Many of us are using the 'LAMP' system (Linux, Apache, Mysql, and PHP) for web development. Session is usually used by websites to keep track of various user related information across some period of time. PHP provides session garbage collection mechanism that ensures old unused sessions to be cleared regularly. This will help to prevent performance degrade due to filling up of session data and to reduce the risk of session hijacking as well.
The parameters that control this garbage collection process are session.gc_maxlifetime, session.gc_probability, and session.gc_divisor in the PHP configuration file php.ini. session.gc_maxlifetime defines the number of seconds to be elapsed before session data is seen as garbage and cleaned up by the garbage collection process. It represents the minimum amount of time that garbage collection allows an inactive session to exist. session.gc_probability and session.gc_divisor define the probability that the garbage collection process is run on every session initialization. For example, if session.gc_probablility is set to 1 and session.gc_divisor is set to 100, then the probability of 0.01 (= session.gc_probability / session.gc_divisor) indicates that there is a 1% chance that the garbage collection process runs on each session initialization request. Setting the probability too high will add unnecessary processing load on the server whereas setting it too low may cause server performance to degrade due to large amount of stored session data (whether needed or not) and increase the risk of user reconnecting to an old unwanted session as well (whether maliciously or not).
In Drupal, the settings.php file uses ini_set('session.gc_maxlifetime', 200000) as its default configuration. You can modify this value together with some other parameters (eg. session.cache_expire, session.cache_limiter, session.cookie_lifetime) to suit the particular needs of your website. One thing you might not have noticed is that in the Debian/Ubuntu distro, by default PHP disables its session garbage collection mechanism (eg. the default php.ini contains the line ;session.gc_probability = 0 in Ubuntu). Instead, it runs a cron job every half hour (see the script /etc/cron.d/php5) to purge session files in the /var/lib/php5/ directory. In most cases, this doesn't do the session cleanup job for us as session data may not be saved in files under the /var/lib/php5/ directory (like in Drupal). Thus by default PHP session garbage collection does not run in Debian/Ubuntu as many may expect. To solve this, you can modify the php.ini file by adding the line session.gc_probability = 1 there. In Drupal, you can also change the settings.php file and add lines such as:
ini_set('session.gc_probability', 1);
ini_set('session.gc_divisor', 100);
In Drupal, you can make use of the session expire module (http://drupal.org/project/session_expire) as well to trim the sessions table regularly.
Comments
Very great article there. I am learning a lot these days about different CMS and this article was totally helpful. Moreover this article helped me to understand sessions.
Thank you
Quote: "by default PHP disables its session garbage collection mechanism ... [with] the line ;session.gc_probability = 0".
This does not disable it (it is commented out). The default within the engine is still used - phpinfo() shows the value to be 1. There is a problem with garbage collection in Debian (and thus Ubuntu) but that's due to PHP wanting to vacuum garbage that has already been removed by the cron script. This causes an error that may be displayed on the unlucky page.
Interesting, I am storing my sessions in a databse. So, I have written my own garbage collection, but it was not called enough. After tweaking gc_probability and gc_divisor I was able to keep my session table a little leaner. However, now I am considering just making this a cron job (as occurs in the Ubuntu/Debian distros) so that some unlucky user doesn't land on the page and have to wait for garbage collection. It isn't slow per se, but with thousands of sessions it can add a little bit of wait time to the page. Anyways, thanks for the article.
Post new comment