Garbage collector problem with sessions

[deciacco]

The code below works as expected on my ubuntu linux server 7.04
with LAMP installation.(out of the box)

The problem is on my Windows 2k3 Server. It seems
the garbage collector never deletes the session file, or deletes
it and recreates it immediately, so the script never gets to
the "setting session variable" after the first time.

I'm using php 5.2.4 isapi.

("\\" is used in $sessdir for windows. only difference.)

I've searched google, and read the sessions pages on php.net.
Any ideas? Something I might have missed?

Thanks!

*************
<?php
$sessdir = ini_get('session.save_path')
."/session_testing";

if (!is_dir($sessdir)) {
mkdir($sessdir, 07777);
}

ini_set('session.save_path', $sessdir);
ini_set('session.gc_probability', 100);
ini_set('session.gc_divisor', 100);
ini_set('session.gc_maxlifetime', 5);

session_start();

if(isset($_SESSION['isalive']))
{
echo "now wait for 5 seconds and refresh twice";
echo "<br>on the second refresh ";
echo "the session will be set again";
echo "<br>because the session data file would";
echo " have been deleted by the gc";
}else{
echo "setting session variable....";
$_SESSION['isalive'] = true;
echo "<br>set!...now refresh...";
}
?>
**************

session settings in ini:
---------------------------

Session Support enabled
Registered save handlers files user memcache sqlite
Registered serializer handlers php php_binary wddx

Directive Local Value Master Value
session.auto_start Off Off
session.bug_compat_42 Off Off
session.bug_compat_warn On On
session.cache_expire 180 180
session.cache_limiter nocache nocache
session.cookie_domain no value no value
session.cookie_httponly Off Off
session.cookie_lifetime 0 0
session.cookie_path / /
session.cookie_secure Off Off
session.entropy_file no value no value
session.entropy_length 0 0
session.gc_divisor 1000 1000
session.gc_maxlifetime 1440 1440
session.gc_probability 1 1
session.hash_bits_per_character 5 5
session.hash_function 1 1
session.name PHPSESSID PHPSESSID
session.referer_check no value no value
session.save_handler files files
session.save_path C:\PHP\sessiondata C:\PHP\sessiondata
session.serialize_handler php php
session.use_cookies On On
session.use_only_cookies Off Off
session.use_trans_sid 0 0

[Vladimir Ghetau]

can you add error_reporting (E_ALL) at the begining of the script and
see what happens?
Plus, how about this line:

mkdir($sessdir, 07777);

Plus, (even if modes are ignored in Windows) it seems the writing
permissions are written incorrectly.

Next thing,

$sessdir = ini_get('session.save_path')
."/session_testing";

Probably session.save_path outputs something like:

drive:\php_folder\tmp/session_testing

*** see the slashes difference? try to switch the slashes based on the
OS you're using.

Everything should be ok at this step.
Best luck!

Vladimir Ghetau

[deciacco]

Thanks for your time/response.

07777 was a typo in the post but not in the script itself. Thanks for
pointing it out.

On the windows box I use the correct slash as I mentioned in the post
already, but thanks for this as well.

I will put the error_reporting call at the beginning of the script and
see if that shows anything. Didn't think of it...
Vladimir Ghetau wrote:

can you add error_reporting (E_ALL) at the begining of the script and
see what happens?
Plus, how about this line:

>mkdir($sessdir, 07777);

Plus, (even if modes are ignored in Windows) it seems the writing
permissions are written incorrectly.

Next thing,

>$sessdir = ini_get('session.save_path')
."/session_testing";

Probably session.save_path outputs something like:

>drive:\php_folder\tmp/session_testing

*** see the slashes difference? try to switch the slashes based on the
OS you're using.

Everything should be ok at this step.
Best luck!

Vladimir Ghetau

[deciacco]

Still does not work. Below is the updated code. (This is the Windows
code. The linux code just changes the slashes) I can see the session
file being created, but it never gets deleted. I don't get any errors
with the E_ALL setting. After I start the session the first time, if I
keep refreshing before the 5 seconds are up, the session stays alive as
it should. After 5 seconds the file should be deleted by the GC and the
file_exists($filepath) should return false. This is the behavior on
linux but not on windows. The permissions are set correctly for the
sessions folder. The IUSR has full modify access, so I'm pretty sure
it's not a permissions issue. This is a win 2k3 box with ntfs and
filemtime() works fine. I've even tried a custom session handler storing
to a database, and I get the same behavior.

Could this be a bug?

****************************
<?php
error_reporting(E_ALL);

$sessdir = ini_get('session.save_path')."\\session_testing";

if (!is_dir($sessdir)) {
mkdir($sessdir);
}

ini_set('session.save_path', $sessdir);
ini_set('session.gc_probability', 100);
ini_set('session.gc_divisor', 100);
ini_set('session.gc_maxlifetime', 5);

session_start();

if(isset($_SESSION['isalive']))
{
echo <<<END
Now wait for 5 seconds and refresh twice.<br><br>

On the first refresh the "Session Established"
line will dissapear<br>
because the session data(file)
is deleted by the GC.<br><br>

On the second refresh a new session
will be created and the 'isalive'<br>
session varible set again.<br><br>

If you keep refreshing before the 5 seconds are up<br>
the session doesn't die becuse the session date(file)<br>
never has a chance to expire.<br><br>
END;

$filepath = ini_get('session.save_path')
.'\\sess_'.session_id();

if(file_exists($filepath))
{
$filetime = filemtime ($filepath);
$timediff = mktime() - $filetime;
echo 'Session Established: '
.$timediff.' seconds ago<br><br>';
}
}else{
echo "Setting session variable isalive....";
$_SESSION['isalive'] = true;
echo "<br>Set!...Now refresh...";
}
?>
***********************

Vladimir Ghetau wrote:

can you add error_reporting (E_ALL) at the begining of the script and
see what happens?
Plus, how about this line:

>mkdir($sessdir, 07777);

Plus, (even if modes are ignored in Windows) it seems the writing
permissions are written incorrectly.

Next thing,

>$sessdir = ini_get('session.save_path')
."/session_testing";

Probably session.save_path outputs something like:

>drive:\php_folder\tmp/session_testing

*** see the slashes difference? try to switch the slashes based on the
OS you're using.

Everything should be ok at this step.
Best luck!

Vladimir Ghetau

[C.]

On 4 Sep, 20:00, deciacco <a@awrote:

Still does not work.

<snip>

You have no idea what your code / system code is doing. You should:

1) setup logging properly on your system
2) configure PHP to log everything
3) add your own logging within the code
4) consider writing your own session handler (you're half-way there
already)

C.

[Vladimir Ghetau]

On Sep 4, 8:00 pm, deciacco <a@awrote:

Still does not work. Below is the updated code. (This is the Windows
code. The linux code just changes the slashes) I can see the session
....

The thing is, I tried your code and it worked after I made those
changes on my local windows box, that's how I came with the
suggestions.

I think you should try things like:

- setting the ini settings directly in php.ini
- do more debugging, step by step (e.g. try the sessions without
setting a particular path, use default one; next thing would be trying
to see what happens if 'session.gc_maxlifetime' is not set and so on);
- when doing an ini_set, try an ini_get and see if the value is really
set
This is what I would do, the code is cool as it is now

Best!

Vladimir Ghetau

------------------------------
http://www.vladimirated.com

[deciacco]

I will try to enable better logging.
Thanks.

C. wrote:

On 4 Sep, 20:00, deciacco <a@awrote:

>Still does not work.

<snip>

You have no idea what your code / system code is doing. You should:

1) setup logging properly on your system
2) configure PHP to log everything
3) add your own logging within the code
4) consider writing your own session handler (you're half-way there
already)

C.

[deciacco]

What I found with the UPDATED code, is that the GC does indeed delete
session files, but it does not delete the file associated with the
current session. In other words...

Imagine the script running in two different browsers, browser A and
browser B. In bA you continually refresh so not to let the session
expire. In bB you let the session expire by not touching it for more
than, in this case, 10 seconds. When you refresh bB after 10 seconds
you'll see that the session restarts because the GC from bA has deleted
the session file of bB. If you didn't have bA running, the session in bB
would just continue.

This is fine in an enviroment with many hits, but in an app that only
has one user or one user at any given time, it does not work.

I tried writing a custom session handler with a database, but this
yielded the same results. What I ended up using is basically my own GC
script. The script deletes "expired" session files manually and I set it
to run before every session_start(). This seemed to work just fine. I
could have even gone as far as putting in probability, but since this is
really a few-user app at most, it doesn't really matter.

I am curious to know more about your php configuration on Windows.
What version of Windows/Php, Cgi or Asapi, etc, etc.

I used these instructions to setup php on my win 2k3 server.
http://www.peterguy.com/php/install_IIS6.html

For what it's worth, I've tested this on another Windows box with the
same setup and I get the same results, so this leads me to believe that
it's something wrong with the way I'm setting up php, or perhaps a bug
in Php in Windows.

Vladimir Ghetau wrote:

On Sep 4, 8:00 pm, deciacco <a@awrote:

>Still does not work. Below is the updated code. (This is the Windows
code. The linux code just changes the slashes) I can see the session
....

The thing is, I tried your code and it worked after I made those
changes on my local windows box, that's how I came with the
suggestions.

I think you should try things like:

- setting the ini settings directly in php.ini
- do more debugging, step by step (e.g. try the sessions without
setting a particular path, use default one; next thing would be trying
to see what happens if 'session.gc_maxlifetime' is not set and so on);
- when doing an ini_set, try an ini_get and see if the value is really
set
This is what I would do, the code is cool as it is now

Best!

Vladimir Ghetau

------------------------------
http://www.vladimirated.com