Sessions adding up to ~256MB+ per day, is this too much and if so can it be prevented?

Question

On of Magento sites is currently building up sessions files fairly fast and I'm having to clear it once or twice a day just to be safe. The reason for this is because I put sessions in RAM which means if the space gets full then you can no longer create sessions and therefore not add items to cart / login etc.

I've now expanded this space to 256MB (before it was 64MB) but it just keeps filling up.

Traffic is around 2k-5k a day however I think the problem may actually lie in robot spiders scanning the site.

Is there a way to check this and potentially stop it if it is indeed the case or alternatively find out what is the cause of so many sessions?

Specs:

• Magento 1.9.1
• Nginx
• Running on AWS EC2 instance
• 15GB RAM

Answer 1

It sounds like you're storing too much in session. You've likely installed a 3rd party module that puts cart contents or other serialized content into session.

My suggestion is two parts:

• Don't use a tmpfs memory partition. Use a real storage solution, like Redis, if you'd like to do this. It will purge when it gets full and you can create expiration rules and get logs
• Find what is storing this large amount of data and do away with it. Find a better method of keying data and store that in the database.
• Rotate sessions more frequently. Don't retain sessions for longer than 7 days. The longer a session is persisted the longer the window for an attack vector becomes. In general, sessions should expire fairly rapidly and you should be relying on customer registration to persist the information.

Best of luck!

---

Source: personal experience migrating 17GB of session storage to Redis.

Answer 2

Clear it once or twice a day just to be safe

Don't. Unless you intentionally want to disrupt sales by obliterating customer carts.

I put sessions in RAM

Don't. This is a common (and dangerous) Magento myth.

• If its a single-sever deployment, use files and don't look back.
• If its multi-server, use Redis.

Memcache should not be considered unless either you care not for persistence, or you are hitting the single threaded behaviour of Redis (very unlikely).

Traffic is around 2k-5k

Session files are often ~5kB, if you are using 256,000kB, then that's around 50k per user, something isn't right.

I wouldn't be largely concerned about session storage utilisation, if its consuming space, so be it. I'd only be worried when you start seeing >2GB utilisation and it becomes a performance bottleneck.

Is there a way to check this

Open one of the largest session files in a text editor and you'll find the cause. It will be a rogue 3rd party extension storing information in sessions that perhaps shouldn't be.