43

From the PHP manual, session.gc_probability and session.gc_divisor state that gc will occur based on this probability. I get that.

What I'm not clear on is whether this probability is on a session by session basis or overall.

So if my probability is 1% (1/100) that GC will occur, does that mean that if one session keeps getting extended, each time there is a 1% change that specific session will be cleaned up? Or does this mean that 1% of all existing sessions (as well as new ones) will trigger GC for all other existing sessions?

I'm pretty sure it's the latter, I just want to make sure.

The purpose of this question is that on our site, I want users to have long-term sessions (6 months). If 1% of all sessions trigger GC, then that effectively removes the purpose of having that long-term session, as GC will end up occurring every hour or two.

2
  • related stackoverflow.com/questions/3865303/… Commented Apr 4, 2013 at 17:34
  • For anyone else reading this attempting the above, with 6 months of session files it may cause serious performance issues (as stated below). You can, however, use session_set_save_handler() to write a custom session handler that will use the DB instead of the FS, negating many performance penalties.
    – Meep3D
    Commented Jul 20, 2016 at 13:03

3 Answers 3

12

Every time a PHP script is executes and starts session there is a probability that it will sweep through the session folder killing off old session.

Cleanup will only delete sessions which were not accessed within a certain time. However PHP does not guarantee that the session WILL be destroyed within that time.

Your long-term session strategy should work just fine, but you might want to reduce 1% to something like 0.1%

Another thing to look out for is that operating system might clean up your /tmp folder during reboot so even if PHP won't do it.

5
  • I've reduced the probability from 1/100 to 1/1000000 (0.000001%). I'm hoping that fixes the issue. Also, this is a Magento site, so sessions are stored in /var/session. This folder, as far as I know, is not touched by the server (but I'm guessing it will be removed if "Flush cache storage" is chosen from Magento admin).
    – pspahn
    Commented Oct 19, 2011 at 22:59
  • Oh, lets hope Magento does not implement alternative sessions which would ignore gc_* settings.
    – romaninsh
    Commented Oct 19, 2011 at 23:03
  • 5
    and the side effect of reducing the probability is that you will fill up your hard drive with old sessions. and sessions will take longer and longer to find and load, and at the end of the day there is still a minimal chance you will wipe the sessions anyway (even though it is remotely small). You could look at alternative options such as writing your own session handler and controlling exactly which sessions you want remove and when. it is not that hard. php.net/manual/en/function.session-set-save-handler.php
    – bumperbox
    Commented Oct 20, 2011 at 0:07
  • I would second what @bumperbox mentioned. Creating your own session handler can give you much greater control.
    – Insyte
    Commented Aug 12, 2015 at 18:02
  • It's unlikely number of session would somehow impact the speed. I have never experienced it, Linux filesystem use binary trees or something similar to index by filename, so it's pretty fast, unless you type "ls" in that folder. Size shouldn't be issue also, unless you store files in session. Moving session to database will not directly address any of those issues, however developers are usually more skilled with database than files, so it could be easier to clean them.
    – romaninsh
    Commented Aug 13, 2015 at 13:15
9

last time I looked at the source each call to session_start() "rolled the dice" so to speak, using the divisor and probability. If you hit, then it would delete all files from the session.save_path directory that were older than session.gc_maxlifetime. I forget if it used modification or access time of the file, although it shouldn't matter in normal curcumstances because php overwrites the session file by default at the end of script execution, so mod and access times should almost always match very closely.

// Rough psuedo code of how php's session_start() function works regarding garbage collection.
function session_start() {
    $percentChanceToGC = 100 * ini_get('session.gc_probability') / ini_get('session.session.gc_divisor');
    $shouldDoGarbageCollection = rand(1, 100) < $percentChanceToGC;
    if ($shouldDoGarbageCollection) {
        $expiredCutoffTime = time() - ini_get('session.gc_maxlifetime');
        foreach (scandir(ini_get('session.save_path')) as $sessionFile) {
            if (filemtime($sessionFile) < $expiredCutoffTime) {
                unlink($sessionFile);
            }
        }
    }

    // ... rest of code ....
}

I don't know how many session files you're going to end up having hang around if you want them to live for a minimum of 6 months. Consider it may take a little while for php to stat many thousands of files to determine their age. Maybe consider other options for durable storage of this data. Or you could disable php gc and just run a cron job to delete stale session files. Otherwise, that 1% of requests are gonna trigger gc and have to wait for php; in other words it could possibly lag.

2

I'm not an expert on this, but from reading the manual, I'd draw your attention to another setting, session.gc_maxlifetime. From the docs:

session.gc_maxlifetime specifies the number of seconds after which data will be seen as 'garbage' and potentially cleaned up. Garbage collection may occur during session start (depending on session.gc_probability and session.gc_divisor).

So if you set this setting to a suitable value (60 * 60 * 24 * 365 / 2 for half a year, so 15768000), then the appropriate data won't be eligible for garbage collection, no matter what the other settings are.

3
  • 1
    I've already set gc_maxlifetime to 15552000 (180 days) - Everything seemed to be working properly on the dev site, but once I pushed it live, it worked for awhile before it started kicking users back to the login page.
    – pspahn
    Commented Oct 19, 2011 at 22:57
  • 8
    does this value means "seconds after session creation" or "seconds after last modification"? Commented Oct 25, 2012 at 15:43
  • It would need to be a combination of putting off the garbage collector so your session data will be there in the dictionary but also extending your cookie lifespan so it saves the session id unique to that row of session data if I understand it correctly.
    – vikingben
    Commented Mar 28, 2013 at 21:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.