Timeout value & session variables

=?Utf-8?B?ZG91Zw==?=

I support several intranet sites one of which had NO STATE. Even though
content has ASP extensions, it was all rendered HTML. Site had NO session or
application variables being managed. Site had no global.asa. IIS Manager
had site timeout set to 20 minutes.

We had to add an ASP include to pages, and that ASP include contained our
first session variable. Users then started complaining of timeouts and being
redirected to logout pages because session variable evaporated. Users
requested a 4 hour - 240 minute timeout. This was set in IIS Manager on
site, and it didn't work. We added global.asa with timeout set in session
on_start routine, and even though we could display the timeout variable at
240 minutes, if we wait 30 minutes and pressed refresh on page displayed, it
took logic path indicating session variable no longer set.

Anyone know why we are experiencing this behavior?

Jul 25 '07 #1

Anthony Jones

"doug" <dm*****@newsgroups.nospamwrote in message
news:0A**********************************@microsof t.com...

I support several intranet sites one of which had NO STATE. Even though
content has ASP extensions, it was all rendered HTML. Site had NO session

or

application variables being managed. Site had no global.asa. IIS Manager
had site timeout set to 20 minutes.

We had to add an ASP include to pages, and that ASP include contained our
first session variable. Users then started complaining of timeouts and

being

redirected to logout pages because session variable evaporated. Users
requested a 4 hour - 240 minute timeout. This was set in IIS Manager on
site, and it didn't work. We added global.asa with timeout set in session
on_start routine, and even though we could display the timeout variable at
240 minutes, if we wait 30 minutes and pressed refresh on page displayed,

it

took logic path indicating session variable no longer set.

Anyone know why we are experiencing this behavior?

Most likely the application pool is recycling.

Take a look at the properties of the Application pool the site runs in. You
will probably need to adjust the recycling and preformance tabs so that the
workprocess is not recycled on a regular basis during normal use and that
the idle timeout is longer than the session timeout you require.

--
Anthony Jones - MVP ASP/ASP.NET

Jul 26 '07 #2

WenJun Zhang[msft]

Hi,

If this is a Windows 2003 IIS 6.0 server, please check the site's
application pool property. Verify the setting 'Shutdown worker processes
after being idle for(time in minutes)'.

The default setting of IIS6 is to shut down worker processes(web site/app
pool instances) if there is no new requests come in for 20 mins. In this
case, all the in-process sessions will be lost.

Thanks.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscripti...t/default.aspx.

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Jul 26 '07 #3

=?Utf-8?B?ZG91Zw==?=

That was it. Thanks. I have to say I'm not a big fan of overlapping options
of this nature.

doug

"Anthony Jones" wrote:

"doug" <dm*****@newsgroups.nospamwrote in message
news:0A**********************************@microsof t.com...

I support several intranet sites one of which had NO STATE. Even though
content has ASP extensions, it was all rendered HTML. Site had NO session

or

application variables being managed. Site had no global.asa. IIS Manager
had site timeout set to 20 minutes.

We had to add an ASP include to pages, and that ASP include contained our
first session variable. Users then started complaining of timeouts and

being

redirected to logout pages because session variable evaporated. Users
requested a 4 hour - 240 minute timeout. This was set in IIS Manager on
site, and it didn't work. We added global.asa with timeout set in session
on_start routine, and even though we could display the timeout variable at
240 minutes, if we wait 30 minutes and pressed refresh on page displayed,

it

took logic path indicating session variable no longer set.

Anyone know why we are experiencing this behavior?

Most likely the application pool is recycling.

Take a look at the properties of the Application pool the site runs in. You
will probably need to adjust the recycling and preformance tabs so that the
workprocess is not recycled on a regular basis during normal use and that
the idle timeout is longer than the session timeout you require.

--
Anthony Jones - MVP ASP/ASP.NET

Jul 26 '07 #4

=?Utf-8?B?ZG91Zw==?=

This was it thanks.

doug

""WenJun Zhang[msft]"" wrote:

Hi,

If this is a Windows 2003 IIS 6.0 server, please check the site's
application pool property. Verify the setting 'Shutdown worker processes
after being idle for(time in minutes)'.

The default setting of IIS6 is to shut down worker processes(web site/app
pool instances) if there is no new requests come in for 20 mins. In this
case, all the in-process sessions will be lost.

Thanks.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscripti...t/default.aspx.

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Jul 26 '07 #5

=?Utf-8?B?ZG91Zw==?=

I'm not going to pretent I understand the nuances of this seeming overlapping
set of options. I'm in an applications group and we have moved to IIS6 as
part of a reband a year or so ago, and given tightened budgets in training,
our training went to more direct skill needs. Don't these various settings
in the app pool imply a depreciation of the site session timeout value? We
had hoped to control our production timeout issue from the application side
in that we can do an overnight content update via a new global.asa rather
than go thru a 10 day lead time to request/implement changes to a web site
from the server.

""WenJun Zhang[msft]"" wrote:

Hi,

If this is a Windows 2003 IIS 6.0 server, please check the site's
application pool property. Verify the setting 'Shutdown worker processes
after being idle for(time in minutes)'.

The default setting of IIS6 is to shut down worker processes(web site/app
pool instances) if there is no new requests come in for 20 mins. In this
case, all the in-process sessions will be lost.

Thanks.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscripti...t/default.aspx.

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Jul 26 '07 #6

Anthony Jones

"doug" <dm*****@newsgroups.nospamwrote in message
news:8A**********************************@microsof t.com...

I'm not going to pretent I understand the nuances of this seeming

overlapping

set of options. I'm in an applications group and we have moved to IIS6 as
part of a reband a year or so ago, and given tightened budgets in

training,

our training went to more direct skill needs. Don't these various

settings

in the app pool imply a depreciation of the site session timeout value?

We

had hoped to control our production timeout issue from the application

side

in that we can do an overnight content update via a new global.asa rather
than go thru a 10 day lead time to request/implement changes to a web site
from the server.

A very active application pool would never shutdown due to an idle timeout.
However individual sessions associated with an application in the pool may
be abandoned due to inactivity from individual clients.

Application pool idle also applies more broadly than to just ASP to include
anything which requires handling by filters or other script engines. Which
is pretty much most things.

Also a single application pool can contain several distinct applications.
All applications in the pool would have to be idle for the timeout to take
effect. Each application may use its own ASP Session settings.

There is an overlap but more in an umbrella sort of way than in a
deprecating way.
You may have a pool with an 4 hour timeout and containing two ASP
applications one which also has a 4 hour timeout for its sessions and
another where 15 mins is more appropriate. It would be annoying if you
could only set the timeout on the application pool.
--
Anthony Jones - MVP ASP/ASP.NET

Jul 26 '07 #7

=?Utf-8?B?ZG91Zw==?=

That is one perspective. The other, ours, is our users made a good case for
needing a 4 hour session. By your thinking, we would need to adjust the app
pool timeouts to 4 hours (minimum) and then allow individual sites to tune
their respective timeout to values less than 4 hours. I'm not sure I
appreciate the umbrella nature provided if it means I need to effectively
nullify the umbrella by setting the value so high to accomodate users session
timeout needs.

But I will look into learning more about IIS6 and the features it offers.

Thanks for the insight.

"Anthony Jones" wrote:

"doug" <dm*****@newsgroups.nospamwrote in message
news:8A**********************************@microsof t.com...

I'm not going to pretent I understand the nuances of this seeming

overlapping

set of options. I'm in an applications group and we have moved to IIS6 as
part of a reband a year or so ago, and given tightened budgets in

training,

our training went to more direct skill needs. Don't these various

settings

in the app pool imply a depreciation of the site session timeout value?

We

had hoped to control our production timeout issue from the application

side

in that we can do an overnight content update via a new global.asa rather
than go thru a 10 day lead time to request/implement changes to a web site
from the server.

A very active application pool would never shutdown due to an idle timeout.
However individual sessions associated with an application in the pool may
be abandoned due to inactivity from individual clients.

Application pool idle also applies more broadly than to just ASP to include
anything which requires handling by filters or other script engines. Which
is pretty much most things.

Also a single application pool can contain several distinct applications.
All applications in the pool would have to be idle for the timeout to take
effect. Each application may use its own ASP Session settings.

There is an overlap but more in an umbrella sort of way than in a
deprecating way.
You may have a pool with an 4 hour timeout and containing two ASP
applications one which also has a 4 hour timeout for its sessions and
another where 15 mins is more appropriate. It would be annoying if you
could only set the timeout on the application pool.
--
Anthony Jones - MVP ASP/ASP.NET

Jul 26 '07 #8

Bob Barrows [MVP]

doug wrote:

That is one perspective. The other, ours, is our users made a good
case for needing a 4 hour session.

Actually, it sounds to me as if they've made a strong case for storing state
in a database rather than in Session.
--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

Jul 26 '07 #9

=?Utf-8?B?ZG91Zw==?=

You couldn't be more wrong. Until this requirement change to use this one
single session variable, the server was "stateless". All content rendered
and reposted nightly. No external connections allowed, no databases on
server used. And until then, because sessions didn't appear to die, at least
no symptoms, users had never experienced a timeout. And after long, quick
discussions they decided on 240 minute (4 hour) timeout.

All the other sites supported that have dynamic content seem to have
timeouts set to 20 minutes or less so we hadn't seen it. This sight, by the
nature of it, is just used a different way.
"Bob Barrows [MVP]" wrote:

doug wrote:

That is one perspective. The other, ours, is our users made a good
case for needing a 4 hour session.

Actually, it sounds to me as if they've made a strong case for storing state
in a database rather than in Session.
--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

Jul 26 '07 #10

Bob Barrows [MVP]

You're missing my point, but I'm not going to argue with you.

doug wrote:

You couldn't be more wrong. Until this requirement change to use
this one single session variable, the server was "stateless". All
content rendered and reposted nightly. No external connections
allowed, no databases on server used. And until then, because
sessions didn't appear to die, at least no symptoms, users had never
experienced a timeout. And after long, quick discussions they
decided on 240 minute (4 hour) timeout.

All the other sites supported that have dynamic content seem to have
timeouts set to 20 minutes or less so we hadn't seen it. This sight,
by the nature of it, is just used a different way.
"Bob Barrows [MVP]" wrote:

>doug wrote:

>>That is one perspective. The other, ours, is our users made a good
case for needing a 4 hour session.

Actually, it sounds to me as if they've made a strong case for
storing state in a database rather than in Session.
--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so
I don't check it very often. If you must reply off-line, then remove
the "NO SPAM"

--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

Jul 26 '07 #11

Jon Paal [MSMD]

There is no justification for a 4 hour timeout.

If folks need to keep their session alive for one stinking session variable, then have that page auto refresh or store that one
value in a cookie.


"doug" <dm*****@newsgroups.nospamwrote in message news:BC**********************************@microsof t.com...

You couldn't be more wrong. Until this requirement change to use this one
single session variable, the server was "stateless". All content rendered
and reposted nightly. No external connections allowed, no databases on
server used. And until then, because sessions didn't appear to die, at least
no symptoms, users had never experienced a timeout. And after long, quick
discussions they decided on 240 minute (4 hour) timeout.

All the other sites supported that have dynamic content seem to have
timeouts set to 20 minutes or less so we hadn't seen it. This sight, by the
nature of it, is just used a different way.
"Bob Barrows [MVP]" wrote:

>doug wrote:

That is one perspective. The other, ours, is our users made a good
case for needing a 4 hour session.

Actually, it sounds to me as if they've made a strong case for storing state
in a database rather than in Session.
--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

Jul 26 '07 #12

WenJun Zhang[msft]

Hi,

For a busy production site, generally the application pool idle shutdown
setting will not affect session state since there are always new requests
come in and *ping* the worker process.

Actually the idle auto shutting down function is very important on server
health because application pool can have multiple worker process instance
in IIS 6.0 worker process mode. Based on these new health/recycling
features of application pool, sometime web applications with small
flaws(e.g occasional memory leak, deadlock, etc) can still *work* on IIS6
but will fail on IIS 5.x or eariler.

In this specific case, I'd suggest you adjust the idle shutdown time to a
value greater than 4 hours instead of disabling it.

Please let me know if you have more concern on this.

Thanks.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscripti...t/default.aspx.

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Jul 27 '07 #13

WenJun Zhang[msft]

Just want to check if you have any further question or concern on this?

Have a great day.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscripti...t/default.aspx.

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Jul 31 '07 #14