--- title: "Session garbage collection in PHP · Appnovation" url: "https://www.appnovation.com/insights/session-garbage-collection-php" description: "How PHP session garbage collection works on LAMP stacks and how to configure it to keep session storage clean and performant." --- Article # Session garbage collection in PHP [![](https://cdn.sanity.io/images/ey850001/production/36eb314260fb474cacc1b3a473d7e8402d997898-68x68.png?w=68&auto=format) Appno Blogger Appnovation Coop](/people/appno-blogger.md) Mar 15, 2010 3 min read ![Appnovation Blog Default Header](https://cdn.sanity.io/images/ey850001/production/9efe1c26d9584ecfb3dfef5a63e698bf4567d305-1440x600.jpg?w=1400&auto=format) Many of us are using the 'LAMP' system (Linux, Apache, Mysql, and PHP) for web development. Session is usually used by websites to keep track of various user related information across some period of time. PHP provides session garbage collection mechanism that ensures old unused sessions to be cleared regularly. This will help to prevent performance degrade due to filling up of session data and to reduce the risk of session hijacking as well. The parameters that control this garbage collection process are *session.gc\_maxlifetime*, *session.gc\_probability*, and *session.gc\_divisor* in the PHP configuration file php.ini. *session.gc\_maxlifetime* defines the number of seconds to be elapsed before session data is seen as garbage and cleaned up by the garbage collection process. It represents the minimum amount of time that garbage collection allows an inactive session to exist. *session.gc\_probability* and *session.gc\_divisor* define the probability that the garbage collection process is run on every session initialization. For example, if *session.gc\_probablility* is set to 1 and *session.gc\_divisor* is set to 100, then the probability of 0.01 (= *session.gc\_probability / session.gc\_divisor*) indicates that there is a 1% chance that the garbage collection process runs on each session initialization request. Setting the probability too high will add unnecessary processing load on the server whereas setting it too low may cause server performance to degrade due to large amount of stored session data (whether needed or not) and increase the risk of user reconnecting to an old unwanted session as well (whether maliciously or not). In [Drupal (opens in new window)](http://www.appnovation.com/technologies/drupal), the settings.php file uses `ini_set('session.gc_maxlifetime', 200000)` as its default configuration. You can modify this value together with some other parameters (eg. *session.cache\_expire*, *session.cache\_limiter*, *session.cookie\_lifetime*) to suit the particular needs of your website. One thing you might not have noticed is that in the Debian/Ubuntu distro, by default PHP disables its session garbage collection mechanism (eg. the default php.ini contains the line `;session.gc_probability = 0` in Ubuntu). Instead, it runs a cron job every half hour (see the script /etc/cron.d/php5) to purge session files in the /var/lib/php5/ directory. In most cases, this doesn't do the session cleanup job for us as session data may not be saved in files under the /var/lib/php5/ directory (like in Drupal). Thus by default PHP session garbage collection does not run in Debian/Ubuntu as many may expect. To solve this, you can modify the php.ini file by adding the line `session.gc_probability = 1` there. In Drupal, you can also change the settings.php file and add lines such as: `ini_set('session.gc_probability', 1); ini_set('session.gc_divisor', 100);` In Drupal, you can make use of the *session expire* module (http://drupal.org/project/session\_expire) as well to trim the sessions table regularly. [![](https://cdn.sanity.io/images/ey850001/production/36eb314260fb474cacc1b3a473d7e8402d997898-68x68.png?w=68&auto=format) Appno Blogger Appnovation Coop · Appnovation](/people/appno-blogger.md) ## Keep reading [![What is Sovereign AI](https://cdn.sanity.io/images/ey850001/production/a5889abdd5e80376912546622e046e3fbef234b4-2496x1664.png?w=640&auto=format)](/insights/what-is-open-source-sovereign-ai.md) Article · 7 min AI ### [What Is Open Source, Sovereign AI?](/insights/what-is-open-source-sovereign-ai.md) Every company is encouraging more AI, and almost every AI bill is climbing. Sovereign AI is about two kinds of control: over your data and over your costs. Here's why open source sits at its foundation. [Iain MacNeil](/people/iain-macneil.md) Article [![AI-first experience design](https://cdn.sanity.io/images/ey850001/production/8bbc2418e87924ef10f36115478a2e10d5bed95e-1584x624.jpg?w=640&auto=format)](/insights/how-build-ai-first-experience-without-throwing-out-everything-youve-already-built.md) Article · 6 min AI Sep 10, 2026 ### [How to Build an AI-First Experience Without Throwing Out Everything You've Already Built](/insights/how-build-ai-first-experience-without-throwing-out-everything-youve-already-built.md) Users now expect a direct answer, not a list of links to click through. Here's how organizations can layer an AI-First experience onto their existing website or app, in weeks rather than years. [Andrew Douglas](/people/andrew-douglas.md) Article [![What Becomes Possible When AI Can Read All the Data](https://cdn.sanity.io/images/ey850001/production/c28ab0bd26753421ee42937e13adc7a7f19b47f0-1296x510.jpg?w=640&auto=format)](/insights/what-becomes-possible-when-ai-can-read-all-data.md) Article · 4 min AI Sep 09, 2026 ### [What Becomes Possible When AI Can Read All the Data](/insights/what-becomes-possible-when-ai-can-read-all-data.md) Most of the world's data has never been analyzed, only sampled. AI changes that. How AI-ready data platforms unlock questions no one could ask before. [Appnovation](/people/appnovation.md) Article ## Get the thinking, *before everyone else.* One considered email a month. New essays, field notes from live engagements, and the occasional strong opinion. No noise.