How Do I Track and Eliminate Session Abuse?

Question

I'm pretty sure that there have been developers in the past that have severely abused our poor friend ASP.NET session state. Session would love to help track things between requests, but can only do so much! Please help me ease its pain so that it can work with us happily ever after.

Does anyone know of a tool that can monitor session sizes across multiple in memory sessions? We currently have IP affinity turned on at the load ballancer because the sessions are so big people want to keep them in memory. I want to be able to monitor both average session size as well as individual sessions, which applications have been accessing them, and what is being stored in the session.

This heartess, inconsiderate abuse of session state must stop now. Together, we can find an answer.

Answer 1

I agree that Sessions are being abused. I am not currently aware of a tool to monitor Session sizes, but I do recommend code walk-through's before releasing your application to the masses.

By doing a code walk-through, you can easily identify what type of information is being stored in a session, how it is being used, and get an idea of it's size. (For example, stored an entire dataset as a Session variable)

Answer 2

I guess you could implement something like this custom session provider and add some monitoring instead of zipping. That would of course make the session object bigger and slower but it could give you the monitoring you want.

If you use SQL as session provider you should be able to monitor it in sqlserver, but of course sql server makes session handling slower..