• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Liutauras Vilda
  • Jeanne Boyarsky
  • Devaka Cooray
  • Paul Clapham
Sheriffs:
  • Tim Cooke
  • Knute Snortum
  • Bear Bibeault
Saloon Keepers:
  • Ron McLeod
  • Tim Moores
  • Stephan van Hulst
  • Piet Souris
  • Ganesh Patekar
Bartenders:
  • Frits Walraven
  • Carey Brown
  • Tim Holloway

Tomcat sessions do not expire

 
Greenhorn
Posts: 10
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi.

I have several webapps running on Tomcat 5.5.23.
I have set the session expiry time to 60 minutes in my web.xml file.
Up until recently, this was working fine.
However, over the past month, the active sessions has been growing.
I am monitoring sessions using an HttpSessionBindingListener in the application and it is clear that sessions which are not explicitly logged out by the user are not timing out and are hanging about for weeks!!
This is now starting to give concern about memory usage, and also locks against records are not being released because the app thinks the user is still logged in !

I have no record of changing anything in the configuration which would cause this behaviour.
Are there any switches which would disable sessions timing out like this?
Can anyone suggest where I should start looking to fix this.

Aidan
[ June 05, 2008: Message edited by: Aidan hughes ]
 
Sheriff
Posts: 13411
Firefox Browser VI Editor Redhat
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Just grabbing at straws...

Do you have any references to static objects or objects that otherwise wouldn't be freed when your sessions expire (objects that are also bound to context scope or refereneced by an instance variable in a servlet)?

Moving to our Apache / Tomcat forum since this sounds like a container specific issue.
 
Aidan hughes
Greenhorn
Posts: 10
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Thanks Ben.

You might be grasping at straws, but it's a better idea than any I've had so far.
Also, yes - sorry - the Tomcat forum would of course been a better place to post this - I wasn't thinking straight.

I only ever place objects in the session, never application, page etc.
I destroy these objects every time I know a user is finished with them e.g. on return to the home page.
Users will often just close a browser window - this leaves objects in the session and the session still live.
It used to be, that when the session expired, these objects were destroyed and memory reclaimed.
Now that the sessions are not expiring, I'm just waiting for the applications to grind to a halt because of lack of available memory.

However, in terms of a static object referenced by an instance variable in a servlet, I did find a couple of database connection objects which I had not closed in a finally clause.
I've tidied these up and am hoping they might help - it's good to close them anyway.
However, I don't think this is the problem because each of them have been in place for much longer than I've had this problem.

Still looking for ideas !

Aidan.
 
Ben Souther
Sheriff
Posts: 13411
Firefox Browser VI Editor Redhat
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I'm not sure why I would do this but, if this were my issue, I would probably add a session listener that logs the sessionId when the sessions are created and when they are destroyed. It would be interested to know if the sessionDestroyed method even gets called and, if so, what else is being logged at that time.

Just to get any obvious stuff out of the way, make sure you don't have an catch blocks that do nothing. Every one of them, at a minimum, should log the exception being caught.
 
Aidan hughes
Greenhorn
Posts: 10
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Ben,

I currently log the session id in a database table every time a user logs on along with a timestamp.
I also record a timestamp when that session is invalidated.
I do this by having a HttpSessionBindingListener object and whenever a HttpSessionBindingEvent event fires I check whether it is a valueBound or valueUnbound and log accordingly.
When a user logs on, I see the logged session ID.
When a user logs off properly I see the timestamp recorded.
Up until recently, sessions were timing out after an hour of inactivity, and I could see the timestamps being updated.
The number of sessions active in Tomcat usually corelated to the number of log entries with no log out timestamp.
When I test this locally with a short timeout value, it all works well.
However, when I put it up on the server, the sessions no longer timeout.
My log file still corelates with the sessions in Tomcat - except it grows and grows and grows.
When I stop the application, all the sessions by default invalidate and my log file is updated with the timestamp - so I know the listener and destroy methods are working OK.

I think this is slightly different from what you have suggested.
What else would you log - and how would you do this?


As for empty catch blocks, I thought I was clean on this until I looked at my finally blocks.
In every one I have a line to close my database connections:
if ( conn!=null ) { try { conn.close(); } catch ( SQLException e6 ) {/**/} }
I have now fixed these up.
How could this affect sessions not timing out and why would this be considered bad practice?

Thanks,

Aidan.
 
Ben Souther
Sheriff
Posts: 13411
Firefox Browser VI Editor Redhat
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
If they're not bound to session, I don't think it would affect them.

If you have a catch block that doesn't log anything, you might never know when something is going wrong.
 
Aidan hughes
Greenhorn
Posts: 10
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi again.

OK - I've been monitoring this and I'm getting nowhere.
I've checked again - sessions are timing out exactly as I would expect on my dev PC under every scenario I can think of.
I'm therefore reasonably confident that the webapp itself is OK.
However, the sessions are not timing out on the server.
Both dev and server are the same version of Tomcat.
I'm leaning towards configuration differences.
Is there any way that I could have accidentally disabled timeouts in a configuration file somewhere other than my web.xml or context.xml files?

Thanks for your patience...

Aidan.
 
Greenhorn
Posts: 2
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi All,

i have similar problems with session hanging around and loking database records. I'm searching for that holy "button" to daectivate such sessions without restarting tomcat. Is there any hint to follow
 
Greenhorn
Posts: 19
jQuery Tomcat Server Java
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hello,

I've also the same problems. I've got an error ORA-00020: maximum number of processes (500) exceeded meaning the idle DB session are locking the DB. I also started a thread called "Tomcat - sessions do not expire" describing the same problem.

May I know:
- what version of Tomcat you use?
- how you ../conf/server.xml file looks like?
- how many (idle) sessions are active in your application?
- what happens when you logon in you application let the session expire and start working again with your application after the session should be expired?

Regards Wim
 
With a little knowledge, a cast iron skillet is non-stick and lasts a lifetime.
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
Boost this thread!