A Comprehensive Web Workload Characterization

Transcription

1 A Comprehensive Web Workload Characterization J.A.Lacort, A. Pont +, J.A. Gil +, J. Sahuquillo + Department of Systems Engineering and Control + Department of Computer Engineering Abstract Polytechnic University of Valencia Camino de Vera, s/n ,Valencia (Spain) jualalu@isa.upv.es, {apont, jagil, jsahuqui}@disca.upv.es The current and incoming Web are designed according to recent technology breakthroughs and the new topics of social interests, which are two heterogeneous aspects suffering continuous changes when not complete revolutions. Therefore, any drawn conclusion about different aspects related with the Web and its infrastructure will remain valid for a limited period of time. In addition, the Web contents and traffic are highly dependent on the interests of Web Clients. A relevant or shocking event may have a great impact on the Web traffic during a period of time, which will depend on for how long the event keeps being relevant or shocking. This paper focuses on the Web Workload characterization, which is a prerequisite to accomplish both technical and performance evaluation studies. The workload analysed in this paper has been collected over a year to identify current and future trends or new behaviours in either Web objects or users. The consequences of an event, which shook the local society, were also analysed, to measure how the workload parameters change under special circumstances. Main characteristics of the Web workload ranging from the percentage of dynamic against static contents to the cache hits per hour or even the concentration of requests per site have been measured to assess their values and identify consistent changes. Other characteristics to be analysed were chosen based on their variation during the mentioned events. Analysed data were collected by a Proxy Server providing services to a vast community (50K potential users, 122M requests and 810GB transferred). Keywords: workload characterization, web performance, measurement techniques. 1 Introduction As the Web is suffering continuous changes both in contents and technology, the majority of conclusions and assertions must be periodically reviewed [4], [8]. This paper presents two different studies. The first one analyses the workload characteristics and identifies future trends. To grasp a good understanding of these parameters is crucial in order to achieve a high efficiency from all the elements compounding the Web [1], [12]. A second analysis measures the effects that a shocking event has over the Web traffic. Some social events can concentrate big interest and have big impact on the characteristics of workloads of both the Web and Proxy Servers [3], [9]. The event studied was the terrorist attacks in Madrid on the 11 th of March (11M). The study of how the Web behaves during these peaks of activity is highly important, as it determines its usefulness under these circumstances. These special circumstances become more and more common as the resources get more constrained. Thus, the study can unveil difficulties that we will have to face in the near future. This work has been partially supported by the Spanish Government Grant CYCYT TIC C03-02 P67/1

2 The main goal of our web workload characterization is to identify characteristics of the workload that remain stabilized and others that vary according to a trend over a period of time, or as a result of an unusual event. The rest of this paper is organized as follows. In section 2 the system environment is described. In section 3 the results of the workload characterization are presented, both analysing a long period of time and a short period during which the parameters are suitable to be widely modified. Finally, section 4 presents some concluding remarks about both studies. 2 System Environment The analysis has been made over logs collected from the Proxy Server of the Polytechnic University of Valencia (UPV), where figures relating potential Web users and machines with access to the Web or Web Clients has increased from around 39k potential users and 14k Web Clients in 2001 to an estimate 50k potential users and 23k Web Clients in Proxy configuration Squid [13] was the software used in the Proxy Servers during all the period analysed. It is out of the scope of this paper to analyse the efficiency of their configurations Selecting dates Two periods of time have been selected to best fit the study s purposes. In almost any study focused on the Web, a year is typically a period of time long enough. We have selected traces over such a long period of time, to identify trends in the characteristics analysed. Dates representative of the University activity were preferred, that is, periods of time excluding local holidays or those when presence of students could be lower than average. Short periods of inactivity due to hardware or software failure were not excluded from the study. For the first analysis, we selected three weeks within this period from which the traces were obtained, namely: Week 1 (W1.1): Monday 3 rd to Sunday 9 th of February Week 2 (W1.2): Monday 5 th to Sunday 11 th of May Week 3 (W1.3): Monday 2 nd to Sunday 8 th of February To assess the effects of 11M on the Web, we need to characterize the workload during the time that breaking news about the events were published on the Web. A measurement of the same parameters in previous days is required to numerically establish the relevance of the incidents. For this purpose, traces from the week that preceded the attacks, have been considered. Week 4 (W2.1): Monday 1 st to the 5 th of March Week 5 (W2.2): Monday 8 th to the 12 th of March Weekend days have not been included this time, as they could make impossible to distinguish changes due to a different level of activity and those motivated by the analysed events themselves Filtering the logs In order to avoid analysing erroneous log entries, a simplification of the logs has been made by excluding the requests that do not match the access.log standard of Squid. A negligible percentage of the initial log entries were expelled from the study because of this reason. Because of the volume of information that needs to be analysed, a tool to process the data is required. A series of customized scripts were developed in PERL language for this purpose. 3 Workload Characterization 3.1 Workload Characteristics and Future Trends P67/2

3 There are several characteristics in a web workload worth to be analysed and therefore, a selection needed to be done to make the study feasible. The characteristics presented were those found more representative of the workload and its evolution Requests The volume of requests received is the most significant characteristic to probe, in order to establish the activity of a Proxy and how it evolves over a period of time. Table 1 shows these data corresponding to the three weeks mentioned above (W1.1, W1.2 and W1.3). Day of the week Week Item MON TUE WED THU FRI SAT SUN Thousands of Requests Gigabytes Transferred W1.1 Standard Deviation Average Thousands of Requests Gigabytes Transferred W1.2 Standard Deviation Average Thousands of Requests Gigabytes Transferred W1.3 Standard Deviation Average Table 1. Number and distribution of the requests received by the Proxy Sever As expected, the number of requests and volume of bytes transferred from the Proxy Server drops during the weekend, due to a lower presence of users. On Saturdays the activity is around 10% of a typical working day, and it gets even lower on Sundays. It is outstanding, though not surprising, the high value of the standard deviation of the size of the files transferred, what illustrates the wide range of sizes the web objects present. Table 2 presents an additional analysis, were data has been summarised by week. Item Week W1.1 W1.2 W1.3 (w1.3-w1.1) Thousands of Requests Gigabytes Transferred Standard Deviation Average Table 2. Number of requests and bytes transferred summarized per week The success achieved by the Web over the period can be summarized in a few facts: The number of requests rose by nearly a half (49.1 %). The volume of information managed grew an astonishing 77.2 %. The average size of the Web object requested is 18.8% higher, with the consequent increase in the standard deviation Considerations about usage Given the distribution of the day activity in the University, the requests are made primarily within the working hours, 8 to 20, concentrating on the morning that is the busiest period of the day for most of the users, declining around lunch time (13 to 15 hours), see Figure 1. In other works the activity concentrates towards the last hours of the day [2]. P67/3

4 Figure 1. Number of requests per hour for the period analysed Figures 2a, 2b and 2c, show both the average size of the requests and the Proxy hit rate, for W1.1, W1.2 and W1.3. When the average size of the Web object requested is considered, the higher values are reached on the periods with lower usage, when the Web is less exploited. The chances of a request resulting in a hit in the cache of the Proxy Server improve with the number of requests [10]. Data in Figures 2a, 2b and 2c confirm this fact. Figure 2a.Proxy Hit rate and average size of the requests against request per hour for W1.1 Figure 2b. Proxy Hit rate and average size of the requests against request per hour for W1.2 P67/4

5 3.1.3 Web object types Figure 2c. Proxy Hit rate and average size of the requests against request per hour for W1.3 To understand the type of information accessed through the Web this section classifies the requests based on the file type. The selection of file types filtered has been made considering those native and popular in the Web. The results obtained are presented in Table 3 by number of requests (left side) and by volume of bytes transferred (right side), since the effects are different according to each criterion. The two most popular graphic formats, gif and jpg, account for around 60% of the number of requests that a Proxy receives, with gif format around 4 to 5 times more popular than jpg. One can see how static pages (htm) are losing weight, from 4.3% in W1.1 to 3.6% in W1.3, against dynamic pages (js, php, cgi, cfm and asp), from 9.2% in W1.1 to 15.1% in W1.3. This confirms that the new generation of Web applications is becoming more and more popular. Also, css files increased from 2.3% in W1.1 to 2.6% in W1.3, what indicates the growing presence of the latest design web standards in the Web, while graphic format png tripled from 0.2 in W1.1 to 0.6 in W1.3. Number of requests Volume of bytes transferred Dates Week Week W1.1 W1.2 W1.3 W1.1 W1.2 W1.3 Type Requests Requests Requests AVG AVG AVG (thousands) % (thousands) % (thousands) % (KB) % (KB) % (KB) % cgi htm gif js php cfm asp jpg css png Total Table 3. Number of requests and volume of bytes transferred classified by Web object type While the set of extensions selected account for four out of five requests, when attending to traffic, they account for less than half of the bytes transferred, mainly due to the small size in average of gif objects. The increase in the amount of requests of php objects are followed by a proportional increase in the volume of bytes transferred (from 2.2% in W1.1 to 4.4% in W1.3), reaffirming the fact that the Web is getting more and more dynamic Site Popularity The thousands of different domains visited weekly, more than 65k in W1.3, are not equally popular. The results of the Top 5 sites visited account for around 10% of the total. It proves that the interests of the Web P67/5

6 clients do not differ widely and concentrates on a few sites. This concentration will become even higher under certain circumstances, as will be discussed in section Figure 3. Percentage of requests to Top 5 sites per week for W1.1, W1.2 and W1.3 Figure 4 shows the visits per site versus the ranking position of the site represented on log-log scale. The curve indicates that the request frequency is proportional to 1/i α, following a Zipf-like distribution [6]. This allows estimating the popularity of a site or a set of sites based on its ranking position. In our traces α takes values, presented in Table 4, expectable for a homogeneous environment. Figure 4. Frequency of site accesses versus site ranking Parameter Week W1.1 W1.2 W1.3 α Table 4. Value of α parameter of Zipf Distribution P67/6

7 3.2 Workload Characteristics Affected Following are some of the characteristics analysed, which were outstandingly affected by the 11M events. Additional analyses were conducted for some other characteristics not obtaining clear evidence of variation. Traces from some particular Web Server, which were stressed over the period, would have been valuable to conduct different measurements sessions Requests and response time In W2.1 the requests kept stabilized at around 5 million a day, see Figure 5. In W2.2 from an unusual high volume of requests on Monday, the activity evolved towards normal values. Although it is difficult to estimate the decrease of requests due to the cancellation of classes from 11a.m. on 11M to the next Monday, the number of requests to the Proxy Server did not increase dramatically due to the events on the day or following day. However, when considering response time, the effect of the events arises. During W2.1 the response time varied between 1000 and 1500 milliseconds. For W2.2 response time varied from 1000 to over 2000 milliseconds, except for a peak on the day of the events, when average response time arrived to nearly 3500 milliseconds. Figure 5. Thousands of requests to the proxy and response time (ms) per week There are several potential reasons for this service degradation. A main one could be the fact that the activity on the Web concentrates on a few servers which can be prepared or not to manage this eventuality. On the other hand, the importance of offering the latest information will require a continuous update of the Web pages and will constraint the Proxy s efficiency Site Popularity To establish how 11M affected the sites popularity, we measured the Top 5 visited sites, depicted in Figure 6. The popularity achieved by the top sites during 11M (W2.2 Thu.) was way above normal values. As expected, the most popular sites were those offering information and news related to the events, mainly on line newspapers and radio stations. P67/7

8 Figure 6. Percentage of requests to Top 5 sites per weekday for W2.1 and W2.2 This concentration of visits in a few sites stressed the Web Servers which hosted these extremely popular sites, which struggled to manage the unusually large volume of requests, worsening the quality of service offered to the Web Clients Efficiency of the Proxy Proxy Servers are expected to improve the Web s efficiency, especially when the circumstances seem to favour a high Proxy Hits rate. To analyse if this is the case for our traces, we filtered the requests classifying them according to the HTTP protocol [5] into three categories listed in Table 5. Squid label TCP_HIT TCP_IMS_HIT TCP_MEM_HIT Explanation A valid Copy of the requested object was in the cache. The client issued an IMS (if-modified-since) request for an object, which was in the cache and fresh. A valid copy of the requested object was in the cache and it was in memory, thus avoiding disk access. Table 5. Classification of the requests considered Proxy Hits These categories correspond to the case when the cache had a fresh-cached copy [7]. Different categories imply different benefits, but in any case the client s request did not need to be attended by the Web Server, what alleviated its congestion. Figure 7 shows Hits of fresh-cached copies slightly increased from 40.5% on Thursday of W2.1 to 42.6% for Thursday of W2.2 and from 31.1% on Friday of W2.1 to 40.8% on Friday of W2.2). The highest increase comes from the requests that fell in the MEM_HIT category. These happen to be the most beneficial of the listed, from a Proxy efficiency point of view and rose from 4.2 and 2.3% on Thursday and Friday of W2.1 to 6.5 and 4.4% on Thursday and Friday of W2.2, around 50% increase on each day comparing on a week basis. P67/8

9 4 Conclusions Figure 7. Percentage of requests by Proxy Hit category per weekday for W2.1 and W2.2 This paper has presented a web workload characterization analysis made over more than 122M requests and 810GB of data transferred, during five measurement sessions (W1.1, W1.2, W1.3, W2.1 and W2.2) within a year. Below we summarize the main conclusions obtained from this work. Some remarkable workload characteristics observed are: Graphic files are the most common files in the Web, especially gif formatted, that are responsible of around half of the total accessed in the Web. Their small average size never exceeds 1.7 KB, which makes them not so relevant when considering volume of bytes transferred. File sizes present an enormous dispersion, shown by a Standard Deviation, which reaches their maximum value of 305.7KB in W3. These conclusions are consistent with previous research. The new trends observed during the analysed period are: There is an important increase in the use of the Web in only one year, 49% more requests and 77% more bytes transferred. The noticeable increase of requests for dynamic pages (64.1% higher) against a decrease in the demand of static pages, (6.3% lower), proofs that the new generation of Web applications is gaining presence. New standards for web page design and file formats are increasing presence, confirming that web applications and services are becoming more professional. These last conclusions confirm the evolution of the Web workload and remark the need of periodic analysis to better understand how their characteristics evolve. Regarding the analysis of the effects of 11M on the Web traffic, the most outstanding results are: The response times were longer on 11M, nearly tripling expected values (from 1000 to 1500 ms the previous week (W2.1) to a peak of nearly 3500ms on 11M). The efficiency of the Proxy Server was slightly higher on 11M (total fresh-cached hits rose from 5% on 11M up to 30% the day after). More work needs to be done to provide alternative mechanisms which palliates the service degradation observed on periods of time of unexpected high demand. P67/9

10 References [1] M. Arlitt and C. Williamson, ``Web Server Workload Characterization: The Search for Invariants'', Proceedings of the 1996 ACM SIGMETRICS Conference on the Measurement and Modeling of Computer Systems, Philadelphia, PA, pp , May 23-26, [2] Martin Arlitt, Rich Friedrich, and Tai Jin. Workload characterization of a Web proxy in a cable modem environment. Performance Evaluation Review, Vol. 27, No. 2. September [3] M. Arlitt and T. Jin, ``Workload Characterization of the 1998 World Cup Web Site'', IEEE Network, Vol. 14, No. 3, pp , May/June [4] P. Barford, A. Bestavros, A. Bradley, and M. E. Crovella. Changes in Web Client Access Patterns: Characteristics and Caching Implications. World Wide Web, Special Issue on Characterization and Performance Evaluation, Vol. 2, pp [5] T. Bernes-Lee, R. Fielding, H. Nielsen. RFC 1945; Hypertext transfer protocol, HTTP/ [6] Lee Breslau, Pei Cao, Li Fan, Graham Phillips and Scott Shenker. Web Caching and Zipf-like Distributions: Evidence and Implications. Proceedings of the Conference on Computer Communications (IEEE Infocom), (New York), March [7] E. Cohen and H. Kaplan. Refreshment policies for Web content caches. In Proceedings of the IEEE INFOCOM'01 Conference [8] Sally Floyd, Vern Paxson. Why we don t know How to Simulate the Internet. Proceedings of the 1997 Winter Simulation Conference. December [9] Iyengar, A.K., Squillante, M.S. and Zhang, L. Analysis and Characterization of Large-Scale Web Server Access Patterns and Performance. World Wide Web, vol. 2, pp [10] Ch. Kopparapu, Load Balancing Servers, Firewalls and Caches. Wiley [11] Lacort, J. A. A Proxy workload Characterization. Department of Computer Engineering (DISCA), Internal Report [12] M. Rabinovich, O. Spatscheck. Web Caching and Replication. Addison-Wesley [13] Squid. ( P67/10