A recent study of Web servers in the Fortune 500 caused a stir in the Apache community, as a Windows NT magazine attempted to argue that Fortune 500 usage of Microsoft IIS was overwhelming. Matthew Keller does some investigating and explains what the numbers really mean.
I was minding my own business, checking my snail mail at the office, when
all of a sudden I was assaulted: "IIS Most Used Web Server Among Fortune
500 Sites" slapped me upside the head like a two-liter shot of Mountain
Dew. For those of you who haven't read the cover story of Volume 5 Number 10 of
ENT or seen the
their website--go do that first, and then come back.
After recovering from what I though must have been wrong, biased marketing
research, I set out to prove ENT wrong.
I wrote a small Perl script that went to Fortune's Web site, pulled out the list of
Fortune 500 companies, extracted their "brochure site" address, and
then polled that address with an HTTP HEAD request. This returns the
HTTP server string, along with some other information. The same script then
used nmap to ascertain the operating
system. After the script was finished, it compared the results I just collected
with what Netcraft had listed for both
server and operating system.
After looking through the results and then manually inspecting some of the
sites, I noticed that Netcraft's method of ascertaining
the operating system was much more accurate than nmap, most of the time, so I
merged their OS data with mine.
After all of this happy automation, I decided to go one step further and
actually look at the Web sites--yes, all 500 of them. You find out some
interesting things when looking at all those pages. For example, when you go to
K-Mart's homepage at www.kmart.com (running
IIS4 on Windows), you get automatically redirected to
Netscape-Enterprise 3.6 on Solaris). Another neat factoid is that, in my
opinion, Berkshire Hathaway
gets the "Least Impressive Web Site of the Fortune 500" award. All
funny business aside, the results were astounding.
I set about this study with a mission: To objectively collect data on the
"brochure sites" of the Fortune 500. My secondary objective, of
course, was to disprove the ENT study. My results were almost identical to
theirs, however. If you look at the entire Fortune 500, from
General Motors all the way to
ReliaStar Financial, IIS reigns king.
If you, however, look at subsets of the Fortune 500 and the types of companies
represented, the picture is much different. Netscape Enterprise Server
dominates until the Fortune 300 is looked at as an aggragate, where both
Netscape and Microsoft share 41 percent of the market. This information was
embedded in the ENT article as well.
So far, I haven't really told you much more than the ENT article, so let's
start analyzing this information.
When I look through the Who's Who of IIS users in the Fortune 500, one thing
strikes me: These companies are not, by in large, technology companies. They
are retailers, department-store chains, auto manufacturers, grocers, drug
stores--big companies that aren't in the technology field. Sure, there are
exceptions (Microsoft, Compaq, Intel, Dell, Gateway, Qwest, and a few others
all rely on IIS) but in general I'm seeing JC Penney's, Quaker Oats,
Sherwin-Williams: companies that probably are using IIS simply because it's
included with NT and doesn't require a "UNIX freak" to administer.
Before you go jumping to conclusions, let me explain how I came to this
Looking at all of the Web servers being used by these companies, only four
different Web servers are being used on a Windows operating system (IIS,
Netscape-Enterprise, Lotus-Domino, and Website Pro); out of these, Lotus-Domino
is being used on five Windows boxes, Netscape-Enterprise is being used on 10
Windows boxes, and WebSitePro is being used on three Windows boxes. Quite
obviously people who are running some flavor of Windows as their Web server
don't bother changing. I suppose the argument could be made that these
companies are conciously buying Windows + IIS, but I doubt that you can
convince me that the majority of these companies are basing their IIS usage on
anything but price, availability, and ease of administration. IIS is free for
NT/2000 Servers, installed with the OS (unless you opt out), and painless to
administer for trivial Web sites.
Windows 2000 use in the Fortune 500 is pretty minimal. Only two companies in
the Fortune 100 are running it, and one of them is Microsoft! Only 12 Fortune
500 companies seem to have adopted the Win2000/IIS5 pair at this point.
Microsoft-IIS had 20 percent of the Fortune 25, 22 percent of the Fortune
100, 35 percent of the Fortune 200, and 41 percent of the Fortune 300, 400 and
Netscape-Enterprise comes in a close second for the "Platform
Diversity of the Fortune 500" award (second to Apache). Solaris is the
most popular OS to run Netscape-Enterprise on, but AIX and HP-UX make up a good
number as well as the scattered Windows users. SunOS4, Tru64 and IRIX also
padded the diversity of Netscape-Enterprise.
When I look through the Who's Who of Netscape-Enterprise users in the
Fortune 500, two things strike me: These companies tend to be high-tech and/or
high-finance--companies like Boeing, Aetna, Goldman Sachs, Prudential, MCI
Worldcom, AT&T, Bell Atlantic, and Charles Schwab, who need scalability and
solid security. Let's face it, IIS doesn't run on a 36-processor Solaris server
like Netscape-Enterprise does (Apache does too, and Apache 2 will be magnitudes
better). Go ahead and tell FedEx and UPS, who have two of the busiest
e-commerce applications in the Fortune 500, that they can only run on up to
four processors--ha! Netscape-Enterprise is well-designed, very threaded, and
therefore very scalable.
Netscape-Enterprise had 64 percent of the Fortune 25, 63 percent of the
Fortune 100, 47 percent of the Fortune 200, 41 percent of the Fortune 300, 37
percent of the Fortune 400, and finished at 35 percent of the Fortune 500.
Apache Web server use, including Stronghold, a commercial secure Web server
built on Apache, cleanly won the "Platform Diversity of the Fortune
500" award with at least 10 different operating systems being used.
There doesn't seem to be a pattern to Apache users. A lot of the companies
are service-oriented, such as CBS, Sysco, Cendant, and ADP. But there are also
some product companies like Oracle, Apple, Hewlett-Packard, and Maytag. Several
financial heavyweights also rely on either Stronghold or mod_ssl, such as
Allmerica Financial, MBNA, and SouthTrust Corp.
Apache also has the capability of reporting what major modules are being
used in the server string, and although a lot of sites chose not to disclose
this information, some did. Mod_php was the most popular reported module at 19,
followed by mod_perl with 11, and a tie between mod_ssl and Stronghold (yes, I
know Stonghold isn't a module) at eight. Covalent's Raven SSL module was
reported on one server. Other modules and Apache projects used included
ApacheJserv, Tomcat, mod_frontpage, mod_fastcgi, mod_oas, and other proprietary
modules used by CBS, Oracle, and others.
Apache had 8 percent of the Fortune 25, 12 percent of Fortune 100, 10
percent of the Fortune 200, 12 percent of the Fortune 300, 14 percent of the
Fortune 400, and finally 15 percent of the Fortune 500.
Based on the trends shown in the accompanying figure, it looks like
Microsoft's IIS cuts in on the iPlanet Web server, while Apache and everyone
else are acting as minor detractors in the heavyweight slugfest. Before you
criticize this graph for not properly presenting the data, let me just make it
clear that the jump from "Top 25" to "Top 100" is only
representing the change in 75 servers, as opposed to the 100 servers that all
of the other points represent, and is only shown for comparison purposes.
There are many flaws in both my study and the ENT study. Neither of our
studies looked at a more global picture and are both very narrow in scope. Here
are just a few of the major holes to keep in mind when reading this data.
The most glaring hole in our research is one of numbers: Polling all of the
www.companyname.com sites is only a small fraction of all of the Web
servers being used by an organization. For example, although www.apple.com has
MacOSX running Apache in their pool, www.mac.com, itools.mac.com, and others
(also owned by Apple) are running Netscape-Enterprise on BSD/OS almost
exclusively. Compaq's brochure site at www.compaq.com may be running Windows
and IIS4, but they've got a whole slew of Tru64 servers running
Marketing Engine vs. Real Workhorse
Another hole in this research is one of politics. I don't know how many
times I've had a client call me and say, "Jim in Marketing says we need a
Web site, how much will that cost?" I always roll my eyes at these calls
because I know what "Jim" is going to want for a Web server is
Windows and IIS. Why? Because he has Windows on his desk, so there is virtually
no learning curve. A lot of so-called "brochure sites" are
commissioned, if not run, buy marketing personnel who don't necessarilly make
choices based on performance or scalability, but rather on convenience. Don't
get me wrong, I know plenty of technology-savvy marketing people; my only point
is that the decision of OS and Server software for Web sites can sometimes be
made by less-than- knowledgeable people.
Another point to look at is purpose. As I mentioned in my last
"flaw," not every company is looking for a real workhorse when they
get a Web server. Some companies just want to set up a Web presence and let the
marketing people have fun and perhaps draw a few more customers and make a few
more dollars--they aren't big e-commerce giants or depend on their Web site to
make them money in any way other than marketing. These companies will look for
ease-of-administration above performance, and even above cost most of the time.
Another area this study does not look at is traffic. High-traffic
powerhouses like FedEx, UPS, Yahoo, Netscape, and AOL have a lot at stake when
they pick a Web server and operating system. Yahoo! needs to be able to respond
to a user's search request as fast as possible, while also responding to
hundreds of thousands of other requests at the same time. Their needs and wants
for a Web server is much different than some company that doesn't get all that
much traffic. Even a Fortune 500 company may not get a lot of traffic on their
"brochure" site. For example, Berkshire Hathaway's website probably
gets a fraction of the traffic that some of the Web sites of companies they own
get, such as Geico Insurance or Dexter Shoes.
I may not have forced crow down the gullets of the ENT researchers, but
hopefully I've provided a rounder look at the facts surrounding this study.
Apache is, bar none, the King of the Web server according to numerous studies,
with both IIS and iPlanet staring ahead with drool.
My Humble Opinions
My Web server of choice for most purposes still is the Apache Web server,
and that opinion will only be strengthened as the thread-aware Apache 2.0
matures into a production-grade product in the not too distant future.
The incredibly scalable iPlanet product (Netscape-Enterprise) is my most
highly recommended Web server for high-traffic sites, or for sites that have
heavy loads to process and need to run on an 8-, 16-, 36- or even 64-processor
Although I'm not too fond of IIS, it is incredibly ease to administer and
retains some degree of my respect (and thusly recommendations) in environments
that need this ease, or have specific applications they need or want to run,
that require COM or other Windows-centric models or tools. IIS works well in
high-traffic areas in a load-balance pool, such as Microsoft's, but still
flails helplessly on enterprise-level servers.
This microcosmic study was quite time-consuming and required quite a bit of
horsepower. I would love to see someone "fix" some of the flaws I
mentioned above--poll the domains of Fortune 500 companies, find their Web
servers, catalog all of them, and make some more pretty graphs for us to look
at. I would be more than happy to share all of my data in pretty much any
format (Quattro, Excel, StarOffice, tab-delimited text, etc) to anyone who is
interested in either replicating this study or going further with it.