The tests that did not immediately pass were:

Request validation: Fail

OK so we find <pages validateRequest="false" … in web.config.

But we are assured this is deliberate and acceptable in mojoPortal because, as Joe Audette explained,

validateRequest is false because we do our own validation of inputs and setting it to true causes problems/errors when posting back html content from a wysiwyg editor.

Excessive headers: Warning

So our IIS server and site are revealing several pieces of information about the technologies behind the site, and we are better concealing these http headers.

Specifically we have:

• Server which can be turned off with URLscan by setting RemoveServerHeader=1 in UrlScan.ini (there are other ways, but this is by far the simplest).
• X-Powered-By which can be turned off in IIS Manager: select the web site, then open HTTP Response Headers and remove this one.
• X-AspNet-Version which can be suppressed by adding this attribute to the httpRuntime setting in web.config: <httpRuntime … enableVersionHeader="false" />

Secure cookies: Fail

In line with the mojoPortal documentation on SSL we already had the attribute in bold:

<forms name=".mysitecookiename" protection="All" timeout="50000000" path="/" cookieless="UseCookies" requireSSL="true" />

but we were still failing the test until we also added this into the system.web section:

<httpCookies httpOnlyCookies="true" requireSSL="true" />

Joe Audette said:

Adding the <httpCookies element as you have just means that any other cookies issued for the web site would also be kept secure, but as far as I know any other cookies we are creating are only for cosmetic purposes such as the one to toggle the collapse state of the admin toolbar etc.

So I think we were secure anyway, but it’s nice to pass the test.

Clickjacking: Warning

This was easily blocked by preventing our site from being run in an iframe. This is achieved in IIS Manager: select the web site, then open HTTP Response Headers, and add a new one as follows:

If we are using an iframe within the site, for something like a keep-alive, another value for this setting is "SAMEORIGIN" - this allows iframes in the site to host content that is within the same domain. If we want our site to be displayed in an iframe within a known other site, we can use "ALLOW-FROM uri".

View state MAC: Not tested

Not tested apparently because the viewstate is encrypted in mojoPortal, but it turns out versions of mojoPortal before 2.4.0.2 had enableViewStateMac="false" which is not what we want. This has been removed, meaning it is set to true by default, in version 2.4.0.2, but if running an earlier version we should ensure this setting has only the following attributes:

<pages validateRequest="false" viewStateEncryptionMode="Auto" maxPageStateFieldLength="500" controlRenderingCompatibilityVersion="4.0" clientIDMode="AutoID">

So on sites running mojoPortal 2.4.0.2 or later, no change needed.

Summary

So we needed to make two changes in web.config, remove one http header and add another one. Plus install and configure URLscan if it's not already present. These are one-off changes for a server and/or site except the web.config settings. mojoPortal upgrades generally involve overwriting the web.config, so it’s important to keep separate notes about what default settings need to be changed again after an upgrade. We always keep these notes for each site in a UpgradeNotes.config file in the root folder of the site.

*** UPDATE ***

Further testing of some sites with ZAP and https://securityheaders.com identified two more http headers (in italics below) that should be set to improve security. Overall the header settings can be wrapped up by including this section in system.webServer:

  <system.webServer>
...
        <httpProtocol>
            <customHeaders>
                <remove name="X-Powered-By" />
                <add name="X-Frame-Options" value="SAMEORIGIN" />
                <add name="X-XSS-Protection" value="1" />
                <add name="X-Content-Type-Options" value="nosniff" />    
                <add name="Referrer-Policy" value="no-referrer-when-downgrade" />
                <add name="strict-transport-security" value="max-age=31536000; includeSubDomains" />
            </customHeaders>
        </httpProtocol> 

...

And it also pointed  out that auto-complete was not disabled on the login screen (which leaves accounts vulnerable where more than one user may share a machine). This can be suppressed with the following in user.config:

<add key="DisableAutoCompleteOnLogin" value="true"/>

If you want a link to open within a popup in the page, rather than the current browser tab or a new tab, this can be achieved simply by adding

class="cblink"

to the hyperlink.

And this can be done easily in CKEditor from the hyperlink editor, using the Stylesheet Classes as shown here:

The result? This is a hyperlink to the home page of the exeGesIS web site.

For this to work the colorbox javascript has to be loaded with the page. When logged in as admin, or on pages with certain features like the image gallery, this is loaded automatically. But on other pages, as noted in Kate’s previous post, this will not be loaded unless you include this property in the ScriptLoader in layout.master:

<portal:ScriptLoader id="ScriptLoader1" runat="server" AssumejQueryIsLoaded="true" AssumejQueryUiIsLoaded="true" MojoCombinedFullScript="/mojocombined/mysitecombined.js"  IncludeColorBox="true" />
Crispin Flower  ...]]> https://www.esdm.co.uk/how-to-make-links-open-in-a-colorbox-popup-in-mojoportal-without-writing-any-code crispin.flower@idoxgroup.com (Crispin Flower) https://www.esdm.co.uk/how-to-make-links-open-in-a-colorbox-popup-in-mojoportal-without-writing-any-code https://www.esdm.co.uk/how-to-make-links-open-in-a-colorbox-popup-in-mojoportal-without-writing-any-code Tue, 17 Dec 2013 13:20:59 GMT If your users complain that they can't see your nice pretty Colorbox popup add:

IncludeColorbox="true" to the scriptloader in layout.master

The ColorBox javascript is included in the admin javascript combiner, but is not loaded for anonymous users unless the above is set.

This is typical of what I was seeing in the system log:

2013-04-17 19:15:57,147 ERROR 192.168.54.5 - en-GB - /Admin/PageLayout.aspx?pageid=282 - mojoPortal.Web.Global -  Referrer(ttp://www.mysite.co.uk/Admin/PageLayout.aspx?pageid=282) useragent Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; BOIE9;ENUS)
System.FormatException: Input string was not in a correct format.
   at System.Number.StringToNumber(String str, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean parseDecimal)
   at System.Number.ParseInt32(String s, NumberStyles style, NumberFormatInfo info)
   at System.Web.UI.WebControls.ImageButton.LoadPostData(String postDataKey, NameValueCollection postCollection)
   at System.Web.UI.WebControls.ImageButton.System.Web.UI.IPostBackDataHandler.LoadPostData(String postDataKey, NameValueCollection postCollection)
   at System.Web.UI.Page.ProcessPostData(NameValueCollection postData, Boolean fBeforeLoad)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Joe Audette pointed out a possible solution in this thread so I installed .Net 4.5 on the web server and the problem was cured.

Note : if the databases are on the same server, or can be linked, then it is possible to take the SQL of the selects in the ExportASPNETUserData.bat file and use them to insert into the MojoPortal database tables. Using the .bat files will work wherever the databases are, as long as your PC can connect to both.
If you can't connect to both, run the XMLFormat and Export scripts on a machine that can connect to the ASP.NET membership database, then copy the files and run the Import script on a machine that can connect to the MojoPortal database

Note: It is possible to do the format/export/import in one script, but being able to sanity check the data before inserting is useful. You could also use staging tables to test the scripts before using the real MojoPortal tables

Note: The switches set in each file are those I found were best for the LHaR data. Change them if you feel it is appropriate for you data. See: BCP Utility Technical Reference

How-to

• Set MojoPortal to use plain text passwords
• Create a folder on your PC to contain the scripts
• In this folder, create the following .bat files:
  • CreateMojoUserTablesXMLFormats.bat
  • ExportASPNETUserData.bat
  • ImportMojoPortalUserData.bat
• In this folder create the following subdirectories:
  • data
  • formats
  • output
• Create and run the CreateMojoUserTablesXMLFormats.bat file
• Create and run the ExportASPNETUserData.bat file
  • Note: add as many user properties as required. To do this, select out each property in a separate select and then UNION the results together
  • Check the output directory for any errors
  • Check the data files have been created and contain the data you expect
• Create and run the ImportMojoPortalUserData.bat
  • Check the output directory for any errors
  • Check the database tables have the data
• Switch MojoPortal back to using encrypted passwords
• Test a few logins

CreateMojoUserTablesXMLFormats.bat

set login=-U [Username] -P [Password] -S [SQL Server Instance]
set database=[Databasename].[Schema].
set switches= -c -x
set formatDir=[Full path to formats directory with trailing slash]

bcp %database%mp_Users format nul %login% %switches% -f %formatDir%mojoUsers.xml
bcp %database%mp_UserProperties format nul %login% %switches% -f %formatDir%mojoUserProperties.xml
bcp %database%mp_userRoles format nul %login% %switches% -f %formatDir%mp_userRoles.xml

ExportASPNETUserData.bat file

set login=-U [Username] -P [Password] -S [SQL Server Instance]
set dataDir=[Full path to data directory with trailing slash]
set database=[Databasename].[Schema].
set switches= -k -c

bcp "SELECT 0 AS UserID, 1 AS SiteID, aspnet_Users.Username AS Name, aspnet_Users.UserName AS LoginName, COALESCE (aspnet_Membership.Email,aspnet_Users.UserName + '@dummyemail.co.uk' ) AS Email, aspnet_Membership.LoweredEmail AS LoweredEmail, NULL AS PasswordQuestion, NULL AS PasswordAnswer, NULL AS Gender, aspnet_Membership.IsApproved AS ProfileApproved, NULL AS RegisterConfirmGUID, aspnet_Membership.IsApproved AS ApprovedForForums, 0 AS Trusted, CASE aspnet_Roles.RoleName WHEN 'xg' THEN 0 ELSE 1 END AS DisplayInMemberList, NULL AS WebsiteURL, NULL AS Country, NULL AS [State], NULL AS Occupation, NULL AS Interests, NULL AS MSN, NULL AS Yahoo, NULL AS AIM, NULL AS ICQ, 0 AS TotalPosts, NULL AS AvatarURL, 0 AS TimeOffsetHours, NULL AS [Signature], aspnet_Membership.CreateDate AS DateCreated, aspnet_Membership.UserId AS userGUID, NULL AS Skin, 0 AS IsDeleted, aspnet_Users.LastActivityDate AS LastActivityDate, aspnet_Membership.LastLoginDate AS LastLoginDate, NULL AS LastPasswordChangedDate, NULL AS LastLockoutDate, 0 AS FailedPasswordAttemptCount, NULL AS FailedPwdAttemptWindowStart, 0 AS FailedPwdAttemptCount, NULL AS FailedPwdAnswerWindowStart, aspnet_Membership.IsLockedOut AS IsLockedOut, NULL AS MobilePin, NULL AS PasswordSalt, NULL AS Comment, NULL AS OpenIDURI, NULL AS WindowsLiveID, '77C33D82-D6F0-49ED-95A7-84C11919AD94' AS SiteGUID, NULL AS TotalRevenue, userInfo.ForeName AS FirstName, userInfo.Surname AS LastName, aspnet_Users.Username as Pwd, 1 AS MustChangePassword, NULL AS NewEmail, NULL AS EditorPreference, '00000000-0000-0000-0000-000000000000' AS EmailChangeGuid, NULL AS TimeZoneID, '00000000-0000-0000-0000-000000000000' AS PasswordResetGuid FROM %database%aspnet_Membership INNER JOIN %database %aspnet_Users ON aspnet_Membership.UserId=aspnet_Users.UserId INNER JOIN %database%userInfo on aspnet_Membership.UserId=userInfo.userId INNER JOIN %database%aspnet_UsersInRoles ON aspnet_Membership.UserId=aspnet_UsersInRoles.UserId INNER JOIN %database%aspnet_Roles ON aspnet_UsersInRoles.RoleId = aspnet_Roles.RoleId" queryout %dataDir%lharUsers.txt %switches% %login% -o output/usersOutput.txt

bcp "select RoleName,UserId from %database%aspnet_Roles INNER JOIN %database%aspnet_UsersInRoles on aspnet_Roles.RoleId=aspnet_UsersInRoles.RoleId" queryout %dataDir%lharUsersRoles.txt %switches% %login% -o output/userRolesOutput.txt

bcp "SELECT newid() AS PropertyID, UserId AS userGUID, [String to use as MojoPortal PropertyName] AS PropertyName, Title AS PropertyValueString, NULL AS PropertyValueBinary, GETDATE() AS LastUpdatedDate, 0 AS IsLazyLoaded FROM %database%UserInfo
UNION ALL
SELECT newid() AS PropertyID, UserId AS userGUID, [String to use as MojoPortal PropertyName] AS PropertyName, Title AS PropertyValueString, NULL AS PropertyValueBinary, GETDATE() AS LastUpdatedDate, 0 AS IsLazyLoaded FROM %database%UserInfo" queryout %dataDir%lharUserProfiles.txt %switches% %login% -o output/userPropertiesOutput.txt

ImportMojoPortalUserData.bat

set login=-U [Username] -P [Password] -S [SQL Server Instance]
set database=[Databasename].[Schema].
set dataDir=[Full path to data directory with trailing slash]
set switches= -k -R
set formatDir=[Full path to outputs directory with trailing slash]

bcp %database%mp_users IN %dataDir%lharUsers.txt %login% %switches% -f %formatDir%mojoUsers.xml -o output/importUsers.txt
bcp %database%mp_userProperties IN %dataDir%lharUserProfiles.txt %login% %switches% -f %formatDir%mojoUserProperties.xml -o output/importUserProperties.txt
bcp %database%mp_userRoles IN %dataDir%lharUsersRoles.txt %login% %switches% -f %formatDir%mp_userRoles.xml -o output/importUserRoles.txt

The default configuration is American English. To change this in such a way that mojoPortal upgrades don't revert it back again, first configure the site to use a custom configuration file for CKEditor. Do this by first copying the default configuration file, found here: /ClientScript/ckeditor-mojoconfig.js, to create a new version (either in the same folder or anywhere else; any new file will not be overwritten in mojoPortal upgrades). Then add this setting to user.config:

<add key="CKEditor:ConfigPath" value="~/ckeditor-mycustomconfig.js"/> (this example presumes you have out the config file into the site root folder).

Then touch web.config to reload the settings.

Now you can edit the settings in the new file, to change the language (also to customize the toolbars etc, but that's another story).

To make the SCAYT (spell check as you type) function use British English, add this line into the main body of settings:

config.scayt_sLang = 'en_GB';

And to make the "Check Spelling" tool use British English by default, set this:

config.wsc_lang = 'en_GB';

Incidentally, since SCAYT often causes the editor to behave badly, I like to switch it off by default with this setting:

config.scayt_autoStartup = false;

Finally, beware of caching when changing these settings. I kept finding that making a change didn’t work, but I think the CKEditor javaScript was being cached in the browser.  In IE9, use F12 > Cache > Clear browser cache for this domain, plus I like to tick “Always refresh from server” to make sure.

• Download  the latest mojoPortal deployment files and reference the relevant dll’s from your project.
• Download the latest mojoPortal source code, build it and then reference the relevant dll’s from your project.

Check the properties of these references and ensure that ‘specific version = false’.

This means that ths custom modules can then be dropped into any deployed mojoPortal site, regardless of version. Well nearly...

The only gotcha I found is when your project references a different version of the same strongly named assembly that mojoPortal does, e.g. AjaxControlToolkit.  You’ll have to change your project to reference the same version as mojoPortal or, if you’re building against the source code rather than deployment build you could rebuild mojoPortal with the dll that your project references.

Aside: the problem with running an application pool under its own user account is that MapServer CGI will not run within the site – I’ve no idea why, though it must be a permissions issue. When the app pool runs as ApplicationPoolIdentity then MapServer works fine.

As you’ll see from a previous post about how to install a mojoPortal site, it is necessary to secure the web site folders. When I came to do this I found there was no user account called ApplicationPoolIdentity, and no user with the name of the application pool either.

It turns out there is a virtual user account, and it can be entered as

IIS APPPOOL\ApplicationPoolName  (obviously replacing ApplicationPoolName as appropriate):

Folder permissions can then be granted/revoked for this user.

Creating the site

1. Download the latest release from https://www.mojoportal.com/download
2. Unpack the zip and find the wwwroot folder. Copy the contents to wherever you want your web site files.
3. On your SQL Server create an empty database, and give a login dbowner access to it.
4. In the web site folder, rename user.config.sample to user.config and alter the MSSQLConnectionString to point at your new database. Better still copy in a user.config from another working site and adjust.
5. In IIS Manager, we like to create a dedicated application pool per site:
   
6. Then create a web site:
   
7. On a PC, browse to your web site… you should see lots of messages appear like this:
   Welcome to mojoPortal Setup
   Probing system...
   File system permissions ok.
   MSSQL database connection ok.
   database permissions are sufficient to alter schema.
   database initial schema needs to be created.
   Running script mojoportal-core - 2.3.4.8 - 00:00:00.0700000
   Running script mojoportal-core - 2.3.4.9 - 00:00:03.2250000
   Running script mojoportal-core - 2.3.5.0 - 00:00:03.2820000
   Running script mojoportal-core - 2.3.5.1 - 00:00:03.3130000
   etc etc
8. Your site should now be up and running. Assuming it is, there are a couple more things to do to secure the site.

Securing the site

1. Sign in as admin@admin.com / admin
2. Got to Administration > Security Advisor – it will be warning you about the machine key. Click “Generate a new key”, copy the result, and paste it into your web.config on the web server (replacing the existing machine key – search the file for “machineKey”). This will make your site restart so you will have to log in again.
3. Next visit the “Member List” page (using the link at the top of the page), and click “Add new user”. Create a new account for yourself, and after clicking “Create User” go to “Role Membership” and add the new account to the Administrators role. Sign out, and sign in again with your new account.
4. Go to the Member List, “Manage” the “Admin” account, and delete it.
5. Go to Administration > Site Settings > Security, and change the password format from “Clear Text in DB” to “Hashed in DB…”
6. Screw down the permission on the web site folders as instructed here. We like to make the application pool run under a specific user account, then give this account the permissions described.

That’s it – you have a secure mojoPortal web site.

Useful settings

We like to add the following settings to user.config (remembering to touch web.config to make these take effect):

    <!-- to allow extensionless URLs -->
    <add key="AllowChangingFriendlyUrlPattern" value="true" />
    <!-- Set these to false during design work -->
    <add key="CacheCssOnServer" value="false"/>
    <add key="CacheCssInBrowser" value="false"/>
    <!-- To prevent startup scripts running. Change to false when upgrading mojo -->
    <add key="DisableSetup" value="true" />
    <!-- make sure admins put content files in same place as non-admins -->
    <add key="ForceAdminsToUseMediaFolder" value="true" />
    <add key="AllowForcingPreferredHostName" value="true" />
    <!-- EMAIL -->
    <add key="DisableDotNetOpenMail" value="true" />
    <add key="SMTPServer" value="myserver" />
    <add key="SMTPRequiresAuthentication" value="true" />
    <add key="SMTPUseSsl" value="false" />
    <add key="SMTPPort" value="25" />
    <add key="SMTPUser" value="mymailserver" />
    <add key="SMTPPassword" value="mypassword" />
    <add key="SMTPTimeoutInMilliseconds" value="30000" />
    <!-- Leave this blank for ASCII encoding. Allowed values are utf-8, utf-32, and unicode -->
    <add key="SmtpPreferredEncoding" value=""/>
    <!-- END EMAIL -->

Skinning the site

Big topic, with plenty of guidance on www.mojoportal.com, and we are now going over the 10 minutes! The easiest way to get started is to choose the shipped skin that is closest to your layout/behaviour requirements, clone this skin, then work on the CSS, layout.master and graphics. We usually review the extra skins that are available for each mojoPortal release (as well as the ones in the release folders). These are also found on the Codeplex download page (see above) as “extra-skins.zip”. If you drop the unzipped skin folders into \Data\skins in your web site folder they will be available for all child sites. If you have already create a site, you can drop them into \Data\Sites\N\skins (where N is the number of your site).

UPDATE 14th March 2012: now moved to http://testutils.org/multi-mechanize

Multi-Mechanize is an open source framework for API performance and load testing. It allows you to run simultaneous python scripts to generate load (synthetic transactions) against a web site or API/service. 

In your scripts, you have the convenience of mechanize along with the power of the full Python programming language at your disposal. You programmatically create test scripts to simulate virtual user activity. Your scripts will then generate HTTP requests to intelligently navigate a web site or send requests to a web service.

…

You should be proficient with Python, HTTP, and performance/load testing to use multi-mechanize successfully.

Installing Multi-Mechanize

First time around I got this horribly wrong, probably through not being proficient with…. actually my problem was installing Python 3.2 for Windows 64 bit; it turns out Multi-Mechanize only works with Python 2.6 and 2.7, and if you install the wrong version you get loads of syntax error messages; so I had to start again. Here is the correct sequence:

1. First install Python 2.7
   http://www.python.org/download/releases/2.7.2/ 
   specifically
   Windows X86-64 MSI Installer (2.7.2) [1](sig)
2. To install mechanize, download
   http://pypi.python.org/pypi/distribute#distribute-setup-py 
   and run 
   C:\Python27\python C:\blah\Downloads\distribute_setup.py
   then
   C:\Python27\scripts\easy_install mechanize
3. Install Numpy from http://www.lfd.uci.edu/~gohlke/pythonlibs/#numpy 
   specifically numpy-MKL-1.6.1.win-amd64-py2.7.‌exe [8.7 MB] [Python 2.7] [64 bit] [Oct 29, 2011]
4. Then install Matplotlib from http://www.lfd.uci.edu/~gohlke/pythonlibs/#matplotlib 
   specifically matplotlib-1.1.0.win-amd64-py2.7.‌exe [4.4 MB] [Python 2.7] [64 bit] [Oct 06, 2011]
5. Finally download Multi-Mechanize
   http://code.google.com/p/multi-mechanize/downloads/list
   and copy the unzipped folder somewhere (no installation).

Using Multi-Mechanize

It’s pretty simple. Use a command like this to start a session:

>c:\python27\python multi-mechanize.py testMySite

This refers to a “project” (in this case “testMySite”) which is a folder under \projects under your Multi-Mechanize folder.  To create a project I just copied and adapted the “default_project” that came in the download.

In the project folder there is a config.cfg text file that specifies some global settings and some details about what scripts to run on and how many simultaneous sessions to run. There is some sparse information on the config settings here: http://code.google.com/p/multi-mechanize/wiki/ConfigFile

You can specify any number of “user groups”, each representing one sequence of actions on your web site/service (e.g. loading the home page, or executing a search). Each user group is associated with a python script defining the actions. Each user group has a number of threads, i.e. virtual users attempting the sequence of operations.

TODO: insert some information about the actual Python script - how to perform simple and more complex operations on a web site.

The global settings include how long to run the test for, the time series interval for results analysis, and how long to “rampup” the number of users, presumably from one up to the maximum number of threads specified in the user groups. The ramp-up is to see within one test how the site performs under low and then progressively higher loads.

The results of the test are output into a folder below the project, with a time-stamped name like \results\results_2011.12.27_16.32.07

This contains the raw results as CSV, plus some graphs as PNG images, and an HTML page that brings the numbers and images together into a report.

Example tests

I ran simple tests on the following sites:

• www.esdm.co.uk (main exeGesIS web site built in DotNetNuke and running on one of our older Telehouse servers)
• www.esdm.no-ip.co.uk (draft replacement exeGesIS web site built in mojoPortal and running on our newer Telehouse hosting stack)
• www.breconfans.org.uk (a site I run at home, using mojoPortal on Arvixe hosting)
• www.wikipedia.org (a high availability global site as a control)

The test script simply loaded the home page and checked for some text on the page. I tested with two user groups undertaking the same actions, with 50 virtual users in each, ramping up throughout the 5 minute test period.

www.esdm.co.uk

Timer Summary (secs)

Interval Details (secs)

Graphs

Response Time: 30 sec time-series

Response Time: raw data (all points)

Throughput: 30 sec time-series

www.esdm.no-ip.co.uk

Timer Summary (secs)

Interval Details (secs)

Graphs

Response Time: 30 sec time-series

Response Time: raw data (all points)

Throughput: 30 sec time-series

www.breconfans.org.uk

Timer Summary (secs)

Interval Details (secs)

Graphs

Response Time: 30 sec time-series

Response Time: raw data (all points)

Throughput: 30 sec time-series

www.wikipedia.org

Timer Summary (secs)

Interval Details (secs)

Graphs

Response Time: 30 sec time-series

Response Time: raw data (all points)

Throughput: 30 sec time-series

Analysis

I am no expert in load testing, so I do not pretend to be able to analyse the results in any meaningful way. Looking to learn though…!

But bringing together the most significant statistics from these tests…

These identical tests put the web sites under heavy load, particularly after the first minute or so. It is clear that the two mojoPortal sites dramatically out-perform our old esdm.co.uk, with average response times of 2.9 and 2.2 seconds compared with 12.8 over the full test period. The reasons for this are far less clear though.  esdm.co.uk and esdm.no-ip.co.uk have about the same amount of content, but this is not really a fair comparison between DotNetNuke and mojoPortal, because esdm.no-ip.co.uk is running on faster servers. Also, we are running the latest version of mojoPortal (2.3.7.5) compared to an ancient version of DNN.

Interestingly the minimum response time was 0.48 for esdm.co.uk, significantly faster than the 0.78 seconds for breconfans.org.uk, perhaps because the latter is on US hosting meaning a longer round-trip regardless of other factors; esdm.no-ip.co.uk gave 0.21 seconds minimum, perhaps demonstrating the inherent responsiveness of our new hosting stack.

I was surprised that breconfans.org came out better under load than esdm.no-ip.co.uk, but I suspect this is because the latter is a much larger site, with hundreds of pages (and so a much larger mojoPortal database) compared to about 25 pages for breconfans.

Testing wikipedia was an afterthought, and of course it is not quite the same because it is always under heavy load; nonetheless it was reassuring to find that my mojoPortal sites performed better, and that the wikipedia performance also degraded through the test as more virtual users were added (though this does make me wonder whether some of the performance degradation is client-side, e.g. inherent bottle-neck in processing http requests in Windows?).

Conclusion

Multi-Mechanize was simple to set up and use (admittedly in a limited manner). It quickly demonstrates what kinds of load web sites can sustain before degrading.

More advanced configuration of the test scripts, e.g. to perform form-based operations, should be reasonably easy for our developers. This should give real power for load-testing our web applications.

Aside: I found when running the longer tests with lots of threads (e.g. 100) that the routine would not complete after the allotted time, and would stick saying “waiting for all requests to finish”.  Usually it would complete after a minute or two extra waiting. If not, no outputs were produced, but killing the python.exe process sometimes caused the output files to be created. This issue has been encountered by others, with no apparent resolution (e.g. http://groups.google.com/group/multi-mechanize/browse_thread/thread/706c30203c568d61)

Insert Code

http://plugins.live.com/writer/detail/insert-code-for-windows-live-writer

Here’s an example of inserted HTML, with line numbers switched on:

   1:  <!DOCTYPE html>

   2:  <html>

   3:  <head id="ctl01_Head1"><title>

   4:      Authoring with Windows Live Writer or Word - exeGesIS SDM Ltd

   5:  </title>

   6:  <link rel='stylesheet' type='text/css' href='http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.14/themes/blitzer/jquery-ui.css' />

   7:  <link rel='stylesheet' type='text/css' href='/csshandler.ashx?skin=esdm-website&amp;s=1&amp;v=2.3.7.0' />

Paste from Visual Studio

http://plugins.live.com/writer/detail/paste-from-visual-studio

Here’s an example of pasting direct from VS2010:

protected override void OnPreRender(EventArgs e)
{
    base.OnPreRender(e);

    SetupColumnCss(forceShowLeft, forceShowRight);
   
}