By Joel Snyder
Network World, 4/7/97

Visitors to your Web site may not be able to tell what Web server software you're running, but you need to understand the differences inside and out to pick the package that's right for you.

Though there are more similarities in the underlying code than differences, it's the added features that distinguish the high climbers from the basement dwellers.

While the Buyer's Guide chart lists all the players and products, we brought the leading contenders into our labs for a closer look.

The best server we looked at, Netscape Communications Corp.'s Enterprise Server, led the pack on the strength of its setup, management and reporting tools. StarNine Technologies, Inc.' Macintosh-based WebSTAR and O'Reilly and Associates, Inc.'s WebSite Professional also offer a comprehensive management tool kit, a full set of tools for the Webmaster and excellent documentation.

Microsoft Corp.'s Internet Information Server (IIS) and The Apache Group's Unix-based Apache httpd server are solid products, too, but with less support for network manager and Webmaster. With the exception of WebSTAR and Apache, the products all ran on Windows NT.

The servers we reviewed came from the top products in the Netcraft Web Server Survey. Netcraft periodically scans the Internet and keeps track of which software each server is running. We discarded duplicates and family members (only one server to a developer), and customized Internet service provider packages to come up with the five most popular servers. We wanted to include the next most popular server, Process Software's Purveyor, but Process told us Purveyor was undergoing revision and chose not to participate.

During our review, Netscape, Microsoft and Apache all had beta products out. To keep the playing field level, we restricted our review to shipping products only.

Managing Web servers

Likewise, Webmasters and Web application developers need a full package of services, extensive documentation and example applications, a strong server API and a rich set of built-in tools, such as server-interpreted HTML and access to databases - all things we looked for in our tests.

Each Web server vendor takes a different approach to server management. For example, Microsoft's IIS is fully integrated with the Windows NT security architecture and authorization databases. Users authenticating themselves to IIS must have a user name in an NT domain. IIS bases all security decisions on the rights and privileges of that user name. NT's groups and access control lists are used to determine whether pages can be seen by a Web server client.

All of the other Web servers we reviewed use a more traditional approach. User authentication is completely separate from the security domain of the system running the Web server. For example, Apache lets the network manager store realms, user names and passwords in simple text files or, when a large number of users is involved, in a database.

WebSTAR, Enterprise Server and WebSite Professional have similar mechanisms, separate from normal server security, for maintaining access control to Web pages. Your individual needs will determine which approach is best for you.

Management interfaces also reflect vendors' differing approaches. The most primitive and least usable is Apache's, which relies on a set of poorly documented configuration files, typically modified with a text editor, to tell it what to do.

At the other end of the spectrum is Enterprise Server, which does an excellent job of comprehensive server management and some monitoring using a Web browser. WebSTAR's management interface, available via a separate application over an AppleTalk network or through a Web browser over TCP/IP, is also well designed, though WebSTAR offers fewer configuration options than Enterprise Server.

IIS and WebSite Professional both are best managed via their Windows-based interfaces, although IIS does have a subset of management available via Web browsers, as well. All products can be managed remotely (if you consider telnet a remote management client in Apache's case).

Managing, monitoring performance

WebSite Professional also provides current statistics via a special ''stats'' URL for access via HTTP. WebSTAR managers can get an idea of current load using the management interfaces.

At the high end, both Microsoft and Netscape export statistics via an SNMP subagent, which eases integration of Web servers into existing SNMP-based network monitoring systems.

Performance optimization, such as internal disk caching, is either missing or undocumented in most of the servers we looked at. WebSTAR includes an internal disk cache, tunable by the network manager. The others appear to rely on the operating system for any performance optimization.

Other Web server performance optimizations are more subtle. Except for Netscape's Enterprise Server, all the servers we reviewed support HTTP persistent connections. This is an important new feature; when it becomes widely available in both browsers and servers, performance across the Internet as a whole will increase significantly. Persistent connections let the client and server move multiple pages or images within a single TCP connection. This is key, because latency and the TCP three-way handshake make a page with 10 images load much more slowly than raw bandwidth would otherwise allow.

Apache and Netscape also take seriously the issue of performance over TCP/IP. When we installed Netscape on our Windows NT system, it offered suggestions for increasing capacity and throughput by adjusting Windows Registry values for us with permission. Likewise, Apache maintains a comprehensive set of tips for increasing HTTP capacity and tuning the operating system on supported Unix platforms.

No topic causes more stress between Webmasters and network managers than log files. While Webmasters revel in analyzing the demographics of every site visitor, network managers fear the load of managing what can be hundreds of megabytes of log files every week. Webmasters want maximum information, including the reverse Domain Naming System lookup of each visitor's IP address, while network managers nervously eye the cost of retrieving such data.

Good Web servers automatically roll over log files at predefined intervals. All the servers except Apache have this capability built in. Microsoft's IIS also allows you to specify that log files roll over when they reach a predetermined size. All the servers let you vary log formats somewhat.

Given all of the above, we concluded Netscape's management interface was the strongest and most flexible. Only a handful of features were not exported from the server to the Web-based management interface. The combination of a strong remote management capability, Windows NT performance monitoring and SNMP management make Enterprise Server truly enterprise-ready.

If you prefer to edit configuration files (as is required in Apache), Netscape's server also supports that interface, with full documentation on how to maintain the configuration manually.

Good deals for developers

Bundled example applications help Webmasters get off to a fast start by giving them code to model. Servers such as WebSTAR, with more than 100 built-in sample applications, or Netscape's Enterprise Server, which has dozens of examples in its AppFoundry, provide fertile ground for the imaginations of Webmasters to grow new applications and modify existing ones.

O'Reilly doesn't offer the same broad Webmaster's kit but makes up for it with outstanding developer documentation. These vendors have made it easy for developers to get a good start.

Apache, which has a small but respectable kit of sample applications, doesn't measure up to the others because it lacks good documentation. Apache has many of the same built-in features but little definitive documentation, so it's much harder to figure out how to use them. This makes Apache a high-overhead product: free to acquire, but expensive when you want to push the boundaries.

In contrast, Microsoft, which has almost no developer's tool box, pushes undocumented and proprietary FrontPage extensions, which are designed to lock developers into an all-Microsoft world. FrontPage users have the benefit of an integrated development environment that links to powerful server extensions. But server managers who want documentation on the interaction between FrontPage clients and servers are out of luck.

When sample code is insufficient to illuminate a task, Webmasters must become software developers, using the generic Common Gateway Interface (CGI) or a server-specific API. All of the servers we tested support the same basic CGI interface, and a simple CGI program we wrote in C to display HTTP headers ran almost without change on all five servers.

For best performance, though, Web site developers are pushed into using a server-specific API. While faster, this is also much riskier. Because API-based applications are tightly integrated with the server, a bug in the developer's code could take the entire server down. WebSite Professional includes so-called FaultGuard technology, which provides some help by isolating API modules and using built-in Win32 features to catch some kinds of errors before catastrophe strikes.

All five servers offer their own APIs, but Apache, Microsoft, and O'Reilly are all heavily influenced by Netscape's pioneering work in developing Netscape API. O'Reilly's WebSite Professional also includes a subset of the Microsoft server API, so some applications written to Microsoft's Internet Server API will run unchanged on O'Reilly's server. The one real oddball is WebSTAR's W*API, which offers similar features but is based on an entirely different architecture.

We found it was easiest to write simple programs for Enterprise Server, mostly because Netscape's documentation was the easiest to understand and the best laid out. Also, Netscape doesn't require programmers to know too many details about the operating system interface.

Although APIs and CGI scripts are crucial to high-end Webmasters, sometimes programming is not necessary. See Network World Fusion for a discussion of each of the products' techniques for ''programming without programs.''

To go along with the nonprogramming features, good Web servers should have built-in support for full-text searches of all HTML files on the site. Microsoft, Netscape and O'Reilly all match this need with speedy search engines.

Netscape does an excellent job, offering a full-text search engine and something it calls a catalog engine, which offers different views of a Web site by title, classification, author and modification date. These are included in the features of the basic Enterprise Server.

Netscape's approach is particularly elegant because it includes the ability to automatically reindex and recatalog a site at regular intervals, assuring an up-to-date index at all times.

WebSite Professional also has a full-text indexer in its Webindex and Webfind tools, while Microsoft brings indexing to the Webmaster with the free Index Server add-on to IIS. Although Microsoft's Index Server has capabilities Netscape's doesn't - for example, it can index Microsoft Excel spreadsheets, should you want to do such a thing - having to manage two different applications seems an unnecessary burden on the Webmaster.

Bottom line

For smaller sites, Webmasters will love WebSite Professional. Outstanding documentation, reasonable pricing and a long list of features make it an excellent choice when the Webmaster is also the network manager.

WebSTAR is a well-engineered Web server, but it is also tied to the Macintosh platform. In many MIS departments, religious beliefs dictate that a Macintosh cannot serve as a corporate Web server. We disagree, but WebSTAR's Macintosh roots are destined to hold it back.

Microsoft's IIS fundamentally is a good product and offers some features no other server does, such as integration with the NT security domain. However, it's not as manageable as Enterprise Server and not as well documented as WebSite Professional. Its best role is probably as an intranet server rather than a large-scale Internet server.

Apache's success is hard to argue with: More than 400,000 Web servers are happily running using Apache. And many Webmasters and network managers have customized their Apache servers, which its relatively clean architecture encourages. Nevertheless, if you're willing to spend some money and don't think that access to the source code of the server is of paramount importance, other servers can meet or beat Apache.