is session timeout working correctly?

[Yoshiki Nishikimi]

Hi,

We have used memcached-session-manager for 3 years.
Recently I upgraded Tomcat to 7.0.68 and session timeout is not working correctly.

I think there are two problems.

First, the value of the element <session-timeout> in web.xml is not set to
_maxInactiveInterval in MemcachedBackupSessionManager.
 so a session be expired for 60 minutes every time although we specified
 a <session-timeout> element different value.
ex 1440 (1day)

Next, Tomcat 7.0.68, the value of <sesion-timeout> element is converted to seconds
in the method ManagerBase.createSession. Tomcat 7.0.68 or earlier, the value is converted

 in MangerBase.setContainer.
This 'createSession' method is overridden in memcached-session-manager.
To convert minutes to seconds, I think the superclass's method 'createSession' should be called
in subclass, MemcachedBackupSessionManager.createSession.

Please tell me your idea.

Waiting for your kind reply.

Regards,
Yoshiki.

[Martin Grotzke]

Hi Yoshiki,

which msm version are you running? There was a similar/related issue
with tomcat 7.0.68 reported here:
https://github.com/magro/memcached-session-manager/issues/287 - which
was resolved in 1.9.2

Cheers,
Martin

> --
>
> ---
> You received this message because you are subscribed to the Google
> Groups "memcached-session-manager" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to memcached-session-...@googlegroups.com
> <mailto:memcached-session-...@googlegroups.com>.
> For more options, visit https://groups.google.com/d/optout.

--
inoio gmbh - http://inoio.de
Schulterblatt 36, 20357 Hamburg
Amtsgericht Hamburg, HRB 123031
Geschäftsführer: Dennis Brakhane, Martin Grotzke, Ole Langbehn

[Yoshiki Nishikimi]

Hi Martin,

Thank you for your reply.

I'm running as described below.

Using.

 memcached-session-manager 1.9.2 (latest)

 Tomcat 7.0.68

Configuration.

   <Manager className="de.javakaffee.web.msm.MemcachedBackupSessionManager"
          memcachedNodes="n1:kvs-node-01:11211"
          requestUriIgnorePattern=".*\.(ico|png|gif|jpg|css|js)$"
          sticky="false"
          sessionBackupAsync="false"
  />

2016年4月25日月曜日 15時52分36秒 UTC+9 Yoshiki Nishikimi:

[Billy Bacon]

Hi Martin,

We are experiencing issues with user sessions expiring _way_ before they are specified to in our web.xml. It sounds like this issue was resolved in msm 1.9.2 for tomcat 7, according to this thread; is there a chance this wasn't ported into the tomcat 8 lib? We have an expiration of 8 hours in our web.xml...

<session-config>
   <session-timeout>480</session-timeout><!-- 480 minutes is 8 hours -->
</session-config>

I turned up the logging levels on both our Tomcat 8 servers to FINE level and found when my session was created and saved in memcached. Here's the logging statements.

26-Jul-2016 14:03:11.885 FINE [ContainerBackgroundProcessor[StandardEngine[Catalina]]] de.javakaffee.web.msm.MemcachedSessionService.updateExpirationInMemcached Checking session 828AE41C3AA9B0BB52ADC3CE758EEA05: 
- isValid: true
- isExpiring: false
- isBackupRunning: false
- isExpirationUpdateRunning: false
- wasAccessedSinceLastBackup: true
- memcachedExpirationTime: 1790

Looking at the source, that memcachedExpirationTime is in seconds. 1790 seconds is 29.5 minutes.

Am i looking in the right place? We are using the latest msm tc8 1.9.5.

Please let me know when you get a moment, we have this issue in production right now :-/

Thanks Martin!

- Billy -

[Billy Bacon]

Hi Martin,

Any chance you've had the opportunity to take a look at this issue or point me in the right direction?

- Billy -

[Martin Grotzke]

Hi Billy,

sorry, very busy atm, couldn't really work on my private inbox. I just had a look at the last related commit https://github.com/magro/memcached-session-manager/commit/eddf4c45c7a224516867a1b59f6610177a389ce1 - the change was similarly applied to tomcat 8.
The best would probably to have an automated test for this, as it seems there's none yet. Tomorrow I'm traveling and hopefully have time to look at this.
Which tomcat 8 are you currently running?

Cheers,
Martin

--

---
You received this message because you are subscribed to the Google Groups "memcached-session-manager" group.

To unsubscribe from this group and stop receiving emails from it, send an email to memcached-session-...@googlegroups.com.

[Billy Bacon]

Thanks Martin, apologies for continuing to hound you.

Server version: Apache Tomcat/8.0.35

Server built:   Jun 10 2016 17:49:21 UTC

Server number:  8.0.35.0

OS Name:        Linux

OS Version:     4.4.14-24.50.amzn1.x86_64

Architecture:   amd64

JVM Version:    1.8.0_91-b14

JVM Vendor:     Oracle Corporation

As a side note, I tried to duct tape this issue by setting the session-timeout in web.xml to -1, so the session wouldn't expire. I deployed this to production but sessions are still expiring, which is surprising to me since the memcachedExpirationTime is outputting 0.

28-Jul-2016 15:36:34.695 FINE [ContainerBackgroundProcessor[StandardEngine[Catalina]]] de.javakaffee.web.msm.MemcachedSessionService.updateExpirationInMemcached Checking session 61F7550BE22C7580CC44A1416260F3B1: 

- isValid: true

- isExpiring: false

- isBackupRunning: false

- isExpirationUpdateRunning: false

- wasAccessedSinceLastBackup: true

- memcachedExpirationTime: 0

Thank you for looking into this, I appreciate it.

- Billy -

To unsubscribe from this group and stop receiving emails from it, send an email to memcached-session-manager+unsub...@googlegroups.com.

[Martin Grotzke]

Ok, thanks. I'll give you an update tomorrow.

Cheers,
Martin

To unsubscribe from this group and stop receiving emails from it, send an email to memcached-session-...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

---
You received this message because you are subscribed to the Google Groups "memcached-session-manager" group.

To unsubscribe from this group and stop receiving emails from it, send an email to memcached-session-...@googlegroups.com.

[Martin Grotzke]

Hi Billy,

I think I found the issue, and just released 1.9.6 with the fix.

The last related commit introduced the issue because tomcat now no
longer invokes Manager.setMaxInactiveInterval, so that the configured
session timeout simply didn't reach msm.

Cheers,
Martin

> Billy Bacon <billy...@gmail.com <javascript:>> schrieb am Do., 28.

> memcached-session-...@googlegroups.com
> <javascript:>.

> For more options, visit https://groups.google.com/d/optout

> <https://groups.google.com/d/optout>.

>
> --
>
> ---
> You received this message because you are subscribed to the Google
> Groups "memcached-session-manager" group.
> To unsubscribe from this group and stop receiving emails from it, send

> an email to memcached-session-...@googlegroups.com
> <mailto:memcached-session-...@googlegroups.com>.

> For more options, visit https://groups.google.com/d/optout.

[Billy Bacon]

Thank you, Martin! I will bring this down and test this out this afternoon. Much appreciated!

To unsubscribe from this group and stop receiving emails from it, send an email to memcached-session-...@googlegroups.com.

[Billy Bacon]

This 1.9.6 release has resolved the issue, Martin. Thanks for resolving this!

- Billy -

[Martin Grotzke]

Great to hear!