Performance and security issues in web applications OICGI (OpenInsight Specific)
At 31 MAY 2000 11:58:24AM Wilhelm Schmitt wrote:
We are testing an environment that uses an AREV database (50-80 LAN users) with a duplicate on a web server running through OICGI.
Since we do not have much practice with web applications, we would like to get an idea about the basic performance issues we should consider before going public (with the duplicate database only).
We expect approx. 2000-3000 requests per day (up to 500 requests/hour during peak hours. The average request would load a record (2KB) into a HTML form (+5KB), send it to the client browser and getting it back with some modifications.
How many "concurrent" user requests is OICGI able to handle without major delays? If we installed 2 different OICGI, would that speed up response time?
Are there performance reports or benchmark tests available?
How should we test security?
Recommendations on the Internet Server software?
Any comments or suggestions will be appreciated.
TIA
Wilhelm Schmitt
At 31 MAY 2000 08:13PM Mike Ruane, WinWin Solutions Inc. wrote:
Wilhelm-
Your response time will depend upon the speed of your Web server, and efficiency of your programs.
Will you be using the built in Inet_Read and Write_form programs, or your your own? Based upon your description- I would guess your own custom programs. 500 per hour sounds quite doable, although I haven't been able to test that. We've done 60-100 per minute well, so I think your in good shape.
You shouldn't need 'concurrent' OICGI programs based upon your load. What we've also done in the past is to take those processes that take some time- 40 or more seconds- and generate reports or do some batch processing- is to have the our INET procedure hand the job off to a job processor machine that will email the results to the requestor.
Testing security can happen at a number of levels: Firewall, Web Server, and OI. A firewall will basically take a user, validate them, and redirect them to the real site.
The Web Server can username and password protect sites, subdirectories, or files, based upon configuration files. Most will use a file named .htaccess.
OI has a function named Inet_Security that allo0ws you, as a developer, to perform some sort of check before OICGI returns anything. You can do whatever security you need to here as well.
As far as web server software, we've had a lot of success with Apache for NT, avaliable at WWW.Apache.Org. We've used Sambar in the past with luck, avaliable at WWW.Sambar.Com. We used to use IIS, version 2 or 3, but we haven't used it in a while.
Hope it helps-
Mike Ruane
WinWin Solutions Inc.
WWW.WinWinSol.Com