I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such as SEMRush or Bing generating files such as the below:


_secure_cookie_check|s:32:"9f01d3ce7854010140a04e28e8ea1ff2";core|a:4:{s:23:"_session_validator_data";a:5:{s:11:"remote_addr";s:12:"";s:8:"http_via";s:0:"";s:20:"http_x_forwarded_for";s:0:"";s:15:"http_user_agent";s:71:"Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)";s:24:"session_expire_timestamp";i:1532950280;}s:8:"messages";O:34:"Mage_Core_Model_Message_Collection":2:{s:12:" * _messages";a:0:{}s:20:" * _lastAddedMessage";N;}s:12:"visitor_data";a:15:{s:0:"";N;s:11:"server_addr";s:4:"mËsš";s:11:"remote_addr";s:4:"Ï. K";s:11:"http_secure";b:1;s:9:"http_host";s:23:"www.removedforsecuritypurposes.com";s:15:"http_user_agent";s:71:"Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)";s:20:"http_accept_language";s:0:"";s:19:"http_accept_charset";s:0:"";s:11:"request_uri";s:29:"/catalog/category/view/id/421";s:10:"session_id";s:26:"temfgjqqf4o0miijgedvcf7nq6";s:12:"http_referer";s:0:"";s:14:"first_visit_at";s:19:"2018-07-30

But I've noticed there are loads of Chinese looking files being generated such as below.



Is it possible the session folder is somehow being hacked, or could something else be generating these files? Would Chinese/Japanese browsers generate their own language into these files? We have a very secure server and always make sure our website is using the latest patches so it's all a little strange!

  • The translation of the Chinese text, nor the Chinese version itself looks like a valid session file. Are the file permissions for your /car folder set up correctly? Jul 30, 2018 at 19:45
  • Yes, all my permissions are as per a default Magento installation. Jul 31, 2018 at 8:19
  • Did you ever solve this as I am havint the same issue with a Magento 2.3.1 upgrade and it is causing issues along the the lines of: Failed to decode session object session destroyed etc etc Be great to know where you got to with this? Thanks Matt
    – Matt
    Jun 6, 2019 at 9:22
  • If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review Jun 6, 2019 at 10:04
  • This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. You can also add a bounty to draw more attention to this question once you have enough reputation. - From Review
    – sv3n
    Jun 6, 2019 at 10:18


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.