Web Server Workload Characterization Assignment 3, COMPSCI 314 Due: Refer to the deadline on ADB 1 Introduction Data analytics is the process of examining raw data to find actionable information that can support decision making in organizations. Data analytics is a growing field, with demand for data scientists who can parse through large volumes of data to find meaningful patterns. These results can be utilized by organizations to improve their business processes. Internet traffic measurement involves collecting network data that can be analyzed for several purposes such as traffic modeling, designing better network protocols, and traffic management. The growth in popu- larity of Web in the 1990s resulted in researchers trying to characterize Web traffic. These research works have utilized Web server logs to understand the workload characteristics of Web servers. The results of the research has led to improving performance of Web applications, designing better caching and load balancing techniques, and providing better user experience to clients, among other things [1, 3–5]. If you are further interested in the general area of distributed system (IoT, cloud, networks, cyber security etc.), Internet measurements, performance evaluation or data science and would like to do a Honours project, 380 project, MSc or PhD, then please contact me at [email protected]. 2 Web Server Access Logs In this assignment, you will analyze one of two university Web server access logs [2]: 1. A campus-wide Web server at the University of Saskatchewan (UofS_access_log). 2. A department-level Web server at the University of Calgary (UofC_access_log). The server access log contains information about all requests made to the server and the corresponding server responses. The server log is in the fixed text-based Common Log Format and has the following syntax: hostname – – [dd/mm/yyyy:hh:mm:ss time_zone] object response_code transfer_size The hostname is the resolved name or IP address of the client making a request for an object stored on the Web server. The following fields (- -) are usually empty, but may contain user-identifier information such as username. The next field indicates the day and time the request was made along with the time zone. The URL requested is noted in the object field. The response_code field indicates the HTTP response code returned by the server. The transfer_size field records the bytes transferred by the server. For example, the following is a line from the UofS_access_log: imhotep.usask.ca – – [15/Sep/1995:16:02:09 -0600] “GET /changes.html HTTP/1.0” 200 1254 This line represents a request made by host imhotep.usask.ca on September 15, 1995 at 4:02:09 p.m. The time zone is central time (GMT-0600). The host requested the HTML file called changes.html using HTTP version 1.0. This request was successfully completed by the server as shown by the status code 200. The server transferred 1254 bytes to the host imhotep.usask.ca. Note the following about the datasets: 1 • UofS_access_log: This trace contains seven month’s worth of all HTTP requests to the university Web server. The logs fully preserve the originating host and HTTP request. A local client is one containing usask.ca in the hostname or an IP address with 128.233.X.X. All others are considered remote clients. Timestamps have 1 second resolution. • UofC_access_log: This trace contains approximately one year’s worth of all HTTP requests to the University of Calgary’s Department of Computer Science Web server. The hosts making requests to the server have had their addresses removed to preserve privacy. Hosts are identified as either local or remote where local is a host from the University of Calgary, and remote is a host from outside of the University of Calgary domain. Paths have been removed. Files were numbered from 1 for the first file encountered in the trace. Files retain the original file extension, so that the type of file can be determined. Paths of the filenames have been removed. Modified filenames consist of two parts: num.type, where num is a unique integer identifier, and type is the extension of the requested file. Timestamps have 1 second resolution. 3 Web Server Workload Analysis Choose one dataset you like and answer as many questions as possible: 1. Based on your learning of Internet measurements in this course answer the following questions: (a) What measurement mechanism was used for the collection of the Web server logs? Active, Passive, or both. (b) What type of network were the measurements taken from? Edge network, core network, or both. (c) What type of analysis techniques did you apply on the dataset to get the answers? Online, offline, or both. (d) Is analyzing server logs the only way to characterize the workload of a Web server? Briefly explain your answer. 2. How many requests are made per day on average? 3. How many bytes were transferred during the entire log duration expressed in Megabytes (MB)? 4. What is the average number of bytes transferred per day expressed in MB per day? 5. Produce a breakdown of the server response codes expressed in percentage of the total number of requests. Group the status code as follows: Successful, Not Modified, Found, Unsuccessful. A successful response (status code: 200) means that the server received a request for a valid object (for which the client has the necessary access privilege), the object was found, and returned successfully to the client. A not modified response (status code: 304) means that the client already has a copy of the requested object in its cache, wants to verify if the object is up-to-date, and the client is informed that the object has not been modified at the server. A found response (status code: 302) results when the requested object is known to be stored in a different location than the URL requested by the client. The server responds with the new URL in this situation. A unsuccessful response (status code: 4XX and 5XX) happens when the requested object does not exist on the server, the client did not have access permission, or there was a server-side error. 6. How many requests are made by local clients and remote clients, respectively? Report your answer as a percentage of total requests. 7. How many bytes are transferred by local clients and remote clients, respectively? Report your answer as a percentage of total bytes transferred. 8. Produce a breakdown of requests by file type category. The file categories are as follows: Video, Sound, Dynamic, Formatted, HTML, Images, Others. Report your answer as a percentage of total requests. The file categories by file extensions are described in Table 1. 2 Table 1: File categories Category File extension HTML html, htm, shtml, map Images gif, jpeg, jpg, xbm, bmp, rgb, xpm Sound au, snd, wav, mid, midi, lha, aif, aiff Video mov, movie, avi, qt, mpeg, mpg Formatted ps, eps, doc, dvi, txt Dynamic cgi, pl, cgi-bin Others Everything else 9. Using Table 1, produce a breakdown of bytes transferred by each file category. Report your answer as a percentage of total bytes transferred. 10. Using Table 1, calculate the average transfer sizes (in bytes) of each file category. 11. Identify all unique object requests in the log and sort them based on frequency. Next, identify all the objects that were requested only once in the log. What percentage of unique objects are accessed only once in the log? What percentage of bytes are accessed only once in the log? 12. Produce a Cumulative Distribution Function (CDF) plot of the transfer sizes of all distinct objects. The x-axis should be in log-10 scale. 13. Produce three plots to show the percentage of total requests per hour of the day, the percentage of total requests per day of the week, and percentage of total requests per month of the year. 14. Produce a CDF plot of the inter-reference times of objects that are requested more than once. The x-axis should be in log-10 scale. For questions 6 onwards, your analysis should be based on successful requests only. Report your results to 2 decimal places. Some requests in the log may be malformed. It is safe to ign
ore these requests in your analysis. Please check that these requests account for a negligible fraction of the total requests. Try briefly commenting on your results (Explain the results and discuss their implications). 4 Submission Complete the attached Answers.docx file with your answers. Convert this file to PDF format. Rename it to your username.pdf. Submit the file to ADB. A code template will be provided later in the week to help you get started with the assignment. For added challenge, you may write the parser and analysis scripts from scratch using a programming language of your choice. You are free to use online resources (e.g., online code, tools) as long as you provide appropriate attribution. You do not need to submit the code. You should keep the code, in case we wish to see it. You are encouraged to discuss the assignment with each other, however, the code and the produced results must be done individually. We will only accept assignments submitted on ADB. Late assignments (sent through email) will not be accepted. Please ensure that you have uploaded the correct file to ADB. Please make sure you have received a receipt from ADB after you have uploaded your answer. Questions regarding this assignment and code template should be directed to the course tutor. 5 Grading Scheme Each question is worth 10 points. This assignment is worth 100 points. You can earn a maximum of 120 points. The additional 20 points can be applied to marks lost in any other assignments. For each question, 3 you will receive full points for the correct answer. You will receive 50% points for an answer, which is close to the correct answer. You will receive zero points for an answer that is far off from the correct answer. References [1] Martin Arlitt and Tai Jin, A Workload Characterization Study of the 1998 World Cup Web Site, IEEE Network 14 (2000), no. 3. [2] Martin Arlitt and Carey Williamson, Internet Web Servers: Workload Characterization and Performance Implications, IEEE/ACM Trans. Netw. 5 (1997), no. 5, 631–645. [3] Leeann Bent, Michael Rabinovich, Geoffrey M. Voelker, and Zhen Xiao, Characterization of a Large Web Site Population with Implications for Content Delivery, WWW 9 (2006), no. 4. [4] Venkata Padmanabhan and Lili Qiu, The Content and Access Dynamics of a Busy Web Site: Findings and Implications, Proc. ACM SIGCOMM, 2000. [5] Weisong Shi, Y Wright, Eli Collins, and Vijay Karamcheti, Workload Characterization of a Personalized Web Site and its Implications for Dynamic Content Caching, Proc. WCW, 2002. 4
