Stats on Xen tarball downloads

[George Dunlap <george.dunlap@xxxxxxxxx>]

Hey all,

One of the questions we had with respect to changing our release
practice (for instance, making the process more light-weight so that
we could do a point release after every XSA) was, "How many people are
actually using the tarballs?"  I finally got access (again) to
downloads.xenproject.org, and took a look at the logs.  It appears
that we only keep about 2 weeks of logs there.

Short answer: It's pretty clear from looking at the logs that there
are large numbers of automated build systems building various versions
of Xen from tarballs.  It *looks* like there are over 300 people a
week downloading 4.18.0 specifically from various web browsers.

Attached is a report generated by goaccess on the log after filtering
for xen-4.18.0.tar.gz (which includes the .sig), as well as a report
filtering on any Xen release (again including .sig files).

Between 6 and 19 Feb, the xen-4.18.0 tarball was downloaded by 704
"visitors" (unique by IP address, user agent, and date).  There are a
handful of IPs that had more than one "visit', but the vast majority
had only one "visit".  (The "Visitor Hostname and IPs" tab is somewhat
confusing on this point; it lists 800+ visits, but only 366 unique IP
addresses.  I verified independently that there were around 800 unique
IP addresses in the logs, so this may just be a limit as to how much
data is included in the report.)

Of the user agents, only 48 of these visits are classified as
"crawlers"; the vast majority are (in order) Chrome, Firefox, Edge,
Opera, or Safari.  There are a handful (<20) of downloads from
non-browser, non-bot/crawler agents (all wget).

Looking at the *non*-4.18 downloads, nearly all of them have user
agents that make it clear they're part of automated build systems:
user agents like curl and wget, but also "Go-http-client", "libfetch",
and "ansible-http".  There are several references to package managers
as well (xbps, pkgmon, slackrepo).  What is *not* significantly
represented are user-agent strings that look like web browsers; there
are intermittent ones, but not very many.

It's not really clear to me why we'd be getting 300-ish people
downloading the Xen 4.18.0 tarball, 2/3 of which are on Windows.  But
then I'm also not sure why someone would *fake* hundreds of downloads
a week from unique IP addresses; and in particular, if you were going
to fake hundreds of downloads a week, I'm not sure why you'd only fake
the most recent release.

I think we can fairly conclusively conclude that there are regular
users of older versions of the Xen tarballs, as part of automated
build systems which could be disrupted by any significant change to
the way the tarballs worked.

I think we can *tentatively* conclude that there are hundreds of
people per week downloading the most recent release tarball via the
website.  It would be interesting to see if we could determine some
way of trying to evaluate how many of those resulted in a build (e.g.,
by looking at "extfiles" downloads or something).

More conclusions than that (e.g., whether it's worth changing the
tarball layout to make it more automate-able, whether it's worth
investing time making the build-from-tarball experience better, and/or
pointing people to better ways to get Xen) I haven't considered yet.

 -George

<<< text/html; charset="US-ASCII"; name="4-18-report.html": Unrecognized >>>

<<< text/html; charset="US-ASCII"; name="report.html": Unrecognized >>>