EnterpriseCacheSessionDAO - Session Expiry and Reporting Session State

[agilone <er...@medyanova.com>]

Hi All, We are using EnterpriseSessionDAO implementation with Memcached as a
back store. Our problem is we are not able to keep track of sessions that
are expired because of inactivity. In terms of session storage system it
works fine, everything works as anticipated.  I have digged into code and
realized that getActiveSessions() method returns null for cache
implementation since Cache client can't get all the active sessions [or
key's in memcached] from cache cluster. Therefore capturing orphan sessions
expiration statuses and then log them to reporting environment [MySQL] seems
impossible. Would you please propose a solution where we can capture this
information? Thanks in advance,ErginHere is more details
EnterpriseCacheSessionDAO is our session backend with memcached 
cachemanager implemented. Current cluster contains four machines. We
extended DefaultSessionManager to capture expired sessions afterStopped()
afterExpired() System logs session of the user first time when they login
and also during log out if they use log-out command. However we are not able
to capture expiration events for other sessions [orphan sessions] in which
user left the session without log-out.  This causes lots of orphan sessions 
in my reporting environment  which have start time and session id but no
stop time and expired information.  



--
View this message in context: http://shiro-user.582556.n2.nabble.com/EnterpriseCacheSessionDAO-Session-Expiry-and-Reporting-Session-State-tp7578194.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: EnterpriseCacheSessionDAO - Session Expiry and Reporting Session State

[Les Hazlewood <lh...@apache.org>]

Redis is indeed a good choice for this too.  But like Hazelcast, you'll
want to ensure it dumps data to disk (how often is dependent upon your
needs) so if your Redis cluster runs out of memory you don't lose sessions.

On Thu, Jan 24, 2013 at 7:47 AM, John Moore <gr...@jmsd.co.uk> wrote:

> We're using Redis as a backing store for sessions, because it's blindingly
> fast and completely straightforward to deploy (on Debian/Ubuntu, 'sudo
> apt-get install redis-server' is pretty well all you need to do). I did a
> Redis implementation of the Cache and CacheManager classes, in
> Grails/Groovy
> (but they should be easily translatable to straight Java).
>
> In a short time, Redis will, I believe, have the feature you require, using
> its publish/subscribe mechanism, so your application could subscribe to the
> event which occurs when that session key expires. In the meantime, though,
> you could easily do some kind of workaround using polling (which, given the
> relatively small likely number of concurrent sessions and the sheer speed
> of
> Redis, would be unlikely to have much overhead), whereby you maintain an
> in-memory list of session keys and every 10 seconds, say, you loop through
> this checking whether each one is still alive in Redis. If not, you can do
> any clean-up you require and remove it from the list.
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/EnterpriseCacheSessionDAO-Session-Expiry-and-Reporting-Session-State-tp7578194p7578203.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>

Re: EnterpriseCacheSessionDAO - Session Expiry and Reporting Session State

[agilone <er...@medyanova.com>]

Hi Hanso, 

I have memcached implementation with spymemcached. I haven't got chance to
work on Redis because of technology choices here. 

You can find the link to Redis implementation in previous post by Les. It
should be ready to go. 

Thanks, 

Ergin



--
View this message in context: http://shiro-user.582556.n2.nabble.com/EnterpriseCacheSessionDAO-Session-Expiry-and-Reporting-Session-State-tp7578194p7578218.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: EnterpriseCacheSessionDAO - Session Expiry and Reporting Session State

[John Moore <gr...@jmsd.co.uk>]

We're using Redis as a backing store for sessions, because it's blindingly
fast and completely straightforward to deploy (on Debian/Ubuntu, 'sudo
apt-get install redis-server' is pretty well all you need to do). I did a
Redis implementation of the Cache and CacheManager classes, in Grails/Groovy
(but they should be easily translatable to straight Java).

In a short time, Redis will, I believe, have the feature you require, using
its publish/subscribe mechanism, so your application could subscribe to the
event which occurs when that session key expires. In the meantime, though,
you could easily do some kind of workaround using polling (which, given the
relatively small likely number of concurrent sessions and the sheer speed of
Redis, would be unlikely to have much overhead), whereby you maintain an
in-memory list of session keys and every 10 seconds, say, you loop through
this checking whether each one is still alive in Redis. If not, you can do
any clean-up you require and remove it from the list. 



--
View this message in context: http://shiro-user.582556.n2.nabble.com/EnterpriseCacheSessionDAO-Session-Expiry-and-Reporting-Session-State-tp7578194p7578203.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: EnterpriseCacheSessionDAO - Session Expiry and Reporting Session State

[agilone <er...@medyanova.com>]

Thank you Les! Your comments are very helpful. 
I will consider possible replacements - and give Hazelcast a shot. 



--
View this message in context: http://shiro-user.582556.n2.nabble.com/EnterpriseCacheSessionDAO-Session-Expiry-and-Reporting-Session-State-tp7578194p7578198.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: EnterpriseCacheSessionDAO - Session Expiry and Reporting Session State

[Les Hazlewood <lh...@apache.org>]

Hi Ergin,

With Memcached, I don't think this is possible - Memcache is purposefully
'dumb'.  And if Shiro can't get access to the active session keys and/or
entries are evicted without Shiro's knowledge, there is no way for Shiro to
react accordingly.

Another data store is probably necessary for your requirement: you might
consider Hazelcast - via its Loader/Store interfaces, it can persist data
to disk, and so you can ensure that even if the data is evicted from memory
(due to RAM constraints), data can still be 'paged in' later for access.
 TerraCotta+Ehcache is another potential solution (but I'm particularly
smitten with Hazelcast at the moment - it just works).

As Hazelcast is Apache 2.0 licensed, I've recently added Hazelcast as a
Shiro plugin here:
http://svn.apache.org/repos/asf/shiro/trunk/support/hazelcast/

It won't be released until Shiro 1.3, but at least you can copy it in the
meantime if you wish.

HTH,

--
Les Hazlewood | @lhazlewood
CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282
Stormpath wins GigaOM Structure Launchpad Award! http://bit.ly/MvZkMk

On Mon, Jan 21, 2013 at 6:23 PM, agilone <er...@medyanova.com> wrote:

> Hi All, We are using EnterpriseSessionDAO implementation with Memcached as
> a
> back store. Our problem is we are not able to keep track of sessions that
> are expired because of inactivity. In terms of session storage system it
> works fine, everything works as anticipated.  I have digged into code and
> realized that getActiveSessions() method returns null for cache
> implementation since Cache client can't get all the active sessions [or
> key's in memcached] from cache cluster. Therefore capturing orphan sessions
> expiration statuses and then log them to reporting environment [MySQL]
> seems
> impossible. Would you please propose a solution where we can capture this
> information? Thanks in advance,ErginHere is more details
> EnterpriseCacheSessionDAO is our session backend with memcached
> cachemanager implemented. Current cluster contains four machines. We
> extended DefaultSessionManager to capture expired sessions afterStopped()
> afterExpired() System logs session of the user first time when they login
> and also during log out if they use log-out command. However we are not
> able
> to capture expiration events for other sessions [orphan sessions] in which
> user left the session without log-out.  This causes lots of orphan sessions
> in my reporting environment  which have start time and session id but no
> stop time and expired information.
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/EnterpriseCacheSessionDAO-Session-Expiry-and-Reporting-Session-State-tp7578194.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>