IIS7 and Classic ASP Sessions

Question

I've got an old web app written in Classic ASP which used to run on an IIS6 server no problem, then long story short, I moved it onto a Linux server running SunOne ASP which also worked fine (after a couple of minor tweaks), and now in a bid to access some 3rd party COM controls the app originally used, I've moved it back again to a Windows server, this time 2008 running IIS7.

On the whole the app works fine, but there seems to be a random problem now with the session variables getting lost. The implication of this is that the user gets automatically logged out of the system.

It's all pretty simple stuff, and just uses the a session variable to hold the logged in status (as well as a couple of other bits and pieces).

If Session("login_status") <> "loggedin" Then 
 Response.Status="302 Object moved"
 Response.Redirect "/admin/default.asp"
End If

The app is running on a shared hosting server, and what I'm worried about more than anything else is why this is happening, mostly so if I have to host any other ASP apps on the same platform I'm not going to run into similar problems.

Could this be because IIS7 is recycling the application pool and wiping out any session data in the process? And if that's the case, what could be done about it, short of course of writing my own state management/session handler routine, which is next on the cards if all else fails?

Answer 1

Could be the worker process getting recycled but that should only happen intermittantly not regularly (ie every 12 hours or earlier if the server is getting hammered).

Long shot but are you using IE8 when you get the problem, we've had a similar problem with IE8 dropping cookies and for now we've been sending the "behave like ie7" header that you can send down with the request (ASP with JScript btw):

// Force IE8 to act as IE7...grumble
Response.AddHeader( "X-UA-Compatible", "IE=EmulateIE7" );

And in the head of all our page:

<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"/>

This might be a red herring though

Answer 2

You should talk to your hosting company. It sounds very much like your pool is a being recycled. The host ought to keep a log of these and the reason that they were generated.

You should also ask whether you site shares a pool with other sites.

Answer 3

Not sure if it's applicable in this instance, but if you're running on IIS7 and redirecting between SSL and non SSL pages there may be different sessions in classic depending on the site configuration properties. In IIS, review the "ASP" section "Session Properties" - there will be a setting for "New ID on Secure Connection" that may be the culprit.

Answer 4

I have the same problem. i am losing my session in asp classic on IIS7. I am testing the web app on IIS7, there i'm losing the session on random. The web app works on IIS6 fine.

Setting, but doesn't work. Todday 9 people are working on the web app. Two of them have losing the session. application Pool: No managed code, classic, Idle Time-out = 1200 asp: keepsessionstate = false, timeout = 20:00:00

any suggestions?

Answer 5

In response to Ravaut123, and ultimately to reolution to this issue:

I resolved the issue after talking to the hosting company. There are a number of reasons why the pool could be recycled. This was using a shared server, and according to their configuration of the server when the server started to use over threshold limit for memory, the idle-timeout for applications was reduced in order to shutdown application more quickly, which will free up memory quickly.. when it got below the threshold the server returns the application time-out to its default value of 10 mins, if the server reduced the timeout and it is still above the threshold limit it reduces it again.

So what has happened to me was that the server was under high load and so the default application timeout was reduced to 3 mins, overiding the timeout I set in the script.

What the system admin team did was to disable the idle-timeout so the session no longer timed out, and now it's fine.

Answer 6

I can't find the problem. But i lose every day the session id's

My properties:

Application Pools > Advanced Settings

• .Net Framework Version = No Managed Code
• Managed Pipeline Mode = Classic
• Idle Time-out = 0
• Load User Profile = False
• application pool configuration changed = true
• isapi reported unhealthy = true
• manual recycle = true
• Regular time interval = 0
• Specific Times = TimeSpane[]Array [0] = 02:00:00

Sites > MYWeb > dubble click ASP

• Session properties > timeout = 20:00:00

There is no session.timeout in my asp pages.

in Event Viewer i made a Custom View: Can't find in the event log that the application pool is recycled. I think i'm looking in the right eventlog.

Xml of my custom view:

[System[Provider[@Name='Active Server Pages' or @Name='Browser' or @Name='IIS Config' or @Name='IISADMIN' or @Name='Microsoft-Windows-IIS-APPHOSTSVC' or @Name='Microsoft-Windows-IIS-FTP' or @Name='Microsoft-Windows-IIS-IISManager' or @Name='Microsoft-Windows-IIS-IisMetabaseAudit' or @Name='Microsoft-Windows-IIS-IISReset' or @Name='IISInfoCtrs' or @Name='IISLOG' or @Name='IIS-METABASE' or @Name='Microsoft-Windows-IIS-W3SVC' or @Name='Microsoft-Windows-IIS-W3SVC-PerfCounters' or @Name='Microsoft-Windows-IIS-W3SVC-WP' or @Name='IISWMI' or @Name='Microsoft-Windows-IIS-WMSVC' or @Name='Microsoft-Windows-WAS' or @Name='Microsoft-Windows-WAS-ListenerAdapter'] and (Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]] [System[Provider[@Name='Active Server Pages' or @Name='Browser' or @Name='IIS Config' or @Name='IISADMIN' or @Name='Microsoft-Windows-IIS-APPHOSTSVC' or @Name='Microsoft-Windows-IIS-FTP' or @Name='Microsoft-Windows-IIS-IISManager' or @Name='Microsoft-Windows-IIS-IisMetabaseAudit' or @Name='Microsoft-Windows-IIS-IISReset' or @Name='IISInfoCtrs' or @Name='IISLOG' or @Name='IIS-METABASE' or @Name='Microsoft-Windows-IIS-W3SVC' or @Name='Microsoft-Windows-IIS-W3SVC-PerfCounters' or @Name='Microsoft-Windows-IIS-W3SVC-WP' or @Name='IISWMI' or @Name='Microsoft-Windows-IIS-WMSVC' or @Name='Microsoft-Windows-WAS' or @Name='Microsoft-Windows-WAS-ListenerAdapter'] and (Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]] *[System[Provider[@Name='Active Server Pages' or @Name='Browser' or @Name='IIS Config' or @Name='IISADMIN' or @Name='Microsoft-Windows-IIS-APPHOSTSVC' or @Name='Microsoft-Windows-IIS-FTP' or @Name='Microsoft-Windows-IIS-IISManager' or @Name='Microsoft-Windows-IIS-IisMetabaseAudit' or @Name='Microsoft-Windows-IIS-IISReset' or @Name='IISInfoCtrs' or @Name='IISLOG' or @Name='IIS-METABASE' or @Name='Microsoft-Windows-IIS-W3SVC' or @Name='Microsoft-Windows-IIS-W3SVC-PerfCounters' or @Name='Microsoft-Windows-IIS-W3SVC-WP' or @Name='IISWMI' or @Name='Microsoft-Windows-IIS-WMSVC' or @Name='Microsoft-Windows-WAS' or @Name='Microsoft-Windows-WAS-ListenerAdapter'] and (Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]

Can someone point me the right direction, thanks?

Answer 7

You should be sure you're not running a web garden where no garden is wanted. In your App Pool settings, under Process Model, look at "Maximum Worker Processes". If the value is greater than "1", you may have the issue you describe. I know I did.

Read about Web Gardens here: http://geekswithblogs.net/vkamat/archive/2004/11/17/15145.aspx

Answer 8

Hello Ira Rainey,

thanks for your hint regarding the (IIS 7.5) 'application pool's (advanced settings) -> Idle Time-out (group: Process Model)'!

For my Classic ASP site that lost the current session all the time the individual application pool it uses for 'Idle Time-out (minutes)' had a (default?) setting of 5 minutes. I changed this to a higher value and it seems fine now. As this currently is a test system with me as the only test user causing traffic the "Idle Time-Out" seemed to apply after me doing nothing on the site for longer than 5 minutes.

regards ASDev