitoring Windows  Performance monitoring allows you to compare system performance over time You can set multiple counters and watch them in real-time  Windows Task Manager highlights CPU and memory usage  You can modify services to notify you if a service fails

6. Monitoring Windows File opened and closed  Disk Queue Length: overall view of disk load – the longer the length slower the access  % Process Time: How often the processor is being used  Page/sec: RAM availability and how much the virtual memory is being used

7. Windows Event Viewer  The event viewer contains six event types shown in the left pane

8. Windows Event Logs  System and application events display three levels of messages Information Warning Error  Because many messages can be generated, a filter focuses on what you want to see  Over time, the logs fill up so you should clear them or save them

9. Monitoring Linux  Logging is controlled by the syslogd daemon  Facilities represent daemons that use syslogd (shown below)  Each facility generates massages Messages have different priorities  Emerg, alert, crit, err, etc.  Most facilities are listed below Apache uses local7 for loging

10. Eight Levels of Message Priorities in syslogd

11. Monitoring IIS  IIS has specific counters for use in the Performance Monitor Cache; Byte received; Active Server Page Errors); etc.  The System event viewer provides specific information If IIS did not start, you can find out why  IIS has extensive logging capabilities Default log format used by various third-party applications that analyze logs You can create custom logs

12. Monitoring Apache - Error Logs  Performance monitoring of the web server Error log Transfer log (information in and out of the server)  By default, syslogd sends Apache messages to /var/log/boot.log  You can create a different error log for each virtual host

13. Monitoring Apache - Transfer Logs  Transfer logs tell you about the use of your Web site  Default log based on combined format Determined by the CustomLog directive in httpd.conf There are a number of sample formats or you can create your own  By default, they are stored in /var/log/httpd/access_log

14. Monitoring Other Web Applications  Email Keep track of any errors; volume of messages;  FTP Which files are being down loaded Determine possible attacks  DNS BIND uses a logging statement that you configure in named.conf Define logging in two parts  Channel defines where logging is sent  Category defines what will be sent

15. Analysis Tools for the Web Server  Analysis tools extract system data from logs and format the data  For IIS, one of the popular tools is WebTrend Helps you determine the source of Web traffic Determines which pages are most popular Nearly 50 different reports  123LogAnalyzer is available for both IIS and Apache Many reports are similar to WebTrends However, you cannot compare reports over time

16. Class Exercise:  www.whois.net  Give it a domain name www.whois.net You can check who owns the domain name.  www.arin.net/whois  IP Address  www.networksolutions.com  Domain and IP address www.networksolutions.com  http://www.dnsstuff.com/  Very interesting http://www.dnsstuff.com/

17. Summary  Monitoring operating systems typically involves performance monitor graphics and analyzing log files  When monitoring systems, start with a baseline  In Windows, Event Viewer is the primary utility  In Linux, syslogd is the primary utility  Analysis tools take data in logs and help you make sense of it in an easy to read format

18. Homework (April 26 in class submission– Hardcopy only)  Research on WebTrend, 123LogAnalyzer, or any other analysis tools for Web pages. Write a short (2 pages) summary about the software. Explain a sample report you can generate, where to get the software, and if the software is free. Include a picture of sample report.

19. Lab  Do project 11-1 - Windows  Do project 11-2 – Linux (/Var/log)  Do project 11-5 – Linux (/Var/named)  Do project 11-7 – Extra credit 5 points.  All labs must be shown!