What is the default location of session files on an installation of Apache/PHP on Ubuntu 10.10?
8 Answers
The default session.save_path
is set to ""
which will evaluate to your system's temp directory. See this comment at https://bugs.php.net/bug.php?id=26757 stating:
The new default for save_path in upcoming releaess (sic) will be the empty string, which causes the temporary directory to be probed.
You can use sys_get_temp_dir
to return the directory path used for temporary files
To find the current session save path, you can use
Refer to this answer to find out what the temp path is when this function returns an empty string.
-
74And from the command line just do php -r 'echo session_save_path(), "\n";' Commented Aug 10, 2011 at 21:12
-
The location is set and not 'default' under Ubuntu 10.10. A clean build of PHP may give you this, but not under any Debian/Ubuntu builds I have used. The orig question pertains to Ubuntu 10.10. So, just look it up on command line per last comment (or my answer) as location can differ from 'default'/blank/tmp depending on Linux distribution used..– B. SheaCommented Apr 5, 2017 at 13:00
-
5Warning!! I think running php -r 'echo session_save_path(), "\n";' as mentioned above will use a different php.ini file (perhaps /etc/php/7.0/cli/php.ini instead of /etc/php/7.0/apache2/php.ini), and therefore might have a different value of "session.save_path"– MagmaticCommented May 23, 2018 at 19:22
-
@Magmatic is correct, there are TWO
php.ini
files,php_info()
will tell you which one is in use during the current eval, andlocate php.ini
will help you find them– JonathanCommented Dec 5, 2018 at 20:33 -
Please note (as per last 2 comments): Using the CLI PHP version (command line) can produce different results depending on distro and compile. The main thing is it is NOT the Apache version. (Though the INI files may be identical as far as session paths). Better to look in/grep proper Apache PHP.INI.– B. SheaCommented Jun 27, 2019 at 19:45
First check the value of session.save_path
using ini_get('session.save_path')
or phpinfo()
. If that is non-empty, then it will show where the session files are saved. In many scenarios it is empty by default, in which case read on:
On Ubuntu or Debian machines, if session.save_path
is not set, then session files are saved in /var/lib/php5
.
On RHEL and CentOS systems, if session.save_path
is not set, session files will be saved in /var/lib/php/session
I think that if you compile PHP from source, then when session.save_path
is not set, session files will be saved in /tmp
(I have not tested this myself though).
-
1I'm using Ubuntu 12.04.5 LTS and, for some reason (I have not changed anything in
php.ini
) my sessions are under/var/lib/php5/sessions
– FelipeCommented Jan 30, 2015 at 19:35 -
1"Not set"? It is set - but commented out in php.ini. This does not mean it doesn't have a value or isn't 'set'.. From command line just do:
php -i | grep session.save_path
for CLI (and probably Apache) session save path. Also, a givenphp.ini
will normally show the 'default' path - it's just commented out.– B. SheaCommented Apr 5, 2017 at 13:09 -
And yes: if nothing compiled in as default path (not the case with most distributions), a blank will be used (compile default). Which would then use the system temp area (normally
/tmp
) as its fallback/default value. Please refer to php.net/manual/en/…– B. SheaCommented Apr 5, 2017 at 13:16 -
-
DEFAULT Ubuntu 16.04 :
/etc/php/7.0/*/php.ini
->;session.save_path = "/var/lib/php/sessions"
-- A comment doesn't mean 'not set' is all I meant. It is set obviously to something other than 'blank' (/tmp).. and is NOT an empty/null string– B. SheaCommented Apr 10, 2017 at 16:23
If unsure of compiled default for session.save_path
, look at the pertinent php.ini
.
Normally, this will show the commented out default value.
Ubuntu/Debian old/new php.ini
locations:
Older php5 with Apache: /etc/php5/apache2/php.ini
Older php5 with NGINX+FPM: /etc/php5/fpm/php.ini
Ubuntu 16+ with Apache: /etc/php/*/apache2/php.ini
*
Ubuntu 16+ with NGINX+FPM - /etc/php/*/fpm/php.ini
*
* /*/
= the current PHP version(s) installed on system.
To show the PHP version in use under Apache:
$ a2query -m | grep "php" | grep -Eo "[0-9]+\.[0-9]+"
7.3
Since PHP 7.3 is the version running for this example, you would use that for the php.ini
:
$ grep "session.save_path" /etc/php/7.3/apache2/php.ini
;session.save_path = "/var/lib/php/sessions"
Or, combined one-liner:
APACHEPHPVER=$(a2query -m | grep "php" | grep -Eo "[0-9]+\.[0-9]+") && grep ";session.save_path" /etc/php/${APACHEPHPVER}/apache2/php.ini
Result:
;session.save_path = "/var/lib/php/sessions"
Or, use PHP itself to grab the value using the "cli" environment (see NOTE below):
$ php -r 'echo session_save_path() . "\n";'
/var/lib/php/sessions
$
These will also work:
php -i | grep session.save_path
php -r 'echo phpinfo();' | grep session.save_path
NOTE:
The 'cli' (command line) version of php.ini
normally has the same default values as the Apache2/FPM versions (at least as far as the session.save_path
). You could also use a similar command to echo the web server's current PHP module settings to a webpage and use wget/curl to grab the info. There are many posts regarding phpinfo()
use in this regard. But, it is quicker to just use the PHP interface or grep
for it in the correct php.ini
to show it's default value.
EDIT: Per @aesede comment -> Added php -i
. Thanks
-
8Just FYI you can do
php -i
in CLI to get phpinfo() equivalent.– aesedeCommented Oct 27, 2015 at 19:24
Another common default location besides /tmp/
is /var/lib/php5/
-
How come the /var/lib/php5/ is never writable and requires chmodding/chowning. Shouldn't PHP set the session location that is writable by default? Commented Jan 17, 2014 at 10:38
-
2I imagine it is so on shared hosts other people cannot attempt to hijack peoples sessions. Ie, write to session saying "username:admin" and setting an arbitrary session ID, then setting PHPSESSID to that. Would be a very easy was to access something like Drupal or Wordpress on a shared host environment. (It would just log you in as the admin account) Commented Apr 1, 2014 at 23:17
I had the same trouble finding out the correct path for sessions on a Mac. All in all, I found out that the CLI PHP has a different temporary directory than the Apache module: Apache used /var/tmp
, while CLI used something like /var/folders/kf/hk_dyn7s2z9bh7y_j59cmb3m0000gn/T
. But both ways, sys_get_temp_dir()
got me the right path when session.save_path
is empty. Using PHP 5.5.4.
Non of the above worked for me using the IUS repo for CentOS 7 with PHP 7.2:
php -v
> PHP 7.2.30 (cli) (built: Apr 19 2020 00:32:29) ( NTS )
php -r 'echo session_save_path(), "\n";
>
php -r 'echo sys_get_temp_dir(), "\n";'
> /tmp
However, sessions weren't saved in the /tmp
folder, but in the /var/lib/php/mod_php/session/
folder:
ls /var/lib/php/mod_php/session/
> sess_3cebqoq314pcnc2jgqiu840h0k sess_ck5dtaerol28fpctj6nutbn6fn sess_i24lgt2v2l58op5kfmj1k6qb3h sess_nek5q1alop8fkt84gliie91703
> sess_9ff74f4q5ihccnv6com2a8409t sess_dvrt9fmfuolr8bqt9efdpcbj0d sess_igdaksn26hm1s5nfvtjfb53pl7 sess_tgf5b7gkgno8kuvl966l9ce7nn
-
for your kind information: session is not available in CLI. So, you'll not be able to use session related functions and variable in CLI Commented Feb 2, 2021 at 8:19
-
@AhmadAsjad That's not true, while it doesn't really make sense to use sessions in CLI, all methods are still available. It's possible the session save path isn't set automatically in CLI-mode, you may still set it manually, allowing you to access existing session data. If no path isset, it's reverted back to the system temp folder by default, but new sessions still can be created.– TimCommented Feb 2, 2021 at 16:53
-
The only surefire option to find the current session.save_path
value is always to check with phpinfo()
in exactly the environment where you want to find out the session storage directory.
Reason: there can be all sorts of things that change session.save_path
, either by overriding the php.ini
value or by setting it at runtime with ini_set('session.save_path','/path/to/folder');
. For example, web server management panels like ISPConfig, Plesk etc. often adapt this to give each website its own directory with session files.
I believe its in /tmp/. Check your phpinfo function though, it should say session.save_path in there somewhere.
-
Although the PHP docs say that "/tmp" is the default, all linux distros that I've tried do not put the session files in
/tmp
-- do you know any that do? Is that the case if you build PHP from source? When the "session.save_path" is empty it can be tricky to figure out where the files go (hence this question, I suspect)– RichCommented Aug 30, 2013 at 10:51
<?php phpinfo() ?>
and look for thesession.save_path
.session.save_path
by default points to a 1440 folder that doesn't exist, so I just changed it to a path with write permission and now session handling works ok.