The Microsoft Playback Utility

The Windows 2000 Resource Kit

The Microsoft Windows 2000 Resource Kit includes a useful utility called Playback. This utility has two components: an Internet Server API (ISAPI) filter that can record user requests to IIS and a playback program to replay the requests. The playback program consists of recorder files (recorder.dll and lkhash.dll) and a playback file (playback.exe).

Testing a Web site or application is often difficult because of the dynamic nature of real user requests, particularly when you're developing a new Web site or trying to monitor how production performance will change when you make hardware or software changes. The Playback utility is useful because it can help you test the performance of a site with a set of known traffic. The utility works by capturing session data to a log file that you can then replay against the site. You can also capture a traffic log from one server, then replay the log against another server on which you've changed hardware or software.

Using the Playback utility to test a site lets you apply the same load against one or more servers, testing the loading as you go. For example, you can use the Microsoft performance tool in Win2K to monitor server performance as you run a playback log on each system. You can compare the performance logs from each system to see the effect of your changes.

Installing and Configuring the Utility
The Playback utility's files are installed when you install the resource kit. However, resource kit installation doesn't set up the tool, so you must set up the utility and configure IIS. Step 1 of the setup process requires placing lkhash.dll in the system32 directory. Step 2 in the process is to register recorder.dll with IIS as an ISAPI filter. Install the recorder filter only when you want to record traffic. To install the recorder, follow these steps:

You can verify that the filter is working by checking the default log directory C:winntsystem32logfilesreplay. In this directory, you'll see a file with a name similar to replay20001220.log, where 2000 is the year, 12 is the month, and 20 is the day on which that file was created.

The filter creates the replay log when the filter loads successfully upon IIS's startup. In my testing, I found that the filter sometimes creates a log file even if the filter didn't start correctly. For example, before I copied lkhash.dll to system32, I tried loading the filter; the filter seemed to start and created the log. However, the filter wasn't logging data correctly. When I checked the Internet Services Manager (ISM) properties for the filter, I found that the filter wasn't loaded. Copying lkhash.dll to system32 and restarting IIS solved the problem.

After you've loaded recorder.dll as a filter, it will record any traffic to the server on which you installed it. You can open the log in Notepad or Wordpad to verify that the filter is recording traffic. (Note that Wordpad interprets the embedded carriage returns correctly, which makes the log easier to read.) Figure 2 shows a partial log in Notepad. The first few lines of the file specify version information for the utility, and the string starting with #Fields: in the first group of records is a header for the file. The header specifies the format of the data records that follow. The lines that start with two special characters and 80 are data records for a request. To test my server after installing the filter, I accessed the Active Server Pages (ASP) file countit.asp, which generated all the data records in Figure 2 and demonstrated that the filter was working.

Playing Back a Log
After you've created a log, you can play it back. However, you must first remove the recorder filter because the Playback utility won't work if the recorder is active. To remove the recorder, follow these steps:

Now you're ready to replay the log. You can replay the log against the same server that captured it or against another server. Playback.exe is a command-line utility. To use the Playback command, enter Playback at the command prompt, then follow it with the proper parameters. For example, you can use the command

playback /log:C:winntsystem32logfilesreplayreplay20001220.log /loops:100

to play back the 12/20/2000 log. This command plays back the file through 100 iterations (specified with the /loops:100 option). When running a test repeatedly, I recommend placing the Playback command in a command file, which makes repeatedly executing the same command easy. (Here's a note about syntax: Follow an option with the data for that option with no intervening spaces. For example, the log filename in the previous command follows /log: with no space between the colon and C.) If you don't specify the /loops: option, the Playback utility processes the entries one at a time.

You can also specify the /machine: option followed by the name of the computer against which to play the commands. If you don't specify a machine, Playback executes the entries against the server from which they were recorded. Two other options for playback are /timeout:, which controls the timeout in seconds for a socket connection, and /errorlog:, which specifies a filename for error recording.

When you execute the Playback command, it generates output to the command prompt that's recording its actions. You must specify the error log because you need it to uncover any errors that occur during a test.

Many More Options
This utility is interesting because of its ability to capture and play back Web traffic. Many more options exist for the utility than I could cover this month. For more information about these options, see the Using Playback section under Playback.exe: Playback in the resource kit Tools Help.