WebTrends is tops among three Web server log analysis tools, but make sure you understand the assumptions these programs make before you rely on the data they return.

Web management is hot, and a hot market means one sure thing: Don't blink or you'll miss something. Take the three vendors that accepted our invitation to test their Web management software and the one vendor that gave us a sneak peek at its upcoming product; each company is in the throes of revamping an existing package or introducing a brand-new product.

Why the push? Because all of a sudden, the reliability and speed of corporate Web sites are top priorities. What were once internal skunk works projects are now critical electronic business venues. Web site administrators need help monitoring server conditions, planning for capacity, managing site traffic and analyzing usage trends. While we found no product that performs all of these Web management tasks flawlessly, each of the products we reviewed solves a portion of the problem.

Released in late November, WebTrends' Enterprise Suite 3.0 earns our Blue Ribbon award for its ease of use and its detailed quality assurance reports. WebTrends has a firm hold on site content management and log file analysis, and Enterprise Suite 3.0 is clearly a market leader in these areas. Enterprise Suite 3.0's site monitoring facilities are adequate for smaller sites, and its basic alerting will be useful for many administrators who currently have no alarm provisions.

A great complement to WebTrends' Enterprise Suite 3.0 is Freshwater Software's SiteScope 3.1, which excels at monitoring and alerting, though it lags in content management. We tested SiteScope 3.1; Freshwater released Version 3.2 in mid-November, and Version 4.0 is due in early 1999.

WindDance Networks' WebChallenger contains a powerful arsenal of tools, including benchmarking and server discovery features not found in other Web management suites. However, there's no Web management task at which WebChallenger truly excels. Also, WebChallenger's user interface is woefully poor. Stay tuned, though, because it too is a work in progress. As we go to press, WindDance Networks is relaunching WebChallenger as JetStream. The features we tested are the same, but the name is new and the repackaged version will have a new, purportedly cleaner interface.

Finally, we looked at a late beta version of MasterIT from Computer Associates International. MasterIT is a new product from Computer Associates, which has a history in network management, and it's a good one. Our initial inspection indicates that MasterIT may set a new high mark for site monitoring and alarming when it's released this month.

Monitoring fundamentals
Originally a simple log file analysis tool, WebTrends' Enterprise Suite 3.0 today is a Web management tool that monitors site quality, checks links, conducts proxy file analysis and alerts you when your site needs attention. It's a reasonably powerful program with minimal needs: You can run Enterprise Suite 3.0 from any Windows 95, 98 or NT system with 16M bytes of RAM and 20M bytes of disk space.

Monitoring functions track server availability, document availability by URL, SNMP traps, disk space use, Web server logs, NT logs, and the status of various IP-based services such as Domain Name System (DNS). Enterprise Suite 3.0 lets you check thresholds at regular intervals and designate alert mechanisms, including audible alarms, e-mail messages and pages. The product also addresses recovery: Alarms can trigger as many as three actions, including running a program, restarting a service or rebooting a system.

In general, however, we found Enterprise Suite 3.0's monitoring features pretty basic. For example, the software doesn't allow you to monitor server performance, network utilization or the contents of a file. These checks are crucial if you're trying to deal proactively with traffic increases, rather than simply responding after a service fails.

Enterprise Suite 3.0's file integrity-checking function is also simplistic. The feature looks primarily at file size and time stamps; more complex integrity checkers can search for a particular string in the contents of a file. This distinction is important when you consider monitoring a dynamically generated page. What happens if pages are built properly but the program fails and the content isn't placed on the page? A simple URL checker wouldn't notice a problem, and because the page is dynamically built, a file size or time stamp checker would be inappropriate.

Enterprise Suite 3.0's link checking and site quality features identify broken links, large or slow pages, very old or very new pages and general HTML problems, such as missing height and width attributes for images. You can run link checks at any time or schedule runs for later, and you can customize reports or make use of predefined reports, such as one that displays all images used in a Web site.

While the ability to check links is nothing new, Enterprise Suite 3.0's handy integrated site management console is. WebTrends can display site analysis information in a variety of formats, including an interactive hyperbolic tree, file view, link view, Web chart and grouping view. The graphic views allow you to look at site structure, navigate the site and even view the underlying source. Once you isolate a problem, you can launch a third-party HTML editor directly from the management console.

Given its origins, it's not surprising that we found the strongest aspect of Enterprise Suite 3.0 to be its log file analysis support. Like previous versions, this product balances simplicity with power. The built-in log file reports range from basic executive summaries showing site usage patterns to advanced reports that include banner ad tracking and search engine phrase monitoring. You can save the fully customizable reports in a variety of formats, including HTML, Microsoft Word, Excel and comma-delimited or ASCII text. A scheduler can automatically retrieve logs from a disk, by File Transfer Protocol (FTP) or even HTTP. Once the results are processed, you can save the results to a disk, upload them via FTP to a remote system, or e-mail a report to interested parties.

While log files show historical site information, you can set the program to constantly refresh the log information for your reports. That feature, along with this version's improved processing speed, makes near real-time monitoring possible. Speed improvements are partially due to the inclusion of FastTrends, a caching database that stores the results of processed logs.

Other interesting log analysis features include support for clusters and proxy server logs, filters to sort out multiple domains served from a single machine, Open Database Connectivity support for access to log files stored in databases, and the ability to run reports from a remote Web browser. Finally, intranet users may appreciate the ability to provide meaningful naming schemes for IP addresses and machines. This feature allows you to associate addresses and machines with departments or other groupings in internal log file reports.

Focus on site status
For Web site alerting and monitoring, Freshwater Software's SiteScope is hard to beat. The program runs on Windows NT, Irix and Solaris, and consists of a Java server application accessed via a Web browser interface. The interface provides a simple control panel that lets you visually monitor Web services. You can set alarms graphically to be sent via e-mail, SNMP trap and pager.

Setting up site monitors with SiteScope is fairly simple. Like the other products, SiteScope offers ping checks and monitors the availability of services including DNS, FTP, news and mail. You can also watch basic system services such as disk space availability, memory use and CPU utilization; and you can request that warnings be issued when thresholds are reached. Additionally, SiteScope monitors log files for error messages and checks statistics logs to determine hits per minute or bytes transferred per minute, for example.

One interesting aspect of SiteScope's monitoring is its robust URL and file monitoring function. Like most Web management suites, SiteScope can check for the existence of a file as well as monitor the size and date of the last file modification. However, as we noted with WebTrends' Enterprise Suite 3.0, these checks are not useful when you're dealing with dynamically generated pages. For this reason, SiteScope lets you examine the contents of a generated file for a particular string as well as check for the proper execution of a script that may generate a file.

Besides monitoring files, SiteScope can also watch a sequence of URLs or actions that emulate a typical user transaction, such as filling out a sequence of forms and downloading a software package. Using a facility called Deep Monitoring, SiteScope not only monitors the success or failure of the transaction as a whole, but lets you look at the steps that comprise a transaction if a failure occurs.

One interesting twist to Freshwater's Web monitoring approach is an optional subscription service called Global SiteSeer, which monitors your Web site from various locations on the Internet. Public Web site administrators may find the user-oriented perspective that Global SiteSeer provides more interesting than any internal-based alarm system.

Up to the challenge?
WebChallenger from WindDance Networks has some of the most interesting features we found in our tests, but the product is hampered by a clunky interface. If you have 1,024-by-768-pixel resolution or better and are willing to deal with an unpolished HTML- and Java-based browser interface, you'll discover a wealth of useful tools.

WebChallenger requires an NT 4.0 workstation or server with 32M bytes of RAM and more than 100M bytes of free disk space. WebChallenger does not run on the same machine as the Web server and does not require a remote component on monitored servers. Even so, it provides sophisticated network and server monitoring.

Once installed on a client PC, WebChallenger passively watches traffic on its network segment. It can monitor bandwidth usage and page requests sent to any Web server on the network, regardless of operating system or server version.

The product is built around six primary tools: Web Alarm, Web Benchmark, Web Diagnosis, Web Explorer, Web Statistics and Web Verify.

Web Alarm includes some nice features that are useful for catching server failures before they happen. For example, Web Alarm can notify you if server response time falls below a specified threshold or if server throughput slows to less than a specified level. Basic monitoring, such as probing, to see if a server is available or if a network service port is live, can also trigger an alarm.

In general, however, we found WebChallenger's alarm configuration to be subpar. You can designate only one e-mail address to send alerts to, regardless of the type of alarm. Furthermore, the simple pager interface lacks configuration capabilities. For example, you can't directly provide complex pager access scripts that deal with alphanumeric paging systems.

We were more impressed with the Web Benchmark component, which tests server capacity and response time. You can set loads to simulate multiple clients, and you can program each client to look at a particular number of URLs per test cycle. After benchmarking a server, WebChallenger produces a report that includes transactions per minute, as well as throughput and response time in milliseconds. While more complex Web server load-testing products exist, Web Benchmark does an adequate job for general capacity planning.

Web Diagnosis provides raw access to network traffic. While it may be useful to isolate data problems closer to the packet level, it's probably of little help to Web administrators.

More useful is Web Explorer, which checks a network for the existence of various IP-based services, including HTTP, FTP, DNS and Simple Mail Transfer Protocol, among others. Web Explorer helped us isolate some rogue Web servers on a large intranet.

The Web Statistics tool lets you easily watch Web traffic in near real time on a variety of servers.

Finally, Web Verify provides basic site link checking and some quality assurance measures, such as linking statistics, and the age and size of a page. While useful and fast, Web Verify doesn't provide any visualization tools, which are helpful when you're trying to decide how to fix a problem.

What we learned
While no currently shipping Web management product addresses all administrative needs, each of the three products reviewed here can help you better manage your Web site. For site content management and log file analysis, WebTrends' Enterprise Suite 3.0 is clearly the market leader in its price range.

While Enterprise Suite 3.0 provides some site monitoring facilities that may be adequate for smaller sites, it is outclassed by Freshwater Software's SiteScope. With its emphasis on monitoring and detailed alerting capabilities, SiteScope would be very useful for organizations that need to monitor small server farms or collections of intranet servers.

WebChallenger— with its "jack-of-all-trades, master of none" approach— may be appropriate for organizations looking for technical and network probing information at a reasonable cost. In renaming and relaunching the product as JetStream, we hope WindDance Networks will solve WebChallenger's biggest weakness: a poor user interface.

Originally published on Network World, Published: December 7, 1998.