Slashdot Mirror
The Setup Behind Microsoft.com
Toreo asesino writes "Jeff Alexander gives an insight into how Microsoft runs its main sites. Interesting details include having no firewall, having to manage 650 GB of IIS logs every day, and the use of their yet unreleased Windows Server 2008 in a production environment.
is have some crazy sys admins throw chairs around.
"Windows Server 2008 in a production environment."
So even MS has given up on Vista.
My karma is in a nose dive
No firewall? Of course not!
Microsoft servers are notorious for their invulnerability.
[I can picture a world without war, without hate. I can picture us attacking that world, because they'd never expect it]
My blog
Nuke Gay Whales for Jesus.
They run AV when they can? No firewalls? It's like a 1960s flashback!
...I am guessing they do not use an Apache Cluster :)
- Sig
How can anyone complain that they're running Server 2008? My company's software quality dropped considerably when we stopped eating our own dogfood two years ago. When techs, engineers and everyone else is stuck with the same problems as the future ell-users, shit gets fixed a lot faster and a lot better.
If they don't have firewalls, then I have a definition of a firewall wrong.
...
look:
In terms of how we protect the sites, we utilize (starting at the outside edge of the network and working in):
1.
Cisco Guards for DoS detection and automated response
2.
Router ACLs are in place to block unnecessary ports
liqbase
FTA: "Router ACLs are in place to block unnecessary ports" While that might not provide SPI and other benefits of a true firewall, it's still a hell of a lot different than plugging a box into a wide open connection.
Cisco Router: ~$700
Server to run it on: ~$2000
Beta testing Microsofts new server 2008 in a production environment: Priceless
Curiosity was framed, Ignorance killed the cat.
Its like they change the URLs weekly.
I wonder if its on purpose (to avoid bookmarking) or just bad design.
"In terms of how we protect the sites, we utilize (starting at the outside edge of the network and working in):
..."
1. Cisco Guards for DoS detection and automated response
2. Router ACLs are in place to block unnecessary ports
That's what a firewall does... and the funniest thing that this guy doesn't know the definition of a firewall.
Read and Comment at my BLOG
!!!
What is HBI? A quick search found the following unrelated and unhelpful information:
HBI Health and Biomedical Information
HBI Healthcare Building Ideas (magazine)
HBI Home Builders Institute
HBI Home Business Institute
HBI Horizontal Blanking Interval (television)
HBI Hot Beef Injection (band)
HBI Hot Briquetted Iron (plant or facility)
HBI Hubbard Broadcasting Inc.
Wikipedia: Page does not exist.
I once had a 800MB plain-text logfile that I wanted to do a simple search and replace. I opened up the file in Word on a P4-2Ghz-2GB system and it took over two hours to complete roughly 50% of the task at hand. At this point I finally gave up because I was worried what was being done to my file and copied the file to an old PIII/450MHZ/512mb running linux and the task took about 2 seconds using a simple regex with sed.
HBI?
GFS (is the G for "Ghost")?
NBI?
NLB?
ACE?
TIA
At this point we still don't use firewalls for MS.COM sites and don't have any plans on the books to put them in place. Here is the short answer as to why:
1. We run Linux.
Summation 2
I vaguely recall MSFT had to outsource load balancing to Akamai which used Linux boxes to redistribute the incoming traffic at some point in the past. Looking at Netcraft.com, it shows some subdomains of microsoft.com resolved to Linux boxes before the year 2000. So it is able to get out of the sandbox now? Is that the main story?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Let's set aside the natural urge to bash MS into oblivion. Let's (just for now) ignore conventional advice about network security and firewall use. Now, not only are these guys a Microsoft shop...they ARE Microsoft. MS claims their software is stable and secure. Perhaps it is -- when was the last time microsoft.com was taken down by malevolent hackers?
That said, with their closed source and closed-doors policy to revealing details about the inner workings of the OS, _Microsoft_ may be the only company that can successfully deploy a 100% Microsoft powered solution. How many registry changes, service daemon modifications, and other tweaks have been made to get their config running this way? The world may never know. It's probably impossible for the consumer world to ever have that level on knowledge about the Windows environment, and thus run it at peak security levels. For most consumers and businesses, a Linux OS with properly implemented firewalls is much more secure than an out-of-the-box Windows deployment and router ACLs.
khasim (12/9/06): In a blind taste test, more people preferred Coke over the Pepsi that I had previously pissed in.
Comment removed based on user account deletion
SUREURCORRECT!
... !?
2. Router ACLs are in place to block unnecessary ports
Right-o ! Shows what a brainwashed, single-minded dim he is. Doesn't say "(Microsoft) Firewall v.0.38.2a" on the shrink-wrapped package; and voilà, isn't (a firewall). That's how they keep the masses unwashed and in admiration. (But I digress.)
Actually, the whole thing is a disgrace, but what to expect
2. We have ~650GB/day of IIS logs [...] Just IIS logs are a challenge without trying to parse another ~650GB of firewall logs.
Why is an IIS log size just as large as a firewall log ? Makes me wonder, if he thinks they were the same ??
650GB of what ? ASCII text or gzip ?
3. 5+ years ago, there wasn't a firewall solution that would scale to our needs and this forced us to focus on network, host, and application security.
I'd never would want their stuff for free even. Because the use of the word 'forced' is absolutely wrong. Program security is the alpha and omega of security; and anyone who wants to have his software taken seriously would look into exactly these. Not into firewalls.
5. Application security is critical since a firewall is likely going to allow traffic on the correct port and protocol through to the web servers so IIS/ASP.NET/Applications must deal with these requests gracefully.
This is so right, see above. But the mentality implies he is unaware of the fact that predictable and graceful behaviour is what we want in the applications in the first place.
6. We do run AV on our servers when we can. At times product adoption means we don't install it, but we do normally run AV.
Makes one wonder what this is supposed to tell us. At times they don't get an AV running on their own boxen ? Can someone point out to me, which logic underpins non-usage of AV for 'product adoption' ? Like, on those boxen containing Vista ?
they used MS Excel...right
don't forget the whole slough of Linux servers that they use through Akamai to handle the bandwidth;
it's one reason why why doing a lookup on Microsoft servers, it often shows that they are running Linux. It's also another reason why people point out that Linux is more scalable because even Microsoft can't eat it's own dogfood.
Nice setup but what about root passwords?
1. The asshat highlights they use no firewall, and yet buried deeper in the article is this "Router ACLs are in place to block unnecessary ports" That's the functional equivalent of a firewall.
2. I get into discussions where tech guys spew traffic numbers and I'm never impressed. It creates issues if you want to actually do something with the data which I doubt they do much beyond running the usual marketing metrics. Until you actually shoot for 99.99 service uptime, you begin to comprehend the challenge it is (on any platform) the traffic itself is not the challenge.
3. I'm very interested in reading what their hardware budget is like. I get excellent performance out of Linux compared to server 2003 boxes on similar compaq dl380's.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Now there's a best practice that other corporations should follow - the use of test software in a production environment.
Cisco Guards for DoS detection and automated response In other words, they don't use firewalling where you have administrator defined rules to control traffic flow, they use networking equipment that accept administrator defined rules to control traffic flow
What in the world do *you* perceive the difference being between a 'firewall' and a router blocking ports based on source and destination being compared with a set of rules (aka ACLs)? Generally, firewall rules *can* get more complex than that, but mere port blocking by an intermediate router has been considered a firewall, even if it doesn't log violating or accepted packets, even if it doesn't have complex rules about connection state. Even if it doesn't have the word 'firewall' emblazened on the chassis somewhere.
XML is like violence. If it doesn't solve the problem, use more.
FTA
... Windows and IIS...rock solid and secure! www.microsoft.com is on Windows Server 2008/IIS7, MSDN/TechNet are migrating to Win2k8/IIS7, and update.microsoft.com is on Windows Server 2003/IIS6. ...
;}
|In terms of how we protect the sites, we utilize (starting at the outside edge of the network and working in):
So there you have it. I think this is a good insight into how we run our own internet properties today. What do you think? Have you got any feedback for the boys over at our MSCOM Operations team?|
3 Free Tips, the rest I charge for:
1st don't advertise your networks security especial from the outside - in.
2nd don't believe your own propaganda on rock solid. There are too many issues in it to be rock solid.
3rd don't state your future migration plans on secure architectures to the public.
Cheers
--- Just because you go hunting doesn't mean you have to shoot yourself in the foot ---
port filtering is just one property of a firewall, that alone does not constitute a firewall
In order to apply the 'ACLs' they describe, they *have* to inspect the packets, by definition. They may only compare a relatively small number of fields (src ip, dst ip, make sure it is a TCP packet *and* the destination port is 80). They might not make use of any logging or stateful inspection (then again, stateful may add next to nothing, so long as they don't need to contact external servers for any updates), but that doesn't mean they can get away with saying 'look, no firewall!' All he's saying is that port 80 (and maybe a few other hand selected ones) are 'wide open' (except something else blocks DoS for them even on those ports). Honestly, I doubt you'll find many public web services that puts a more restrictive 'firewall' than MS just confessed to having in an article where they declare 'no firewall!'
XML is like violence. If it doesn't solve the problem, use more.
They *do* have a firewall, or at least nmap says so:
# nmap -p22 www.microsoft.com
Starting Nmap 4.20 ( http://insecure.org/ ) at 2007-12-13 09:26 PST
Warning: Hostname www.microsoft.com resolves to 4 IPs. Using 207.46.193.254.
Interesting ports on wwwtk2test2.microsoft.com (207.46.193.254):
PORT STATE SERVICE
22/tcp filtered ssh
Nmap finished: 1 IP address (1 host up) scanned in 0.458 seconds
See? It says filtered, not closed. The packet was dropped.
port filtering is just one property of a firewall, that alone does not constitute a firewall
Let's not get into a game of semantics abuse.
The author boldly states they use no firewall which leads one to believe they gave the machines a public IP address with no other protection. And then buried in the story is the method by which they protect the servers.
The author has undeniably mislead readers. Because of Microsoft's long history of misleading practically everyone at one time or another to meet their end goals, it is reasonable to assume this was intentional.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
"Isn't that just you announcing your ignorant of which tools to use?"
What tools would you use to do the same job?
Re:Microsoft and logs do not compute (Score:5, Interesting)
davecb5620@gmail.com
This isn't news. It's an advert.
No, you're reading too much into it.
If someone were to say that they have a firewall on their linux box by cutting off port 25, would that be considered a firewall? No, you naturally would want not only port filtering, but also IP filtering with default-deny or default-allow rules to also be in place. Simply blocking ports does not constitute a firewall.
I have to say it sounds initially like they just stick the machines out there and let them fend for themselves. Then you read on and find that Microsoft can't live on the web without surrounding their servers by a ring of *nix devices providing Packet Filtering.
They don't trust even Win2k8 servers to be secure enough without the *nix safety blanket.
Once I was a four stone apology. Now I am two separate gorillas.
Karma: Frotzed (mostly due to the Frobozz Magic Karma Company)
Two points you and the other fanboys are missing: (1) there IS no text editor for "a simple find and replace" in a default micro$oft system, and (2) full featured text editors in Linux do NOT load the whole file in memory before opening it.
Idiots. Typical micro$oft shills.
I heard that Back In The days, Microsoft were using FreeBSD for their outward-facing servers, hacked-up to look exactly like Windows NT (for that was the product they were selling at the time).
Why is an IIS log size just as large as a firewall log ?
Probably because 99+% of the entries would be functionally identical, or present on the firewall but not the web server?
- Putting firewalls in front of a dedicated web server farm is going to mean your logs are going to contain nearly the same number of entries. The firewall will log an incoming connection, then the web server will log that same connection if it's allowed. The firewall will end up with *more* entries because of the connection attempts that it is blocking.
- The logging configuration for the web server and the firewall are going to be pretty similar. You are going to want to see source IP, source DNS name, date/time, source port. On the firewall you'll want things like destination IP and port and the rule that blocked/allowed the traffic. On the web server you'll want the requested URL and HTTP status.
It's all going to end up in a database anyway, because running grep or whatever repeatedly against 4.5TB of text files just to analyze last week's traffic would get old pretty quickly. So minor differences in size of data are probably going to be nullified by having to use relatively wide varchar fields for things like the source DNS name.
"...always new atoms but always doing the same dance, remembering what the dance was yesterday." -Richard Feynman
I agree that eating your own dog food is good.
But when you serve it in *production* environments, especially external environments, it's not dog food. It's "using your users as Beta testers without their permission or knowledge". Production environments need to be on the conservative side since any critical flaw will affect your unwitting users, which is why people gravitate towards "the stable but old enterprise versions" of RedHat, Novell, Debian, Solaris, and Microsoft Windows rather than the "cutting edge but occasionally problematic but you can 95% of the time recover without too much pain" newer versions.
Failure to do so is either banking on the belief that your users either don't care about losing or corrupting their data or relying on a "hey we never promised that things actually works, be thankful that it does because legally you've let us have our way with you" EULA disclaimer.
Why is blocking of port 25 based on the port alone not a firewall? It fits well within the definition. Sure, firewalls can do much more complex operations, but that obviously isn't necessary in this circumstance.
We all know Microsoft's target audience is the PHB. They will race to the faulty assumption the OS security is bulletproof. A condition which is not knowable, nor very likely considering their long-time meme that "good security" = "good firewall"
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
"hacker tested" icons we see all over at various e-commerce sites then?
the intro is on the D, G and B strings, it's 7-7-7 then 10-7-7
the verses are
D-Bm 4 times, then Em-A-D (the even though you broke my heart and killed me part)
for the part between the verse and chorus (except the ones who are dead) hit B and hold
the chorus is F-C-B-F twice, then B-C-F-Em-Dm (the F-Em-Dm part is the 'you make a neat gun'), then B-A and repeat
I laughed my ass off when I beat it the first time, best video game ending EVER!
Every once in a while my Vista machine develops a little networking problem. I usually have to disable and re-enable the network card to bring it back. But, if I run Vista's network Diagnose & Repair first, a stupidity arises. It tries to ping www.microsoft.com, and when it fails, it complains. Why is it trying to ping www.microsoft.com? Www.microsoft.com does not reply to pings. Microsoft.com does (usually), but not www.microsoft.com. Www.microsoft.com resolves to lb1.www.ms.akadns.net, and IP addresses 207.46.19.190 and 207.46.192.254. A sample of the error message is bellow. [Window Title] Windows Network Diagnostics [Main Instruction] Cannot communicate with www.microsoft.com(207.46.192.254). [Content] Network diagnostics pinged the remote host but did not receive a response. [Reset the network adapter "Wireless Network Connection"] [Cancel] So, why on earth do they have the tool ping www.microsoft.com? Seems stupid to me.
The guy is clueless. All he wrote is that they use new version of IIS and Windows and nothing else. He does not have a clue on how it is all run. The OS they run is not important. I think the application stack is roughly equivalent to unix stuff. Despite the license fees which M$ doesn't have to pay.
:)
1. For what I understand they don't handle data that needs some audit trail in transactions and so on so they don't need firewall. I don't see any logic in his statement.
2. 650GB/day (of what exactly?) may seem a lot but in fact a quite regular database cluster and a proper design would handle that easily if it is well scaled.
3. He is probably just quoting somebody else. Maybe he is right here but it is hard to judge with no knowledge on how exactly does this setup use? And what he means as firewall is another mystery for me.
4. He is stating that some form of NLB made by MS in their web server architecture is bad since it makes normal network design complex and expensive. Is that what he is stating?
5. This point also makes no sense to me. Of course application security is essential since it has nothing to do with firewall. A firewall merely passes or not the traffic based on simple, low-level protocol parameters. Firewall does not protect against application flaws. Application flaws occur at very different level. He is even clueless about OSI model...
The rest is just bullshit about how it is cool to use untested software in production. Actually it is very uncool.
Also this "knowledge" of his is useless. I would love to see some insights on such large setups from somebody who is not M$ and actually did research and testing on which platform to use. Like Google for example.
And also how does microsoft.com compares to google.com? Which is bigger in means of traffic/application load/databases and so on?
News at 11.
Also, running AV software on a web server? What? I can't think of very many situations where that would be at all defensible.
The rest of the article reads like a marketing presentation. Very enterprise.
since the link requires you to logon, here's a version of which I believe to be a copy of the article: http://www.networkmirror.com/EVCMz0uDTZ3L1XPV/blogs.technet.com/jeffa36/archive/2007/12/13/microsoft-com-what-s-the-story.aspx.html/
Sure, that's all well and good for a public face but we all know they really use Xenix behind all that Windows dressing. ;-)
LoB
"Anyone who stands out in the middle of a road looks like roadkill to me." --Linus
Anyone have a link that actually works? The one in the article is out.
all you guys really have nothing better to do then pick apart and gripe at everything Microsoft? I'd like to see all you Linux fan-boys configure as complex an infrastructure with as much volume in site traffic as microsoft.com and still be able to have reliable and fast uptime. I think this speaks wonders for how innovative and thoroughly tested Server 2008 will be. Sure Microsoft has their fair share of bugs, and bad UI, but it just gets more complaints because everyone is using it - there's plenty of terrible Linux open-source, never will be out of beta, crap out there - and none of that gets this firestorm of bad attention, most likely cause it's never really used in such a popular environment. Or is it that you all really like being perpetually employed to fix Linux never-quite-done stuff?
The blog entry the story links to does not exist. Not Found: Forum Not Found The forum you requested does not exist.
Interestingly, I noticed that when pre-GUI disk checking occurs on Server 2008 it says "Windows Vista" at the top of the screen.
At least this is true with the version I'm testing - June 2007 CTP (Community Technology Preview). I expect in later versions this will be obscured.
"the use of their yet unreleased Windows Server 2008 in a production environment."
Now how stupid is that? What sys admin would use an unreleased OS in a production environment?
That's like Rule No. 1, isn't it?
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
The blog has been taken off public view, and only for those who have MS TechNET access. Before that, there were comments on lies & un explained abbreviations the dude used... /. word verification: bondage !!!
Mod points are a dangerous tool. Abuse them wisely.
Where does it say 'error logs'? I read 'IIS logs'.
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
I got to see some of the new stuff in Windows 2008 with one of the MS sales engineers, and I have to say, I'm impressed. Here's some of the stuff they did:
General:
This will be the last Windows Server that will have 32-bit installation available. With the popularity of x64 based Intel and AMD processors, and the proven reliability of WOW64, this shouldn't be a problem.
You may add/remove as many roles at a time, with a single reboot required after all the roles have been installed
You can bypass entering the product code on installation (Activation still requires the code though). Setup is no longer linear - you can pick and choose what you wish to configure.
Virtualization:
Virtualization has now become a feature of the OS, rather than a separate application installation. You can enable virtualization as a server role. When this happens, a thin layer acts as the interface between the virtual hosts and the hardware (marketing term: "Hypervisor"). The parent host OS then becomes a virtual image (that can't be moved). All hosts are treated as equals.
Virtualization requires the 64-bit edition of Server 2008 installed.
Virtual machines can now have memory spaces > 4 GB and have multiple cores
Virtual machines can run any Windows and some Linux variants are now supported (most likely all will run; MS will actually field support calls for the supported Linux variants).
Event Log
The event log is so much better that I can't begin to explain how much better is it. You truly have to see it. Here's some of the features:
Events displayed within each subsystems management screens. Ex: if I were to open IIS management, I would see a default screen with all the events that were generated by IIS, and none that were generated by other systems.
Events from all eventlogs (Application, Security, System, etc) can be displayed in one window
You are able to see events categorized by event severity, and grouped by time frame (ex: 1 critical event in the last hour, 3 in the last day, x in the last week).
You are able to push events to a central server from multiple server, or you can pull events from other servers to one (subscription)
You are able to execute applications or send emails when an event is fired. You set up criteria for that to happen (event ID, severity, text in body/subject, etc).
Management
The Computer Management MMC console has been replaced by the Server Management console. The Server Management console is automatically populated with links to the management windows for each installed role, thus making it the de-facto configuration window.
PowerShell is a new command line interface. It is a hybrid console/scripting environment, created to aid in systems management. You can manage either the local server or remote servers from it.
New Server 2008 Core Installation Option
Server core is an optional way to implement Windows 2008. It removes the GUI portion of the OS as well as a number of other features, thus reducing the attack surface of the OS.
Core is not a separate product; the Standard, Enterprise, and Datacenter editions can all be installed in Core mode
Managed with remote tools and command prompt (cmd)
5 available server roles
Included:
o DNS
o DHCP
o File sharing
o AD
o WSV - windows server virtualization
o Limited IIS - static content only
o Task manager
Not included:
o No GUI
Wow, Twitter. This is content-free, even by your low standards. I'll bet you were pissing yourself laughing as you posted this, though. Hey, whatever gets you through, right?
Windows Genuine Advantage Servers Out
http://it.slashdot.org/article.pl?sid=07/08/25/1819248
Nothing about a breakin though.
J
Here, fixed that for you: http://www.networkmirror.com/EVCMz0uDTZ3L1XPV/blogs.technet.com/jeffa36/archive/2007/12/13/microsoft-com-what-s-the-story.aspx.html Enjoy! :)
Um, you must be new here. Every /.er knows that IIS=>59L *
* ERROR_UNEXP_NET_ERR
Were you going to say something but instead decided to just flap in the wind?
The Bill of Oz?
But it's a setup
until you're fed up
If you use the definition given by Wikipedia of a firewall http://en.wikipedia.org/wiki/Firewall, you will notice that the first generation of firewalls were in fact packet filters. However, as with many words or phrases, definitions change over time. The definition commonly associated with a modern firewall is something more than a simple packet filter like an application layer firewall or stateful filter. For us Linux, Cisco or other old school IT guys, we still refer to a packet filter as a firewall. This person obviously has a more modern, Microsoft, way of thinking of a firewall. That does not give us the right to belittle him and say he does not know what he is talking about. They have a certain level of security, whether you want to call it a firewall or not is your choice. To be perfectly honest, a packet filter is not much with security these days. Most attacks are going to be directed to a certain port to exploit specific software vulnerabilities and these are the attacks that a packet filter cannot handle. A bigger security risk is the fact that they are using unproven software to run their production environment. I personally wouldn't use a new windows OS until, at least, service pack 1 in a production environment. It is always best to wait for software to be proven before it is allowed in a production environment (see Debian GNU/Linux).
Why am I being asked to log in before I read a fucking blog? I've tried both Firefox and Safari now, and both ask me to log in. Even going to the root blog URL redirects me to a login page.
What is humor if not pain tempered by time?
When I go to that link with the bugmenot login, I get:
Not Found: Forum Not Found
The forum you requested does not exist.
Was the article deleted?
I thought that was the reason Home only supported a single CPU, otherwise it has the power to be a server, so you need Pro.
Does anyone really know if Home now supports multiple core? It seams those laptops default to home, and home shows multiple CPU's. but it sure seams dual core laptops run much faster once upgraded to PRO, where as non duo core seamed little difference.
(could just be my imagination though.)
Windows XP Home Edition can and always had permitted just as many cores as Windows XP Professional. However, Windows XP Professional is allowed to have to physically separate processors, where as Windows XP Home may only have one. Microsoft claims that Windows XP Professional is "optimized for notebook computers", and implies that Home Edition is not. However, I have never noticed any difference in performance, though the Professional features such as remote desktop, EFS, and the ability to join a domain all make it worthwhile to get XP Pro.
Just as an aside, Windows XP Media Center Edition is actually the exact same in terms of features as Windows XP Professional, and thus can use up to two physical processors. The only difference is that Windows XP MCE can only be joined to a domain during setup or by using a special hack, and of course it has media center components that XP Pro does not have.
Read my blog: HansMast.com
Netcraft confirms it! Microsoft are running 2008, 2003, 2008, 2003, 2008...
We are currently unable to serve your request
We apologize, but an error occurred and your request could not be completed.
This error has been logged. If you have additional information that you believe may have caused this error please report the problem here.
We are currently unable to serve your request
We apologize, but an error occurred and your request could not be completed.
This error has been logged. If you have additional information that you believe may have caused this error please report the problem here.
when I try to go to their site:
"We are currently unable to serve your request
We apologize, but an error occurred and your request could not be completed.
This error has been logged. If you have additional information that you believe may have caused this error please report the problem here.
"
I think that gives a good demonstration of how they run their site...
Slashdotted. Oh, the many levels of delicious irony...
Ever used notepad with anything larger than a couple of hundred KB? Absolutely, unforgiveably, awfully slow.
Although I'll agree that Word is probably not the right tool for the job, I'd agree with the other posters that say that to do a job such as this, most of the standard MS-based tools are inadequate.
Disclaimer - I haven't used the Microsoft Logfile Parser which _may_ be better suited to this task, but I do a fair bit of work with large plain-text files in a Windows environment and usually end up using Programmers File Editor or Textpad.
If you've ever wondered how microsoft.com uses our technology then read on. I recently came across some good information from the folks over at the Operations team at Microsoft.com. The thread basically talks about how we use IIS, Firewalls and Windows Server 2008. I think as we come up to launch next year it's a really good and quick insight into what they do and how they do it. So enjoy the reading and let me know what you think..Pretend I've asked about how they protect our sites...
:).
At this point we still don't use firewalls for MS.COM sites and don't have any plans on the books to put them in place. Here is the short answer as to why:
1.
We don't handle HBI data so we don't have the need for external logging capabilities. If we did handle HBI, we'd have firewalls.
2.
We have ~650GB/day of IIS logs just for www.microsoft.com and update.microsoft.com (not including the 6GB/hour for each download server). Just IIS logs are a challenge without trying to parse another ~650GB of firewall logs.
3.
5+ years ago, there wasn't a firewall solution that would scale to our needs and this forced us to focus on network, host, and application security. Based on the success of that work, we've not looked further at firewalls even though there are solutions that I believe (haven't tested) would handled the traffic load (our non-download based web traffic alone can be in the 8-9 Gbps range and ~30 total for internal hosted traffic).
4.
We also used NLB for load balancing exclusively up until July 2006 and the micro segmentation of networks required by that solution made firewalls an expensive and very complex solution. Again, especially at the scalability that used to be available.
5.
Application security is critical since a firewall is likely going to allow traffic on the correct port and protocol through to the web servers so IIS/ASP.NET/Applications must deal with these requests gracefully. I realize there are other options/features of firewalls/IPS that provide other options.
In terms of how we protect the sites, we utilize (starting at the outside edge of the network and working in):
1.
Cisco Guards for DoS detection and automated response
2.
Router ACLs are in place to block unnecessary ports
3.
NetScalers for www.microsoft.com and MSDN/TechNet (NLB still for update.microsoft.com) and those also provide DoS protection inherently as well as providing a few other knobs we can turn when required.
4.
Windows and IIS...rock solid and secure! www.microsoft.com is on Windows Server 2008/IIS7, MSDN/TechNet are migrating to Win2k8/IIS7, and update.microsoft.com is on Windows Server 2003/IIS6. We do all the normal shut-off-unused-services practices that line up with MS published security guidance and we utilize GFS images to ensure standardized builds of systems.
5.
Automated Netmon/Perfmon captures for attack analysis on NLB systems when SYN floods occur (event trigger). We've not yet done this for NetScaler systems, but we are noodling on how in our copious spare time
6.
We do run AV on our servers when we can. At times product adoption means we don't install it, but we do normally run AV.
7.
Application security as mentioned. ACE is ver
We apologize, but an error occurred and your request could not be completed.
This error has been logged. If you have additional information that you believe may have caused this error please report the problem here.
The above is what I get when I try to RTFA. I guess that tells me all I need to know!
We apologize, but an error occurred and your request could not be completed.
This error has been logged. If you have additional information that you believe may have caused this error please report the problem here.
How appropriate seen articles subject.
Hah.
Hivemind harvest in progress..
The article seems to have been deleted -- everything else works, except it can't find that article. Google Cache works, though. http://209.85.173.104/search?q=cache:cZIWXV4A-GIJ:blogs.technet.com/jeffa36/archive/2007/12/13/microsoft-com-what-s-the-story.aspx+http://blogs.technet.com/jeffa36/archive/2007/12/13/microsoft-com-what-s-the-story.aspx&hl=en&ct=clnk&cd=1&gl=nz&client=firefox-a
on the second point at least partially, although I suspect the line count would be problematic - once you're going to that sort of volume for logfiles and have Office installed, it's probably time to look at brewing your own routines using VBA. Quick and dirty for the win.
;-)
Never heard of PrimalScript before - will check it out. Thanks for the mention.
N.B. Who else measures files in megabits? Weird