Tomcat sessions expiring unexpectedly

Question

We are running tomcat application server that handle over 100 concurrent sessions. In the last 2 months the most active users noticed that sometimes they are getting kicked off from the system.

As I understood from the log tomcat sessions are getting expired without any reason.

I see no problems from the web application side. Is there any problem from the tomcat side?

Tomcat 6.0.18.

Answer 1

there is a timeout, that you can configure in your web.xml:

<web-app>
  ...
  <session-config>
    <session-timeout>-1</session-timeout> 
  </session-config>
</web-app>

use -1 for no timeout

Answer 2

If there has been no code chance triggering this, I would look at memory usage. This might be the effect of Tomcat running out of memory and invalidating sessions to recover.

If at all possible monitor garbage collections, and/or put surveillance on with jconsole or jvisualvm.

Answer 3

Eventhough I do not know the cause of the problem, one possible fix (which I had done at my previous project) would be to run the application on a tomcat cluster and have session failover. Sessions can be by default sticky and when one node goes down, the healthy nodes pick up the sessions and all this is transparent to the end user.

Answer 4

Increase your logging of sessions, which may shed some light onto your problem.

The Tomcat config page's Logging in Tomcat includes an example of increasing logging of sessions.

Answer 5

You can search Tomcat's bug database, but it would be better to have another look at your web application first. The chances that there is something wrong with Tomcat are very low.

Try to investigate what causes session invalidation. Are you using filters? Do you have cross-context requests? Try adding logging information for every request to find out, when exactly the session is lost.

Answer 6

I would increase the monitoring of the server in general and the sessions specifically.

A good monitoring application is lambda probe - it allows you to view the current sessions and their data. I would also add a HttpSessionListener to log session creation and destruction.

Edit

Is is possible that you add some non serializble objects to the session and Tomcat fails to passivate them to the disk?

Answer 7

Hi! I was wondering if you'd found a solution to this issue? We're having the same issue.

Thanks, SP

Answer 8

A possible cause is that you put in the session an object that does NOT implement the Serializable interface. Tomcat occasionally writes some of the sessions on the disk. If a session contains non-serializable objects it will simply be removed from the container (because of the NotSerializableException). If this is happening you should see the Exception in the tomcat log file.

Answer 9

I have the same problem for a long time now. I have still not figured out what's causing it. I have 3 shopping sites, all are on tomcat 6 behind an IIS server using the isapi redirector from apache. Mysteriously, at random intervals, random customers, using random browsers, lose their session unexpectedly while in their checkout. I cant explain it.

Answer 10

We just ran into this with tomcat 6_0_18 and ibm 1.5 jvm

turns out it was an ibm jvm issue with atomic operations.

There is a fix in tomcats greater than 6_0_19 to handle it.

It also doesn't occur in sun 1.5 jvm

here are some more details

tomcat bugzilla case