WebMelody: Sonification of Web servers

Maria Barra	Tania Cillo	Antonio De Santis
Umberto Ferraro Petrillo	Alberto Negro	Vittorio Scarano

Dipartimento di Informatica ed Applicazioni "R.M. Capocelli"
Università di Salerno, Baronissi (Salerno), Italy

WWW servers are growing in size, complexity and workload. HTTP requests are logged to large log files and, later, analyzed by the Webmaster so that the information can provide useful hints on tuning and/or malfunctioning in the WWW server. Monitoring a WWW server is, usually, an off-line activity. We argue that it is important to provide an effective, efficient way to monitor in real-time the behaviour of the server.

In this paper we present a novel technique and a distributed system, WebMelody, to monitor the behaviour of the WWW server by associating sounds to events describing the server activity. The sounds are carefully chosen so that they form a "natural" background music: music should not engage the listener and should not disturb his/her daily activities.

Sonification of WWW servers

Using nonspeech audio to convey information (or sonification), is particularly useful when there is an abudance of data to be considered. The "ticking" of Geiger counters and sonars is well known since decades as well as using sounds to enable blind scientists to examine experimental data via an auditory presentation [1] or to troubleshoot intermittent network connections [2].

WWW servers generate log files with information about each HTTP request and response. Many servers allow log data to be stored in a proprietary format (like Apache module mod_log_config) and proposals like the Extended Log File Format are studied [3] to add an extensible logging mechanism. These log files are huge (hundreds of megabytes) and the analysis is greatly helped by software programs that perform statistics on such huge amount of data, grouped by several criteria (time, location, Internet domain name, etc.). The analysis is made possible only with off-line tools (known as Log Analyzers) to present log data in a synthetic and coherent shape.

We propose to use sonification as a technique to monitor the correct functioning of the WWW server. At the same time, sonification can be an efficient solution to allow on-line monitoring of the large amount of log data that are available. The technique to use sounds to express and interpret (raw) data is non-obtrusive: the Webmaster can perceive the server behavior and execute other tasks at the same time. This information can quickly redirect the focus of the Webmaster to the problem whenever needed so that he can take appropriate actions.

Sonification allows to convey an interpretation of a large amount of data, since all requests are analyzed and, eventually, "played" in real-time. In this way, while monitoring the behaviour, the Webmaster can avoid to rely exclusively on off-line analysis of the log files that provide, indeed, accurate and entrusted statistics but that are not timely. Finally, sonification could join together the manyfold aspects of a Web server that one wants to monitor.

We envision several real-life situations where a real-time, and still non-completely absorbing, tool can help the Webmaster. By monitoring the WWW server behaviour via sonification the Webmaster can:

• early detect Denial of Service attacks;
• early determine that the server does not work;
• recognize load peaks and have some feeling about possible explanations of these;
• discern among the different types of requests: for example, determining where the requests come from, or discriminating accesses by different agents, etc.
• monitor accesses to restricted (by user authentication) directories;
• recognize the different error types and the HTTP method of the request.

WebMelody is not meant to substitute off-line analysis but is, instead, devoted to ideally complement log analyzers by giving the immediate perception to the Webmaster of what is going on. Then, if necessary, the Webmaster can study logfiles with the log analyzers to pinpoint problems and provide solutions.

One of our goals was to find an adequate musical representation of the behaviour of a WWW server, toward this end we provided sounds that go beyond the simple alarms, trying at the same time to offer an aestethic connotation to sounds that lay on the borderline between music and background noises. The result is a music that can be listened for a long time without diverting the user from the focus of his/her work. Our musical considerations are based on the experiences of this century in the field of the "applied music" such as Luigi Russolo (early XX century's futurism), Edgar Varese (1958) and (more recently) John Cage. In WebMelody we tried to avoid to configure harmonic-tonal fields as well as rithmic references that are potentionally able to attract the focus of the users by leveraging on their mnemonic and musical (personal) capabilities.

WebMelody: the architecture

WebMelody is a distributed, versatile (easily configurable) and portable system that allows monitoring of an Apache WWW server via sonification. The architecture of WebMelody consists of three components: the sonification Apache modules mod_musical_log and mod_counter, the Collector server and the WebPlayer application.

The sonification modules are inserted into an Apache WWW server and are responsible for sending data to the Collector upon arrival and serving of HTTP requests. These modules filter events as specified in the appropriate configuration directives of the Apache WWW server.

The Collector is a Java application that works as middle layer: it buffers the events provided by the Web server(s), parses them and can monitor load and throughput of the Web server as well as analyze the events that must be played only if a treshold is passed. Then, a message specifying the sounds to be played (for the next time period) is produced and then sent to the WebPlayer(s) that holds the MIDI sound files corresponding to each event. The architecture allows multiple WWW servers and multiple WebPlayers as well as heterogenous sources (other services) for events generation.

More details on WebMelody system with a full paper describing the architecture in greater detail and some demo can be found at the Project Home Page at http://isis.dia.unisa.it/SONIFICATION.

References

1. Lunney, D., Morrison, R.. "High technology laboratory aids for visually handicapped chemistry students". Journal of Chemistry Education 58, 228.
2. Mike Muuss Homepage at http://ftp.arl.mil/~mike/ping.html
3. P. Hallam-Baker, B. Behlendorf "Extended Log File Format" . World Wide Web Consortium Working Draft 960323. http://www.w3.org/pub/WWW/TR/WD-logfile.html
4. Apache project Web site: http://www.apache.org
5. Fielding, R., Gettys, J., Mogul, J. C., Masinter, L., Leach,P., and Berners-Lee, T. "Hypertext Transfer Protocol -- HTTP/1.1" . Network Working Group. RFC: 2616. June 1999.
6. Madhyastha, Tara M. and Reed, Daniel A. ``Data Sonification: Do You See What I Hear ``. IEEE Software, vol. 12 n. 2 pp. 46-56. 1995.
7. Will H. Scullin,Thomas T. Kwan, and Daniel A. Reed ``Real-time Visualization of World Wide Web Traffic``. Proc. of Symp. on Visualizing Time-Varying Data, Sept. 1995.