webserver and db on same box

[musicales]

For a while now I've had two separate boxes for IIS webserver and SQL server, but it's become quite expensive, and I'm wondering if I could instead get one high powered box and run them both from the same box instead. Anyone have any experience of this or advice? My sites gets around 5 million hits a month so the box would have to work fairly hard.

[Ocean10000]

Yes it is very possible. But a great deal depends on your database load, if it is high then you probably want to keep them separate so it doesn't compete with the webserver for cpu time.

My preference is to keep the two separate for security reasons to limit the attack surface where possible. So if they get into your webserver, they have to find another hole to get direct access to your db server (assuming the web server is in a dmz).

But since you haven't really posted more specific information I think that is all I can provide advice wise.

[dstiles]

I've been running MySQL on an IIS web server for years for about four web sites plus IP and UA blocking (run via ASP file for all pages of about three dozen web sites).

Recently I moved all of the MDB data for the other web sites into it as well (easier than getting Windows 12 to handle MDB files!).

Six processor box running Windows 2012 for web sites plus hyper-v linux mail server (which also has MySQL for postscript setup). It all comes down to loading (and security, of course).

I've never seen a problem with my setup. I know it's commonly said that databases should be on seperate servers to the using servers but look at it this way: data read/written between servers is open to at least some degree to interception/corruption and has to be slower. And two servers means double the security hassle. Just my view. :)

[LifeinAsia]

Besides security/load balancing, also consider the SPF (single point of failure) issue.

Several years ago I split web & DB to different servers. A couple of years after that, the older (web) server died (H/W-related).

Had I still been on 1 box, I would have had to order/configure a new server and get it shipped to the co-lo center. It probably would have been 2 weeks before the sites were back online again.

Instead, I was able to get the web sites up and running on the DB server within a few hours from backups. The DB server was able to handle the extra load until such time as I got a new server up and running and moved the web stuff to it.

[musicales]

Thanks everyone - dstiles : six processors sounds like it might cost as much as 2 cheaper boxes! How much RAM are you using?

[dataguy]

It's been a few years since I've done the testing, but against conventional wisdom, having the db and IIS on the same box can produce some tremendous performance gains, since the data doesn't have to go over the network to get between the two. Security is a concern, but in my case the speed difference meant an increase in revenue great enough that I could afford to hire someone full-time to manage security.