Management matters

The shakeout of the Web server market has continued since our last roundup in April 1997, with a few marginal players bowing out of the game and some new ones entering. This time we tested Web servers from eight vendors, including trans-Atlantic newcomers Idonex and Zeus Technology. But in the end, we found that experience pays.

Of the eight Web servers we tested, Netscape Enterprise Server 3.6 won our Blue Ribbon Award. A Beta 2 version of Lotus Domino Application Server R5 placed a very close second. We don't typically rate beta products, but Lotus was confident that its late beta could compete with shipping products. (Documentation is not factored into Domino's score because it is not yet printed).

In our tests, Netscape's Enterprise Server surpassed Lotus for administrative ease; Domino, an application server, is inherently more complex. But Lotus gained ground with comprehensive reporting features that topped those of all the others.

The two leading scorers are easy to install. Netscape obligingly points out the default document path, which took a bit of snooping to find on some of the other Web servers. Domino, for all its extended capabilities, asks only that you choose standard, mail or enterprise server to begin installing.

Microsoft's Internet Information Server 4.0 (IIS) is the only free NT Web server we reviewed. A logical choice for anyone who owns Windows NT Server 4.0, it's capable and easy to use.

Weaker database connectivity and security features hurt O'Reilly & Associates' WebSite Professional 2.0, which lagged behind the Web servers from Netscape, Lotus and Microsoft. WebSite impressed us with its ease of administration, and its QuickStats function was useful for a fast look at what's going on with your Web server.

We tested each of the above Web servers on Microsoft Windows NT Server 4.0; we ran the other four Web servers on Linux. Performance was not comparable across NT and Linux platforms, so we didn't use it as a criterion in our ratings.

None of the Web servers we tested on the Linux platform scored as high as those we tested on NT. Of the four Linux servers, the free Roxen Challenger 1.2 from Sweden's Idonex scored highest. Web Server 3.0 from England's Zeus Technology offers weaker administration and reporting capabilities than Roxen at a much higher cost - $1,699.

Apache is represented by Red Hat Software's Secure Web Server 2.0, which includes Apache 1.3. Red Hat's product is the only Linux server we tested that includes a graphical user interface (GUI). After installation, however, we were disappointed by the product's poor administration, weak database connectivity and virtually nonexistent reporting capabilities.

Rounding out the Linux camp is thttpd 2.04, the product of Jef Poskanzer's one-man operation, Acme Laboratories. Not only is the company small, but the thttpd freeware Web server is contained in a 163K-byte compressed file - the most compact software in our group. When we asked about thttpd's security provisions, Poskanzer said incorporating encryption capabilities, let alone support for Secure Socket Layer 3.0 (SSL), would simply make thttpd too big. This attitude and the code that results from it make thttpd unsuitable for enterprise deployment, though it does seem to achieve its designer's goal of speed, strength and stability.

Note that some of these products, most notably Domino Application Server and Netscape Enterprise Server, include more functionality than just a simple Web server; however, this review examines only the Web server capabilities of each product. In the case of Domino, we plan to review the complete product when the new version ships this month or next.

In the field

We subjected each Web server to loads simulating 200, 640 and 1,600 users. Our tests yielded consistent results across varying loads with the somewhat puzzling exception of Idonex's Roxen Challenger. We observed a slight but definite drop in Roxen's transaction capability at the 200-user level; the slowdown became severe at the 1,600-user level. Roxen's senior developer thought that the server may have run out of file descriptors because of the nonforking nature of Roxen's operation. (That is, the Roxen server does not spin off new processes to handle new requests, each of which would have its own pool of file descriptors.) Idonex proposed a fix that involved recompiling the operating system, but because the proposed fix came late in the testing process, we did not have time to try it. It is worth noting, however, that Acme's thttpd is also a nonforking server and encountered no such problems under any load.

In general, the Linux-based group returned fewer errors under maximum load than the NT group, but we can draw no real conclusion from this because the hardware and operating systems were too different.

Greater differences between the NT and Linux groups started to show up when we delved into the Web servers' administrative features. Netscape Enterprise Server favors browser-based administration by way of intuitive, easy-to-use input screens. Microsoft's IIS offers a choice of command-line, Windows or Web-based administration, but it doesn't make the controls as clear as we'd like. Lotus Domino Application Server clouds control clarity even further with a multipaned and tabbed administrative view that gives access to many functions at the expense of user friendliness. Domino's expanded functionality accounts for some of this administrative complexity.

O'Reilly's WebSite has well-organized menus that make it easy to get to information. Although the main administrative control screen resembles Microsoft's, the selections are more logically arranged and easier to work with.

Zeus' Web Server and Idonex's Roxen use browser-based configuration through an SSL-secured connection, but Roxen does a better job. Where Web Server offers a scanty selection, Roxen has many more control settings available and also incorporates customization features that let you tailor the default display.

At the bottom of the administration scale are Red Hat's Secure Web Server and Acme's thttpd. Administering Secure Web Server and thttpd via direct file editing will challenge the skills of most users. Thttpd allows you to make changes to the source code and little else; Secure Web Server improves on this somewhat by listing and defining the available configuration directives. While this certainly helps, you must still change the configuration directives by directly editing the configuration files.

Keeping tabs

Web servers produce log files, which are valuable if a Web site administrator can extract useful information from them. Domino includes a wealth of reporting choices - so many that it takes some studying to determine which tool can best retrieve the information you need. Netscape Enterprise Server and Microsoft's IIS also provide thorough means for checking logs and performance monitors. O'Reilly's WebSite Professional sets up a preconfigured NT performance monitor screen for instant, at-a-glance viewing of your server's health.

Red Hat's Secure Web Server and Acme's thttpd give the user no help in extracting information from log files; Zeus' Web Server and Idonex's Roxen provide only slightly better access to log data through their browser interfaces. Roxen begins to address what should be logged and where data should be stored but stops short, perhaps so users will buy Idonex's Roxen Logview, an add-on traffic analysis product.

Acme is the only company that doesn't include security features in its Web server. All of the other products support SSL 3.0 with 128-bit encryption, and all but Acme and Idonex also support X.509 certificates. Lotus and Netscape add an Access Control List to allow users to define varying degrees of access. Using its NT-native capabilities and the Microsoft Management Console, IIS can accomplish the same type of granular control.

When it comes to database connectivity, Netscape, Lotus and Microsoft offer support for so many products that it's difficult to track them all. Lotus touts Domino Enterprise Connection Services as a means to create native, seamless access to most commonly used enterprise databases. Microsoft prefers its Active Server Pages and ActiveX Data Objects approach. Netscape provides a long database connectivity options list, which covers essentially the same range as the others'. We didn't test each product's database features for speed, stability or ease-of-use. Still, it is clear that these NT vendors have worked hard to anticipate enterprise data access needs.

Idonex includes minimal capabilities within the basic Roxen Web server in deference to another of its add-on products, Roxen Database API Pro, which provides extra database connectivity options that the Web server lacks. The basic Roxen server offers support for Common Gateway Interface and Fast CGI, as well as free databases MySQL, mSQL and Postgres; Zeus and O'Reilly include Open Database Connectivity (ODBC) and Java Database Connectivity (JDBC) in their connection options. Thttpd occupies the low end of the scale, offering only CGI as a connectivity option. Red Hat's connectivity choices consist of gdbm, ndbm, and PHP3 Internet scripting language. Of these, only PHP3, with its hooks to Oracle, Sybase, ODBC and others, is of any real utility.

As in many of the other categories, we found drastic differences between the NT and Linux products' basic installation routines. With the NT Web servers, installation was straightforward and often as simple as installing a typical office application.

Of the Linux servers, Red Hat's server was easiest to install. Secure Web Server's simple GUI and clear documentation allow an administrator who is unfamiliar with Linux to perform a successful installation.

We had to uncompress, extract and install the three other Linux programs entirely through the command line. We had no problems installing Zeus' Web Server and Idonex's Roxen; Acme's thttpd's install routine failed to create one needed directory and one group, which we had to add manually.

Command-line work is not a big deal for those whose needs are simple and who scorn GUIs. In these cases, one of the low- or no-cost products in our group might work well.

For those comfortable with their ability to disassemble and rebuild software to suit, Acme and Red Hat offer low-end pricing, real-world acceptance and, for Red Hat, a large community of fellow users to turn to for support. Newcomers Web Server and Roxen Challenger show promise, but they also display some oddities, which is not unusual for new software. The combination of capable Web-based administration and zero cost should prompt particular interest in Roxen.

From the NT group, Netscape Enterprise Server emerges as our Blue Ribbon Award winner simply by performing all tasks well. Lotus is right behind Netscape with its Domino Application Server R5, which includes large enterprise, clustered-server operation among its functions. Microsoft's IIS enjoys wide availability because it's part of NT 4.0. Its administrative capabilities, although not as intuitive as Netscape's, do not take terribly long to learn. O'Reilly needs only to enhance WebSite Professional's database capabilities to present a serious challenge to its better known competitors.

Related links

MacLeish is a publication tester at Client/Server Labs, an independent testing laboratory in Atlanta. He can be reached at KMacLeish@cslinc.com.

Buyer's guide: Web servers
Select the criteria most important to you, then see which servers support them. Or compare two or more servers in categories you select. Plus, download complete spec sheets for each server.

Downloads: Web servers
Don't just take our word. Download eval and free servers and try them out for yourself.