Learning Windows Server 2003

8.1. IIS Architecture

Because a picture is worth a thousand words, I'll start this section with a diagram (Figure 8-1) that shows the architecture and operation of IIS 6, and I'll describe the internal workings later in this section.

IIS begins with a listener, which detects requests for web services and pages; it's the foundation of IIS. The listener runs in kernel mode, meaning that it has more direct ties to the operating system than traditional programs running in user mode. This means requests are served much faster and much more efficiently.

When an HTTP request arrives at the HTTP Listener (HTTP.SYS, at the bottom of the figure), it verifies that the request is valid. If this check fails, the appropriate HTTP error and code number are sent back to the requester. If everything checks out, HTTP.SYS decides if it can handle the request from a cache of recently requested pages and operations. If the response is in the cache, HTTP.SYS sends the response immediately, without bothering any of the other parts of IIS. Otherwise, HTTP.SYS is forced to pass the request on, and places the request in a separate queue for each worker processessentially a separate copy of IIS's listener running independently of all the other serving program copies. The worker process programs are called W3WP.EXE, as shown in the three partitions above HTTP.SYS in Figure 8-1.

This begs the question of how these individual worker processes are started. If a copy of W3WP.EXE is not listening on the request queue, HTTP.SYS signals the Web Administration Service (WAS), the W3SVC, to start and configure a worker process.

The W3SVC controls all the worker processes, bringing them up and shutting them down as load demands. This procedure is based on the configuration information stored in XML format in a file called the metabase, which is controlled by an overarching process called INETINFO.EXE, shown to the very left in the above figure.

If a worker process or a group of worker processes (which Microsoft calls a web garden) is already started and connected to the request queue, the worker process pulls the request from the queue and processes it through any Internet Services Application Programming Interface (ISAPI) filter or extension and web application code. Then it returns the response to the HTTP.SYS and the requester.

The W3SVC also monitors the health of a worker process. For example, if a particular process does not respond or has exceeded some threshold, such as the number of hours running or number of requests handled, W3SVC coordinates with HTTP.SYS to hold requests in the queue while W3SVC stops the worker process and attempts to start it again.

But what does all this mean to the end user? After all, your customers measure how well you run your Internet business based on the speed of your web site. This structure of IIS also pushes the product to near the current limits of speed as far as a web server is concerned, according to the independent testing firm VeriTest . IIS 6 significantly overtakes Apache, the most popular web server at the time of this writing, as far as performance is concerned in both dynamic and static web serving, much to the chagrin of the open source community. To understand this, take a step backward and see how IIS 5 serviced requests: a single user process, called inetinfo.exe, took care of HTTP requests and acted as the traffic director, sending the requests on to worker processes using dllhost.exe. One problem was that inetinfo.exe operated in user mode rather than kernel mode, which made serving a lot slower just by virtue of where the process was residing in the OS architecture. Contrast this with IIS 6 in Windows Server 2003, which transfers responsibility for directing HTTP requests from a user mode process to a kernel mode driver. The speed increase just as a result of this move is remarkable, mainly because it can interact with the hardware at a lower, more direct level, listening for HTTP requests before Windows has to funnel them up to user mode.

Another big benefit is the interoperability of IIS with the underlying operating system and with Active Directory. You get seamless integration of all components, meaning administration is simpler (you're used to the same interfaces) and user data and information can be shared among all the pieces of your infrastructure.