Tomcat sessions expiring unexpectedly

Question

We are running tomcat application server that handle over 100 concurrent sessions. In the last 2 months the most active users noticed that sometimes they are getting kicked

Answer 1

I would increase the monitoring of the server in general and the sessions specifically.

A good monitoring application is lambda probe - it allows you to view the current sessions and their data. I would also add a HttpSessionListener to log session creation and destruction.

Edit

Is is possible that you add some non serializble objects to the session and Tomcat fails to passivate them to the disk?

Edit 2

Lambda probe seems to be dead, and there a much better fork of the project over at http://code.google.com/p/psi-probe/

Answer 2

If there has been no code chance triggering this, I would look at memory usage. This might be the effect of Tomcat running out of memory and invalidating sessions to recover.

If at all possible monitor garbage collections, and/or put surveillance on with jconsole or jvisualvm.

Answer 3

We just ran into this with tomcat 6_0_18 and ibm 1.5 jvm

turns out it was an ibm jvm issue with atomic operations.

There is a fix in tomcats greater than 6_0_19 to handle it.

It also doesn't occur in sun 1.5 jvm

here are some more details

tomcat bugzilla case

Answer 4

I have seen similar problems when the following prerequisites exist:

• multiple instances of the tomcat app are installed across multiple JVMs
• load balancing (between the web server and the Tomcat JVMs) is not configured correctly.
• Tomcat's session replication feature is not enabled

Due to the incorrect load balancing config, the web server may randomly decide to break session affinity and send an incoming request to a Tomcat JVM that has never seen the session before. The Tomcat JVM will issue a new session and the user will lose all of their previouS session data and effectively start over.

Answer 5

A possible cause is that you put in the session an object that does NOT implement the Serializable interface. Tomcat occasionally writes some of the sessions on the disk. If a session contains non-serializable objects it will simply be removed from the container (because of the NotSerializableException). If this is happening you should see the Exception in the tomcat log file.

Answer 6

Increase your logging of sessions, which may shed some light onto your problem.

The Tomcat config page's Logging in Tomcat includes an example of increasing logging of sessions.