Losing session variables 4

[SarahG]

Sorry if this is in the wrong forum, but I think it's an ASP problem...

I have a website that uses session variables. It has started behaving erratically in that session variables seem to get 'lost'. There is no clear logic as to when they do this and in some cases the session variables can be read again, in others they are not.

We have disabled virus scanning software in case that was a problem. We've also established that it is not a timeout or browser problem. I can reproduce the problem while working directly on the server so it's not a network problem.

I am using IIS6 and ASP.

Has anyone had a similar problem?? Any ideas??

Thanks in advance.

 

[Sheco]

Assuming page "A" and "B" are in your web application...

If you set a session variable at the top of page "A":

1. Can you always Response.Write it out elsewhere on page "A" ?

2. Can you ever Response.Write it out on page "B"?

 

[Sheco]

Also were the pages moved from one copy of the web app to another? or to a new web app? or to another server? or was the the IIS Admin tool used to change the settings of the web app?

 

[SarahG]

I have edited the application so that each page prints out the session variables on opening. If I set the variable on page 'A' it comes out on b,c and all pages. It's just sometimes it doesn't. When this happens either it is displayed again on a refresh, or it doesn't appear again at all.

In answer to your other questions, the ASP files were created on my own server and copied to the production server (routine stuff), they are not moved during processing. The IIS admin tool is not changed while I am testing this.

 

[monksnake]

This site may contain an answer to your problem:

http://classicasp.aspfaq.com/general/why-won-t-my-session-variables-stick.html

It contains many different suggestions.

<.

 

[Sheco]

All session variables will be lost when IIS is restarted. Is there maybe another developer working on a COM object that is not loaded into an MTS/COM+ package such that he has to bump the w3svc service to register new version of the object?

 

[Sheco]

Wow that is a nice link monksnake!

 

[SarahG]

Monksnake - That's a great site thanks. However it's none of those things.
Sheco - I'm the only developer and the IT manager & myself are controlling IIS to resolve this, so if it's being reset it's not by us.

Basically our IT dept followed a list of recommended tweaks on the server to tighten security. Then this problem started. They are rolling these changes back now, but it's a long messy list and I want to see if anyone has come across it before.

Thanks for your help so far.

 

[Sheco]

Hmmm, maybe use the IIS Admin tool to compare the application configuration on your development workstation to the configuration on the server?

 

[Tarwn]

Nice link, with one exception. The most common reason for losing Session variables is kind of hidden in #3 on that site. Make sure that you don't have any links, forms, etc that switch between

http://www.yoursite.com

and

http://yoursite.com.

Since session variables rely on cookies to hold the unique session id, even a change as minor as dropping the sub-domain at the front of a URL will cause you to lose your session because the cookie will not be sent with the browser request.

The most common time I have seen this is in a site that has a full path outlined in either a link or form with all of the other links/forms using a relative URL. You type in the address of the front page and are happily moving around the site, relying on the browser to convert those relative addresses to a fully qualified URL (which it is doing correctly) until you hit the one link or form that specifies the full address differently, at which pointy you "lose" your session because now all of the relative links/forms on other pages are being added to a base address that is different then the one you had when given your initial Session id.

One thing you could do to determine when your session is changing is to actually print out the Session ID on the top of each page. Keep track of when that ID changes (and you lose your session). Or you could just do a search through your files for any fully qualified URLs

-T

 

[SarahG]

Thanks for your replies.

Nothing has worked so far, it produces this problem on the server itself, so firewalls & networks are ruled out. All the links are relative, there are no underscores in the server name, I've ruled out caching problems . I'm at the end of the lsit, and can only think that one of teh service packs/hardening measures applied has not fully un-installed itself.

I have one more question if anyone can help me understand as I'm not an administrator..There are several w3wp.exe processes running on the server. However, there is only one application pool, and the web garden property on IIS is set to one, so shouldn't there only be one w3wp??

 

[tsuji]

Check this out.

http://blogs.msdn.com/david.wang/archive/2005/09/19/Why_do_I_lose_ASP_Session_State_on_IIS6.aspx

Attention should be drawn as well to the particular comment, namely, this.
[tt]
quote
"... the basic issue is that Web Garden introduces multiple processes to service requests while in-process state is not automatically copied across processes... so you either need to avoid state, manually synchronize it, or centralize and share the state in an out-of-process session state store."
unquote[/tt]

 

[SarahG]

The Web Garden setting seems to be the culprit. It has been set to one and IIS restarted (through the Services list rather than through the console).

What is very confusing however, is that I confirmed this setting was one after I originally set up this thread as it was flagged on monksnake's link. This morning it was set to 100. It wasn't updated by staff here, if anyone is aware of some patch/fix that alters this setting, or some reason it isn't retained I would be grateful.

Thanks again for all the information, it has been very useful.