With Web services becoming more prevalent in organizations, keeping tabs on performance, analyzing problems, and managing overall quality of service is as important as ever. One tool that provides a monitoring and analysis solution specifically for Web services is SIFT 1.5 by Service Integrity.

SIFT is designed to seamlessly integrate with existing Web services to provide extensive runtime statistics. At the time of this writing, the product was only available for applications built with Microsoft .NET; however, versions that will monitor Java Web services from various application-server vendors are now available.

Application Architecture
There are three main components to the SIFT application: Application Modules, Stream Analyzer, and Stream Sensors. The Application Modules provide administrators with a GUI interface to collect, manipulate, and analyze a wealth of performance-related data for all available services. The Stream Analyzer inspects XML data on the wire as it passes from client to server. Finally, the Stream Sensors are components installed into IIS (and other application servers as future versions are completed) that intercept data necessary for the SIFT application.

Using SIFT
SIFT installation is straightforward and easy. SIFT requires Microsoft Windows 2000 SP3 or Windows XP Pro SP1 or higher, 128 Mb of RAM, 10 or more Mb of hard disk space for logging, the .NET Framework 1.0 SP2, IIS with ASP.NET support, and the Visual J# Redistributable package 1.0. For the server side, the installation procedure creates a new Web service on the host machine that the SIFT GUI communicates with. This service hooks into IIS to collect runtime statistics on all services running on the machine. The client install provides the SIFT Console for administrators to perform all analytical and monitoring tasks. It should be noted that the console need not reside on the machine that is being monitored.

Setting Up
When the SIFT Console is launched, the user is presented with an option to add remote servers to monitor. Once a server address is provided, a list of available Web Services is presented. Any number of services may be selected for monitoring. For this review, I've created a simple Web service to be monitored that displays summary info and line item data in a basic financial ledger.

Figure 1 shows the Services Group of the SIFT Console that displays all configured host machines. Under each machine, the list of services to be monitored is shown and the rules for generating the logs may be edited.

Logging rules define the file size, rollover frequency, and archiving constraints; and the fields to be captured. In addition to the set of fields provided by SIFT, custom field specific to the services monitored may be added. For example, if an error condition is encountered in business logic, an application-specific error message might be sent to the calling client. A custom field may be defined in SIFT to locate elements within generated error messages to track the frequency of the business error. Once the services to be monitored and all logging rules have been set up, SIFT is ready to go in its default state.

Collecting Data
The Dashboard group in the SIFT Console provides graphing capabilities for viewing archived and real-time performance information. By default, SIFT monitors a host's average response time, the amount of traffic, and the total operations for all hosts. Graphs and charts may be organized into individual dashboards to group related information cleanly.

Custom graphs provide greater insight into the executing services. SIFT provides a wizard interface to construct graphs from any of the logging fields configured in the Services group. Data may be presented in either a time-based or metric versus metric graph. Time-based graphs present data as a line chart while metric versus metric graphs may be line charts, pie charts or bar graphs (see Figure 2).

Within each chart, up to eight series may be created, each assigned to a unique variable in the log file. In the metrics versus metrics charts, data represented by each variable may be aggregated using a standard set of functions including Sum, Average, Count, Maximum, Minimum, and Standard Deviation. Data may be further focused by adding filters to the values in the log fields graphed. Values may be constrained by the top 10 or top 25, or a Regular Expression; or they may be broken up into numeric ranges to produce a histogram. Once the charts are set up, they may be toggled to collect live data at a configurable interval or to look at a set of frozen historical data.

Reporting and Analysis
SIFT provides three types of reports that may be generated for statistical analysis: