Management of a WWW Server using SNMP Carlos Picoto - CiteSeerX

Management of a WWW server using SNMP

Proceedings JENC6

C. Picoto, P. Veiga

Management of a WWW Server using SNMP Carlos Picoto Pedro Veiga

Abstract

In this paper we describe the work we are pursuing in using SNMP [4], the well known and widespread management protocol, in the integration in a WWW server of advanced management capabilities. With SNMP facilities integrated in the WWW server it is possible to manage the server from a remote station. This enables the use of the advanced management platforms that conform with SNMP to monitor and control the operational status of the various WWW servers under a management domain, for example, the various WWW servers of an organisation.

The widespread use of WWW lead to the existence of a large number of WWW servers, even inside a single institution. The good operational status of these servers, unless made in an automated way, requires a significant human effort. In this paper we describe the work we are pursuing in providing a WWW server with remote management facilities by using the SNMP management protocol. With this facility a large number of WWW servers can be remotely controlled and monitored.

I. Introduction

II. Background

The Internet is growing at an incredible pace and one of the applications with the greatest responsibility in this growth is, no doubt, the World Wide Web (WWW) [1]. Indeed since its introduction, but mainly in the last year, the number of users of the WWW is growing very quickly.

For a better understanding of the issues related to our work it is important to mention some background information both on WWW servers and SNMP.

II.A.Server

Due to the nature of the application, based on a client/server model, the information repository is based on servers. Each server, located in a computer system, is responsible for responding to user requests from a client. Between client and server a specific protocol, HTTP [2] , is responsible for the communication. This architecture lead to the existence of a significant number of WWW servers. Each organisation has different strategies for the implementation of the WWW organisation but, in many cases, this can be one server or several servers interconnected by hyperlinks.

The WWW system is based in the client server paradigm. Human operators, using hypertext browsers, navigate thought information located in servers distributed all over the Internet. Each server, running in a machine, is a standalone process that interacts with the client using the HTTP protocol and transfers files formatted according the HTML language. This structure puts a lot of pressure in the correct operation of the server, that must answer to requests coming from many different clients. Thus it is very important that the server has a great availability, and every problem in its operation is clearly and quickly identified and traced. Existing servers use log files to inform human operators of the server status and relevant events. In addition the operator has to monitor the operating system to check for possible operational problems.

The importance of each WWW server for an organisation depends on the criticality of the information made available to WWW clients. As a rule, the availability of each server should be as high as possible. In addition to the availability it is highly desirable that the administrator of the WWW server has access to a large amount of information concerning the operation of the server. These facts mandate that a careful monitoring and management of the server is made.

II.B.SNMP The Simple Network Management Protocol [4] is now a de facto standard regarding the management of devices interconnected by a communication network. Virtually any device could in theory be managed by SNMP. The model used by SNMP, is also very simple since it consists on three main components: the managed nodes, the network

The traditional solution to WWW server management consists in watching the log files created by the server and trying to identify problems or other situations that require some kind of human intervention (restart, tuning, ...),

413-1

Management of a WWW server using SNMP

Proceedings JENC6

management station and the management protocol itself.

C. Picoto, P. Veiga

architecture. The WWW server logs it’s activity into log files and error files.

The managed nodes are any kind of devices connected to the network, and in general terms will fall in one of three categories: a host system, a gateway system or a media device (like a ethernet hub). The model has a Fundamental Axiom that should be always observed in any implementation and it states that: “The Impact of adding network management to managed nodes must be minimal, reflecting a lowest common denominator”.

WWW Server

www.fc.ul.pt

Network Management Station

logging Queries log socket

The network management station (NMS) consists on a host system running the network management applications using the management protocol. Because of the simplicity of the protocol and to respect the fundamental axiom, in order to achieve an efficient management the SNMP drops the responsibility in the Management Applications. It is much easier to support a complex management station than several complex agents that would go against the fundamental axiom. When managing large networks with operation staff using several management stations it is termed a Network Operations Centre (NOC).

control socket (planned)

SNMP AGENT

Traps and Responses

Fig.1 - Architecture Implemented III.A:Transfer logging We use the HTTPD daemon [5] provided by NCSA as the main server for our institution. On the prototype implemented we are hooking our code to the logging functions on the server. This way we can get all the error information and also the access information. This information is passed to the SNMP agent running on the system that increments the counters and updates the available tables. The information is then made available to any network management station by querying the appropriate MIB variables.

The management protocol used in this model implements the “remote debugging” paradigm. For each managed node the management station sees several variables. By reading and writing these variables it is possible to monitor or even change the behaviour of the managed nodes. The set of all these variables is called a Management Information Base (MIB). With this simplicity the protocol is straightforward as it needs to implement a read and write operation. Besides these two, there is also a traversal operation, used to determine which variables are implemented by the managed node. In addition a trap operation allows the managed node to report an extraordinary event to the management station.

Example of a log record: rse28.cem.itesm.mx [Wed Nov 23 22:00:58 1994] GET /images/metro.gif HTTP/1.0 The main variables provide the means to detect the activity of the server. This is done by counting all the requests and incrementing the correct counters. There are also some MIB variables that provide error logging information, although the errors are mainly treated by a trap mechanism. All the MIB variables are updated by the SNMP agent running on the WWW server host, when new information is received from the open sockets.

The data representation scheme used by the SNMP model is based on the Abstract Syntax Notation One (ASN.1) [3]. This is used both to represent the PDUs exchanged by the protocol and also to define the managed objects (or variables).

III. Proposed System

The activity variables are sub divided in three categories: client oriented, document oriented and general variables.

The system under development consists in a computer system where a SNMP agent interacts with a WWW server to collect and/or change information concerning the server operation. Information in the SNMP agent is organised in a MIB that we have developed to store information relevant to the WWW server. The SNMP agent interacts with the WWW server through sockets. In Fig. 1 we have a diagram that represents this

The client oriented variables provide counters to monitor the origin of the requests. This counters can be accessed by transversing the TopLevelDomainRequests and HostRequests tables. Each row has the identification for the table item,

413-2

Management of a WWW server using SNMP

Proceedings JENC6

C. Picoto, P. Veiga

can see a great improvement in the management of the WWW server because now the problems are reported to the NOC, that can take some immediate actions to solve them.

the number of requests and the total bytes that they represent. There is also a general wwwOutOctets variable that in conjunction with the total amount of bytes sent by the WWW server host can be used to monitor the network load impact of the WWW server in the host machine. This information can be obtained by the general variable wwwOutHog.

V. Conclusions The growing complexity of the infrastructure necessary to support an organisational WWW server requires a systematic and standard approach to the management of the various servers involved in the provision of information.

The document oriented variables are used to monitor the document accesses. They are also organised in tabular mode, and each row provides the name of the document, total requests and amount of octets sent.

SNMP is the de facto standard for network management and a large set of products exist on the market to build highly sophisticated but user friendly management systems. Our work, the integration of and SNMP agent to enable the remote management of a WWW server, proved that, together with the definition of a coherent MIB, it is possible the effective management of a large number of servers in an automated and efficient way.

The general variables provide information on last requests and total accounting. This is done by keeping the extracted information from the last record in lastHost, lastTopDomain, lastTimeStamp, lastOperation and lastDocument. The total accounting is gathered and stored on totalOutOctets, totalRequests, totalDocuments, totalTopLevels. To reduce the impact of the modifications on the SNMP agent, we have chosen to keep it very simple, so all the work to produce reports on the collected data as to be done on the server.

VI. References [1] T.J. Berners-Lee, R. Cailliau, J-F Groff, B. Pollermann, CERN, “World-Wide-Web: The Information Universe”, published in “Electronic Networking: research, Applications an Policy”, Vol2 No 1, pp. 52-58 Spring 1992, Meckler Publishing, Westport, CT, USA.

III.B.Error Handling An error record is issued whenever there is a problem with the WWW server. This information arrives at the SNMP agent with the generic format of . When the SNMP agent gets this record it generates a specific trap to the management console alerting for the problem. The agent also maintains lastErrorMsg and lastErrorTimeStamp variables that can be queried from SNMP managers.

[2] T.J. Berners-Lee, “Hypertext Transfer Protocol”, http://info.cern.ch/hypertext/WWW/Protocols/H TTP/HTTP2.html [3] Marshal T. Rose, “The Open Book: A Pratical Perspective on Open Systems Interconnection”, published by Prentice Hall, ISBN 0-13-643016-3

IV. Preliminary Results The test of the prototype system that we have developed has been made using standard SNMP consoles and command line utilities. There are some known problems related to the control of the size of the tabular variables that are being handled in order to keep information out of the tables until they are really needed there, and also to erase old information on a regular base. As we expected, the counter variables are very useful for monitoring the WWW server demand and the effect on the network traffic originated by the server. We are now implementing an extension to the MIB in order to allow the control of some issues in the WWW server. In addition we are doing some work on SNMP consoles developed inside our research group to improve the usage of the available information. We are also testing the scalability of the solution by testing it in several WWW servers. At present we

[4] Marshal T. Rose, “The Simple Book: An Introduction to Management of TCP/IP -based internets”, published by Prentice Hall, ISBN 013-812611-9 [5] “NCSA httpd Overview”, http://hoohoo.ncsa.uiuc.edu/docs/Overview.html

Author Information Carlos Picoto studied Computer Science at Lisbon University in Portugal. After graduation he obtained is M.Sc. in Electronic Engineering and Computer Science from Technical University of Lisbon , working as a researcher at Instituto de Engenharia de Sistemas e Computadores (INESC). Since then he became an Assistant Lecturer at

413-3

Management of a WWW server using SNMP

Proceedings JENC6

Lisbon University where he is working on is Ph.D. He has given courses on Distributed Systems, Advanced Networks and Operating Systems. At the University he has promoted computer based telecommunication services, and managed the Network Connections of the University to the National Service , to the Ebone and to the Multicast Backbone (MBONE). He is also responsible for the maintenance group of the World Wide Web server of the Faculty.

Pedro Veiga is a Professor at the Informatics Departament at the Faculty of Sciences of the University of Lisbon. He has a degree on Electrical Engineering (1975) and a PhD in Electrical and Computer Engineering (1984), both from the Technical University of Lisbon. He is responsible for the scientific area on Computer Networks and Operating Systems where he is responsible for several courses and also leads several R&D projects at the national and international level. Pedro Veiga is responsible for Networking at INESC, the largest portuguese non-profit research institute in the IT area and is advisor in networking of several national and international organisations.

413-4

C. Picoto, P. Veiga