pqdrummer

That must be what's causing the problem. I can almost guarantee that we have other sites with shorter session settings. I'll give that a shot and see how it goes. Thanks!

Because about 50 sites share the same php.ini

I am setting the session.gc_maxlifetime via ini_set in a file that is included at the beginning of every php file. I have confirmed the value via phpinfo. I know that it is being set to 8 hours. However, the other day there was a customer that was online for about 2 hours (inactive for about 1 hour) whos session was lost. I could understand that if GC worked like how I explained it. But if what you said is true, I have no idea how that could have happened and I am back to square one.

My company owns the server, so I have root access, if that's what you're getting at. We use the same server for a bunch of different clients/sites though (and all session data from all sites is save to the same /tmp directory). So from my perspective, no, it's not a shared server. But from our clients' perspective it would be.

Well how do I set the expriration length then? Everything that I read regarding session timeout/expiration had to do with the gc_maxlifetime.

Okay, let me start by apologizing if this has been asked 100 times before. I have a custome ecommerce program that is storing various data in session. The problem that we are having is that every now and then a customer's session information is lost while they are using the site. I currently have session.gc_maxlifetime set to 28800. However, from what I've been able to gather from random internet posts, all this does is indicate that the garbage collection routine can run as long as there is a session file that is at least 8 hours old (whether or not it actually runs depends on the probability that is set). Is that correct? If it is, then that's where my problem lies. This application is (obviously) being used constantly throughout the day. This means that it is more than likely that there will eventually be session files that are at least 8 hours old. As a result, the 8-hours-old session file could trigger a garbage collection which would delete a brand new session file that I don't want to be deleted. I have tried storing each session file in its own folder so that they don't all get grabbed by the global GC, but all that does is create a new folder each time I hit a call to session_start(), thereby not maintaining any session persistance. If anyone knows a way to make it so that only session files that are older than a specified age are deleted by the GC, it would be GREATLY appreciated if you share that info with me. Much thanks in advance.

solved