Where to start when auditing a web application ?

Here is a short questionnaire when starting to audit the performance of a web application:

For instance :

Server :

. Make of the production server : HP

. Year : 2007

. Description : Proliant DL580 G4



Processeur(s) :

. Number : 16 (quad/quad)

. Type : Intel Xeon MP /3.20GHz FSB 800 MHz



RAM :

. Type and numbers of physical unit : 4 * 1 Go de RAM DDR2 533MHz ECC

. Maximum supported size : 256 Go (8*8*4 Go)

. Size of the RAM : 4 Go (Physical)



OS :

. 32 bit ? Oui or 64 bits ?

. Precise version of Windows : Windows Server 2003 Standard

"Microsoft Windows [version 5.2.3790]"

. Service pack : SP 2

. Updating strategies : WSUS (following the updates every 14 days)

. Version du IIS : 6.0



LDAP-Novell :

LDAP Novell eDirectory 8.7.3.7



HD :

. Number of physical disk : 8

. Number of logical disk : 3

. Speed of the disk : 10000 rev/min type SAS, 2.5 inches

. Type of RAID :

2 RAID 1+0 (2 disks each)

1 RAID 5 (3 disks)



LAN :

. Type : RJ45 wire

. Speed : 1 Gbit/s



Virtualisation :

. Any virtual machine hosted on the production server ?

SQL serveur :

. Precise version of the SQL-server : SQL Server 9.0.3050

. Service pack : SP 2

. Updating strategies : WSUS (following the updates every 14 days)


Architecture :

. DMZ, firewall