Professional Documents
Culture Documents
Contents
Comparing IIS and Apache: Questions and Answers................................................................3 Understanding IIS and Apache..................................................................................................4 Apache HTTP Server............................................................................................................4 Internet Information Server 6.0.............................................................................................5 Internet Information Services 7.0..........................................................................................5 Common Questions from Apache Administrators......................................................................6 Does IIS offer the performance and scalability I need?.........................................................6 Is IIS as secure as Apache?.................................................................................................6 Is IIS harder to manage than Apache?.................................................................................7 Is IIS as reliable as Apache?.................................................................................................7 Is IIS really as modular as Apache?......................................................................................8 Apache is an innovative platform. What about IIS?..............................................................8 Troubleshooting Web applications can be complicated. What does IIS offer to simplify troubleshooting?...................................................................................................................9 I depend on a wide variety of Web architectures. Can I run them on IIS?..........................10 Yes, PHP applications can run on IIS, but is it really a good idea?.....................................10 Will IIS be more expensive than Apache?...........................................................................10 Conclusions.............................................................................................................................12 IIS 7.0 Resources....................................................................................................................13
Finally, IIS is deeply integrated with Windows Server 2008, which can be installed using the Server Core installation option. In this mode, the server has no graphical user interface, and the removal of many components reduces the surface area and patching requirements of the operating system. According to Michael Leefers, systems administrator at the Information Services and Technology Division at the University of California, Berkeley, with Server Core, we saw a way to reduce a servers vulnerability to attack, but also its need for patches and our administrative overhead associated with patch monitoring and installation.vii IIS is a both a secure product, and has important security features. Because Microsoft developed IIS6 and IIS7 under the SDL, the Web server continues to enjoy low vulnerability counts. IIS provides the same functionality as Apache authentication, access control, and SSL modules. Plus, IIS makes these features easy to use and configure.
Apache administrators are familiar with using open-source projects like monit to restart Apache based on failed requests, CPU usage, or other factors. IIS also enables administrators to restart the process based on simple configuration options. IIS can monitor and recycle the process based on an apparent crash, elapsed time, total number of requests, amount of memory usage, or other factors. A controlled IIS process recycle should not result in any dropped requests. Fifty-six percent of Fortune 1000 companies already depend on IIS 6 or 7. Mike Graves of AdHost provides his experience with IIS7, explaining, In terms of stability, weve been running Windows Server 2008 for two months now, and have been monitoring it every three minutes from five different Web servers. So far we havent seen even a flicker of downtime.
Additional modules are included to provide functionality for authentication, authorization, compression, application frameworks (such as CGI and the .NET Framework), health monitoring, diagnostics, and logging. Since the release of IIS 7.0, Microsoft has developed new modules for bit-rate throttling and URL rewriting, which provides functionality similar to the mod_rewrite module available for Apache. Outside of Microsoft, modules are available from software vendors, and opensource modules can be found on CodePlex.com.xiii As James Hanauer, a senior software engineer at ServiceU, explains, The modular architecture of IIS 7.0 and its integration with the newest version of the Microsoft .NET Framework contribute to increased Web server performance. These same characteristics provide a customizable platform where specialized server components such as authentication and logging can be extended or replaced.xiv Rich Korb, assistant manager of Data Center Operations for WeatherBug, says, We really like the ability to pick which components of IIS 7.0 we needwhether its using the integrated mode to run ASP.NET applications, using the classic pipeline to run ASP.NET through the ISAPI filter, or just running a streamlined HTTP Web server.
IIS 7.0 includes a number of important innovations. It is fully scriptable and able to operate with no GUI. Microsoft also enhanced IIS 7.0 by allowing it to run FastCGI applications, such as PHP, very effectively. To Apache administrators, these innovations may seem to imply that IIS is only catching up to Apache, but in reality, IIS has its own set of unique innovations. In addition to its new GUI administrative interface, IIS 7.0 includes many performance enhancements that permit it to host more sites and handle more traffic on the same hardware. Windows Process Activation Service can start up the Worker Process on the first HTTP request. IIS includes application pools and sandboxing to let you control reliability and isolation on a per-site basis. IIS supports editing of configuration files while the server is live, and automatically applies the changes. IIS also includes robust static and dynamic output caching, as well as object caching for back-end data. Microsoft continues to evolve IIS to meet the needs of a diverse audience that includes companies hosting their own sites, sites hosted through co-location that require remote management, and hosters that service hundreds or thousands of customers. According to hosting company eLinia, Microsoft really listened to the hosting community when it developed Windows Server 2008. The changes in Internet Information Services 7.0 mean that we can tailor the system to do exactly what we want.xv Craig Tadlock, chief systems architect for Spot Runner, says, IIS 7.0 is a more feature-rich platform than previous Web servers. IIS 7.0 reduces the amount of foundational technology, such as logging and auditing, that we need to develop on our own and thereby simplifies our services and, ultimately, our systems.
Troubleshooting Web applications can be complicated. What does IIS offer to simplify troubleshooting?
Apache records errors in a log file that includes information from the Apache HTTP server and additional information from the relevant modules. Apache also lets users control the amount of information logged, ranging from emergency issues only to verbose debugging information. If users need additional information, they can add such things as mod_log_forensic to capture entire requests. IIS also logs errors, and Microsoft has focused on ensuring that IIS error messages are understandable and useful. IIS defaults to providing verbose error information on the localhost and a more generic message to remote users to ensure that security information is not remotely disclosed. Error information often includes suggested causes and solutions. IIS also provides Failed Request Tracing, which lets users capture entire requests. Failed Request Tracing lets you set the number of log files to keep, which URLs should be traced, and which response codes should generate a trace. Users can even specify that requests for certain URLs be captured only if those requests take over a certain amount of time to process.xvi Dawn Getteau, systems architect at Continental Airlines, explains, The troubleshooting features in IIS 7.0 have been enhanced by leaps and bounds. At the end of the day, what matters to us and our users is not just how well our IIS applications run, but also how fast we can troubleshoot them if they go down.xvii Hostbaskets Van Pottelberghe says, Theres nothing cryptic about it. If something goes wrong, we track it, repair it, and quickly finish the configuration.xviii Gregory Storme, systems engineer of COMBELL, comments, Before, when a clients Web site wasnt performing well, the old debugging tools provided a lot of output. With 500 Web sites running, it was nearly impossible to find the relevant error information. Failed Request Tracing in IIS 7.0 makes it a lot easier to see just the requests that were interested in, with the status codes and other details that we need to debug the site or the application.
Yes, PHP applications can run on IIS, but is it really a good idea?
Microsoft invested heavily in FastCGI and Windows Server 2008 to ensure that PHP and other CGI frameworks would run as first-class citizens on Windows. In addition to providing the basic infrastructure for running PHP applications, IIS-specific features are also available for those workloads. For example, you can use IIS authentication mechanisms such as NTLM that integrate with Active Directory. You can use the SQL Server driver for PHP. In addition, PHP applications get the benefit of IIS application pools and sandboxing. PHP also benefits from the performance that IIS Kernel Mode Caching offers.xxi PHP and ASP.NET can be combined for quick development by leveraging certain functionality that ASP.NET provides out of the box, such as Forms Authentication.xxii Users can apply the exact same modules across PHP and ASP.NET sites, such as, URL Rewriter. By running PHP on Windows, youre able to use the same management tools to monitor your PHP workloads that you use to monitor your Windows workloads. Companies such as COMBELL are providing their customers the capability of running PHP on Windows and today are seeing the results. As Frederik Poelman, technical director of COMBELL, explains In the past, if customers asked for PHP hosting, we offered them Linux; if they asked for ASP or ASP.NET hosting, we offered Windows Server. Now we have a bunch of test customers running PHP on IIS 7.0, and it is working very well for them. The more customer requirements we can support with one operating system, the more experts we can have developing new solutions on that operating system.xxiii
10
But some organizations quickly find that the costs of Linux support subscriptions are comparable to, or even more expensive than, Windows licensing.xxiv These companies can turn to the second method: supporting Apache with internal expertise. This means that organizations have to hire highly skilled experts in order to run mission-critical applications on Apachein some regions these experts are hard to find. In contrast, Windows expertise is relatively common. Some organizations may also find that administrative tasks can be performed more quickly on IIS. Since software acquisition is 7 percent of TCO, while staffing is 60 percent, staff costs can quickly outweigh acquisition costs.xxv Consider one case study: At aruba.it, Italys largest hosting service provider, Microsoft found that the TCO of its existing Windows-based shared hosted services was 16 percent lower than the TCO of its Linux-based offerings. Moreover, the contribution margin from the Windows-based services was 14 percent higher than the contribution margin from the analogous Linux-based services. Finally, the profit margin for Windows was 81 percent compared to 77 percent for Linux.xxvi
11
Conclusions
It is apparent that Apache is a capable Web server. Over the past years Microsoft has invested heavily in the development of IIS which has proven to be not only as capable as Apache, but also able to host a greater variety of applications such as SharePoint, Outlook Web Access, and ASP.NET sites. IIS also hosts popular PHP applications, such as Wordpress, Drupal, phpBB, and MediaWiki.. In addition to being highly secure and reliable, IIS is easy to manage through administrative GUIs and scripts. It runs many Web sites that have extremely high performance and availability requirements. The benefits of a modular architecture are self-evident to Apache administratorsand IIS now shares this type of architecture. IIS 7.0 includes 40 modules that are fully supported by Microsoft, giving administrators one company to hold responsible for problem resolution. Starting with IIS 6.0 and continuing with IIS 7.0, Microsoft has invested in improving the reliability and fault tolerance of its Web server. IIS 6.0 introduced application pools that allow users to make isolation decisions on a per-site basis; IIS 7.0 extends this capability with sandboxing, which provides many of the isolation benefits of separate processes but without the overhead. In addition, IIS 7.0 provides great diagnostics with Failed Request Tracing, a feature that makes it easy to get to the bottom of problems. To evaluate IIS and determine if its right for your workloads, visit learn.iis.net.
12
The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This white paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in, or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. 2007 Microsoft Corporation. All rights reserved.
13
iv
Handling 1.5 Billion Page Views Per Day Using ASP.NET 2.0: http://weblogs.asp.net/scottgu/archive/2006/03/25/Handling-1.5-Billion-Page-Views-Per-Day-UsingASP.NET-2.0.aspx.
vii
University of California, Berkeley: University Tackles Management and Security Challenges in Complex IT Environment: http://www.microsoft.com/casestudies/casestudy.aspx? casestudyid=4000001475.
viii
Dell Simplifies Server Management, Lowers Costs, and Increases Dell.com Performance: http://www.microsoft.com/casestudies/casestudy.aspx?casestudyid=4000001634.
ix
MaximumASP: Web Hosting Firm Empowers Customers with Operating System Upgrade: http://www.microsoft.com/casestudies/casestudy.aspx?casestudyid=4000001217.
xi
Adhost: Web Services Firm Uses Shared Configuration, Reduces Server Setup Time by 80 Percent: http://www.microsoft.com/casestudies/casestudy.aspx?casestudyid=4000001311.
xii
xiii
ServiceU Corporation: Event Management Firm Provides Software as a Service using SQL Server 2008: http://www.microsoft.com/casestudies/casestudy.aspx?casestudyid=4000001258.
xv
eLinia: Hosting Company Provides More Secure Data Transfer Service with New Server: http://www.microsoft.com/casestudies/casestudy.aspx?casestudyid=4000001624.
xvi
Continental Airlines Optimizes Security and Streamlines Application Management: http://www.microsoft.com/casestudies/casestudy.aspx?casestudyid=4000001486. xviii Hostbasket: Web Host Optimizes Security, Improves Performance with Server Upgrade: http://www.microsoft.com/casestudies/casestudy.aspx?casestudyid=4000001623.
xix
xx
Microsoft selected SpikeSource to deliver open-source applications on Windows Server 2008: http://www.spikesource.com/partners/microsoft.
xxi
COMBELL: Internet Hosting Company Reduces Server Management Time by 92 Percent: http://www.microsoft.com/casestudies/casestudy.aspx?casestudyid=4000001254.
xxiv
Reduce your Total Cost of Ownership and Increase the Business Value of IT: http://www.microsoft.com/philippines/windowsserver/compare/unix/reduce-tco.mspx.
xxvi
Aruba.it: Lower TCO for Windows-Based Services Fuels Profitability for Italian Hosting Leader: http://www.microsoft.com/casestudies/casestudy.aspx?casestudyid=200138.