In-Depth

ADT's Programmers Report: Open-source servers today

• By Colleen Frye
• June 3, 2002

If open-source operating systems and Web servers can go mainstream, can open-source application servers be far behind? Already, the likes of Tomcat, Zope, Enhydra and JBoss boast development communities devoted to moving open software forward, and corporate IT has started to test the waters. Some of these products are all the app server many users need. And many are supported by commercial software makers. But questions remain. Can open-source application servers scale? Will management tools be available? Will commercial versions of open-source application servers really be open? Will maintenance and support be readily available? Another question: How important is full J2EE compatibility?

'Without EJBs, [an application server] can't call itself a J2EE server,' said James Governor, a London-based analyst with Illuminata. Full-blooded J2EE servers come under the aegis of Sun's Java Community Process, but are not strictly open source. And J2EE certification, he said, is expensive, which impacts a vendor's ability to maintain the low-cost pricing model of open-source software. But many businesses want a J2EE-compliant product, 'even though most applications don't use that capability,' said Governor. 'A lot of ISVs are throwing good money away at the moment.'

If the history of Linux and Apache provides a roadmap, though, observers say corporations will likely strike a balance, utilizing both open-source and commercial application servers. 'Both have their place,' said Governor. 'It's about balance. People don't want to make gambles, but when they see vendors they trust supporting this stuff, they'll go forward with it.'

Striking a balance
Organizations should look at not only striking a balance between open-source and commercial products, but also between low- and high-end servers, according to research firm Gartner Inc., Stamford, Conn. This way, they will get better value for their money. Rather than standardize on a single-platform application server architecture, Gartner recommends using a low-end server for less-demanding, user-facing applications and a high-end application server for transaction-heavy applications.

Gartner reports that many companies have been paying big bucks for products that have more capacity than they actually need, which the firm chalks up to a lack of architectural planning and 'the blind adoption of vendor-promoted technology.' Gartner divides application servers into two groups: low-end, which support servlets and JSPs, but typically not EJBs; and high-end, which typically support EJBs and Java messaging, and handle large transaction volumes.

From 1998 to 2000, enterprises spent more than $1 billion for application server capacity they never used, according to Gartner. For example, Gartner found that during the past three years, 80% of Java deployments did not utilize EJBs, but 60% of the application servers deployed were high-end and EJB-capable. By 2003, according to Gartner research, 60% of all new J2EE application code will remain JSP/servlets only, and at least 70% of new applications will be deployed using high-end servers. As a result, Gartner projects companies will spend an additional $2 billion on wasted capacity from 2001 to 2003.

Research from Stamford, Conn.-based Meta Group is in lockstep here. Meta cites that while only 10% of corporate-developed Java apps use EJB servers, nearly 90% of Global 2000 company purchases are for EJB-capable products. According to Meta, 'Price differentials between commercial EJB- and non-EJB-capable versions range between 60% and 80%, and the combination of Tomcat and Apache can provide the necessary services for free.'

Added Illuminata's Governor, 'Smart users are questioning their expenditure on Java-based application servers; I think Apache and Tomcat will be part of the enterprise arsenal.'

In the open-source space, there are both low- and high-end app servers, although none as yet with J2EE certification. A look at where they came from might provide some insight as to where they are going.

Apache/Tomcat
The Apache Software Foundation (ASF) is an outgrowth of The Apache Group, which was formed in 1995 to develop the Apache HTTP Server. According to the Netcraft Web Server Survey, January 2002, 56% of the Web sites on the Internet use Apache. Among the Fortune 1000, according to an October 2001 Meta Group report, 19% of these firms use Apache. No matter how you slice the data, Apache has achieved solid acceptance. Credit IBM with much of the muscle, and money, behind Apache.

'IBM funded much of the development of Apache,' said Mark Karaman, president of Solvepoint Corp., a management and technology consulting company in West Chester, Pa. 'They derived the benefit from open source and turned it into WebSphere.' XML and SOAP extensions that position Apache as a fuller application server have been among recent innovations.

Tomcat is an open-source implementation of Java servlet and JSP technologies developed under the Jakarta project at ASF.

Various vendors offer commercial versions of both Apache and Tomcat. Covalent Technologies, for example, offers the Enterprise Ready Server (ERS), a Web server product designed to minimize the resources required to deploy and manage Apache Web servers. The product provides a distributed graphical management tool for the Apache Web server, combining Apache 2.0 with Tomcat.

'The one thing Apache has been missing all along is [an] 800-number,' said Jim Zimmelin, vice president of marketing at San Francisco-based Covalent.

The fact that Covalent offers management solutions for Apache is a plus, said Illuminata's Governor. The lack of management tools for open-source vendors on the J2EE side, he noted, 'I see as a problem. The only company I'd point to at this point is Covalent; they're doing wonderful things around Apache management.'

Sun J2EE certification is not available for servlets-only platforms; however, 'Tomcat implements the majority of the J2EE standard; the pieces it doesn't implement, most people seem to be comfortable [with the idea] they don't need [them],' said Covalent's Mark Douglas, senior vice president of engineering. 'And the cost of adoption is lower [if you] go with Tomcat.'

New Mexico Mutual Casualty Company (NMMCC), Albuquerque, is a Covalent customer. 'We wanted the flexibility of Apache, but still [wanted to] have some kind of technical support and security assurances,' said Tim Thackaberry, Web administrator.

Thackaberry could have built what the firm needed without Covalent, but going through Covalent was more convenient. 'With Covalent, we have an SSL-enabled server out of box without having to install it ourselves; but I could still go in and undo what they've done,' he said.

Covalent's Douglas said the firm is 'a hybrid between an open-source software model and a proprietary software model. We build proprietary software on top of the open-source Apache core -- like management and security -- that aren't easily developed in [the] open-source world and which our customers are glad to pay for.'

NMMCC has a Web application, which was written in Perl, running on Covalent Apache Web servers, over Red Hat Linux. The application allows the firm's insurance agents to handle all aspects of NMMCC's auto and home policies serving New Mexico and Arizona. The company gets about 1 million hits a month.

NMMCC's Thackaberry said he chose to use the Resin XML app server from Caucho Technology Inc., San Diego, rather than Tomcat. Resin implements the latest servlet, JSP, EJB and XML specifications, and is available under the Caucho Developer Source License, which Thackaberry said is inexpensive. 'I have the source code and I can modify it. Resin does have some secondary technology that does do EJBs, but EJBs are too complex for our needs; possibly we'll do that in the future,' he said.

NMMCC had some initial resistance to going with an open-source solution, said Thackaberry. 'You know the stereotype -- it's not always going to work, it won't be secure -- but once we got it up and running and it never crashed' those fears were alleviated, he said. And in terms of maintenance, Thackaberry said it has been a piece of cake. He joked, 'It's Apache, man. It runs itself!'

Zope in the forefront
Another open-source application server is Zope, which Zope Corp. (formerly Digital Creations), Fredericksburg, Va., originally developed as part of its consulting arsenal. The software was released as open source in November 1998.

'With open source, it lets you grab market share and establish momentum on the cheap,' said Paul Everitt, one of Zope Corp.'s co-founders. Today, said Everitt, Zope has a life of its own. According to zope.org, there are more than 20,000 developers around the world contributing to Zope. Zope now targets the enterprise content management market, developing solutions based on the open-source Zope app server and its Content Management Framework (CMF), typically deployed behind the Apache Web server.

Zope was developed with the Python language, an interpreted, interactive, object-oriented programming language. Everitt was a founding organizer of the Python software community; the Python Labs team is now part of Zope Corp.

The U.S. Navy recently used Zope Corp.'s solution to prototype a document management system for coordinating and tracking engineering changes to equipment, enabling the Navy and its contractors to collaborate securely and efficiently. The legacy application it would replace currently runs 1,000 large engineering documents a year, with many attachments, explained Jim Glenn, Internet Branch Manager, U.S. Navy -- NCTS Pensacola, SPAWAR SSC Charleston. Glenn said the application represents integrated product teams across one-third of the Navy's logistics group. The Navy has put the prototype on hold for now, but Glenn said he hopes to resume work on the Zope app in a few months.

Glenn began using Zope before it was open source. He and Zope Corp.'s Everitt were in the Navy together, and Everitt 'helped me bring up the Navy intranet site,' said Glenn. Later, when Glenn had a short deadline to bring on a major Navy database, he went back to Everitt, who showed him Zope. They completed the project in three and a half weeks.

Glenn said he 'can't afford to put all my eggs in one basket,' so he tries to keep on top of a variety of technologies. For example, 'I have Java programmers working in parallel to Zope developers. It takes more to find a good Java programmer than a Python programmer; Java programmers are usually certified, but with no experience. It's not easy to find someone on [the] street, but you can with Python because of open sourcing,' he said.

Glenn said his experience with Zope flies in the face of typical knocks against open-source application servers -- that they do not scale and maintenance will cost more in the long run. 'Scaling isn't a problem if you're talking about the size of the application. And with maintenance on Zope, if anything needs to be upgraded, you just download it and run tests; it's just your own staff time,' he said. And while personnel is often cited as an organization's most expensive cost, Glenn said he finds that doing the maintenance required with open source keeps technical skills sharp, 'so it cuts development time in half.'

Does the fact that Glenn's Zope solution is a commercialized app from Zope Corp. make it any less open than if he downloaded and built it himself? According to Glenn, 'It's about 95% to 98% open, as open as anything else I've seen. Digital Creations [now known as Zope Corp.] has been [a] little bit more free with its software than most, but they control where it's going next.'

Enhydra
Enhydra is an open-source Java/XML application server created by Lutris Technologies Inc., Santa Cruz, Calif., which open sourced the software in January 1999. Enhydra features the Enhydra XMLC technology, an object-oriented standards-based replacement for JSP. Enhydra also provides plug-ins for leading IDEs, such as Borland's JBuilder.

Like Zope, Lutris began life as a consulting company that released its software into the public domain. Unlike Zope, though, Lutris recently took its application server efforts out of the open-source world and into the J2EE-licensed domain. Java originator Sun's certification stipulations played a role in this decision. Lutris's chief evangelist, David Young, said that while servlet programming meets about 75% of customers' needs, 'J2EE has taken on a pretty heavy brand recognition. We saw it as an imperative that we also embrace J2EE and launched our product in August.' The Lutris EAS 4.1 application server enables a full enterprise J2EE solution.

Young acknowledged that Lutris's decision created a stir among open-source advocates. 'I don't think people were real happy. In order to shift our focus to J2EE, we had to move all of our attention to it. Enhydra took on a life of its own; enough people have become experts that Lutris wasn't needed to keep the flag waving,' he said.

So does Lutris believe that an open- source business model will not work? 'Yes, we've gone public about that, particularly in the application server market; the people downloading Enhydra aren't the same ones making purchase decisions; we needed to focus on those decision makers,' he said.

But, Young added, 'by no stretch have we abandoned open source. But rather than our core, it's an element of our development strategy.' Young said Lutris will soon announce two new open-source projects on the micro server side.

Dave Bouvier, technical lead at Electronics For Imaging Inc. (EFI), which does software and hardware imaging solutions for network printing, is comfortable with Lutris's decision. The Foster City, Calif.-based firm will use Lutris EAS as well as Enhydra to build an e-commerce printing app targeted at print buyers/printers.

'I have experience building Web applications based on Java application servers. When I came to EFI, I was going to build a system based on a lot of Apache- and Jakarta-based software,' said Bouvier. 'Velocity was going to be the UI presentation layer. I came across Barracuda, which led me to Enhydra, which led me to Lutris.' Velocity is EFI's workflow solution. Barracuda is an open-source presentation framework and a project of enhydra.org.

Bouvier said the application will run in both open-source Enhydra and Lutris EAS; the version EFI offers in an ASP model will be based on EAS. 'One reason I chose Lutris is that there is the open-source version; for certain customers, where cost is a critical factor, we wanted a low-cost solution. The service available to everyone in the ASP model will be based on the commercial [EAS] version. There's more performance, and you have the ability to do clustering, which you don't have with the open-source version,' he said.

While Bouvier and Lutris's Young feel Enhydra can continue to develop without Lutris, others are skeptical. 'If Lutris is not open source, it says something about what will happen to Enhydra,' said Illuminata's Governor. 'We don't know what's going to happen with Enhydra. For people who are hard-core, open-source bigots, it would tend to drive them toward using JBoss,' he said.

Here comes the JBoss
JBoss is an open-source application server based on the J2EE specification and implemented in pure Java. It is available for free download under the LGPL license. JBoss, however, is not J2EE certified. In a statement posted on the jboss.org Web site, JBoss lead developer and founder Mark Fleury wrote: 'JBoss long ago informed Sun that we were interested in obtaining the J2EE certification suite so that we could apply Sun's certification mark to the JBoss software. Sun quoted a price for that certification suite that is beyond the current financial resources of the JBoss team. As a result, we have chosen not to 'certify' our software. Nevertheless, JBoss fully complies with Sun's published standards.'

JBoss.org claims a community of 1,000 international developers, and that its Web site 'averages approximately 50,000 downloads of its application a month as reported by Sourceforge.com.'

JBoss Group LLC, a commercial company in Atlanta, provides support, training and consulting services around the JBoss platform.

'JBoss is a great product; it is the most thorough implementation of JMX [Java Management Extensions] out there,' said Illuminata's Governor. But while it offers high-end functionality, he added, 'if I'm rolling out an enterprise-class application, I want support. The community will look after itself, but when you want to have a throat to choke, who will you call?'

Experience counts
Whom you call and how much experience they have in developing and supporting the product is more critical than if a solution supports EJBs, hosts more complex apps, is J2EE certified, or even whether it is open or proprietary, said Yefim Natis, vice president and research director at Gartner Inc.

'Open-source application servers are invariably low end, they're not J2EE certified, and they're not backed by vendors with many years of experience with middleware. High-end environments are such that middleware and software infrastructure cannot be tested in a lab,' said Natis. 'A product must be in production and used for some time so the vendor gets feedback, goes through several loops and then the product begins to mature. Look at the leading vendors of high-end application servers, BEA and IBM, both with more than 10 years in the high-end application platform business; that's no accident,' he explained.

And while JBoss positions itself in the high-end space and, according to Natis, 'can host more complex applications -- it's definitely a better platform than Tomcat -- that's not all there is to high-end maturity.

'Open source gives you lower cost,' Natis continued, 'but at the high end, people don't care about that. The cost is not just in the acquisition, but in maintenance and long-term care.' Even at the low end, Natis recommends going with a lower-cost app server from an established vendor, such as BEA's WebLogic Express. 'It's not because it's open source, but for what open source is -- [solutions] offered by relatively inexperienced vendors,' he said.

Natis said there are two justifications for an open-source solution: 'low cost and access to source code. Access to source code is a mixed blessing,' he noted. 'If something goes wrong it's good to [be able to] look at that, but it will require greater technical skills in-house. And you're vulnerable to people changing source code.' There will be more commercial J2EE servers to come, he said.

The next generation
An open-source avenue can also help organizations attract talent, said Britt Johnston, CTO at Bedford, Mass.-based NuSphere, an open-source firm specializing in PHP and databases. 'Employees do like to work with this software, so finding programmers who'd like to work in these environments is not hard. Many kids out of universities often know the basics right out of the gate,' he said.

In the end, it may come down to balance: the use of both low- and high-end application servers, each where appropriate, as Gartner recommends. And perhaps the use of both open and commercial products, each where appropriate.

'A lot of open-source purists view the future as everything open source, and commercial products as evil. We think it's both,' said Solvepoint's Karaman. 'You will have enterprise software doing what it does well, and giving large companies someone to yell at and a place to get support. Then you have the open-source face, where you have a mix of more rapid development, cool tools and peer support.'

For more information, see the related article 'PHP prowls the edge .'