Re: [Openinteract-help] Bulk SPOPS security checks?

[Teemu <te...@io...>]

Dear Andreas,

> we use a cluster of two dual athlon servers for the webservers ( which
> do loadleveling), with one large mysql for most databases, but also a
> Netware cluster for LDAP and fileservices ( the HTML and perl files are
> pulled in via NFS ) and a few oracle and ms-sql databases. This serves
> up 1000 Intranet users. But this is not a regular internet website type
> of usage, but at least 200 users are using this as their main callcenter
> application, so the OI applications are rather heavy weight.

Ok, good to hear. I was thinking about a three web server cluster connected 
with a 1GB lan together, where server 1 operates as a lightweight reverse 
proxy / static webserver / buffer for dynamic content, server 2 with lots of 
memory serving dynamic content from the OI backend and server 3 as the mysql 
database server with fast IO access. If I need load balancing I could add 
more servers that generate dynamic content. 

I'm going to run several these kind of setups serving each up to 3000 users.

> Remember the most important tuning rule here: keep your systems from
> swapping ! ( under Linux install sysstat package, have sac runnig and
> use sar -r, here you should never see more then a few % of swapping. If
> you really want to make it fast, keep the system from swapping more than
> 1 % constantly - 30/40 % constant swapping is already overkill ! )

Good to know. I was also thinking about using a fast journaling filesystem for 
databases and cache. Also there are performance reasons why to use the 
reverse proxy strategy described above.

> You should not worry about this ! ( If you are not using a 486-SX 25 MHz
> ;-) )

More like 2.6 GHz P4 =) The speed problems I have had so far are about SPOPS 
security checking when fetching lots of data and from several different 
tables. Turning off object security and using handler security instead sure 
speeds things a lot.

> Since I am curious: what type of app are you thinking about ?

What I have built so far is a school (student) management system. Some 
screenshots here (shots in finnish, sorry): http://www.mimerdesk.org/RX/oi/

The next application I'm building at the moment is a collaborative learning 
environment. You could compare such systems to groupware solutions to get an 
idea how heavy the application will be.

These applications will be available under the GPL once we have the first 
public versions ready.

Special technical details are the XHTML interface with complete layout control 
through CSS and modified OI themes. The templates we created for the XHTML 
are very generic and allow object oriented approach to web interface design 
(especially useful with some programmers who don't understand how to create 
good user interfaces =) ). We have built an object oriented "Tool" library 
which in the end outputs data structures to be passed for template toolkit, 
which produces the resulting XHTML pages. The system allows creating web 
pages through an object oriented interface similar to Tk/GTK etc. you use to 
build desktop applications. No HTML or anything involved in creating the 
interface.

The benefit in the above example (see link) is that we didn't have to write 
templates for any of the applications we created. We programmers used the 
code to generate tools, the designers optimized the presentation. Everything 
looks uniform. Once we had the interface framework ready we didn't have to 
control layout at all or touch the templates. It was pretty nice to write a 
new application and when you call $R->template->handler that's it. No 
presentation to worry about.

The disadvantage was that the number of TT templates used on each page was 
relatively big (average was something like 100), so generating the page had a 
slight performance hit despite the TT precompiling abilities. We decided to 
heavily use OI page caching features. Still miss the ability to clear cache 
for a different handler output.

Another thing we are working on is a localization system that allows 
translations to be stored separately. We probably use the standard unix 
gettext and .po files for translations and hook that into OpenInteract.

-- 
Sincerely,

Teemu Arina

Ionstream Oy / Dicole
Komeetankuja 4 A
02210 Espoo
FINLAND
Tel: +358-(0)50 - 555 7636
http://www.dicole.fi
http://www.palaveriaika.com