Occasional session lost Or slow response w/ IIS 6 (Samuel)

Mon, 11 Oct 2004 21:55:05 GMT

Q: Everything was working until I migrated my site to IIS 6.0 / Windows 2003. After the migration, my users frequently encountered session loss problem. They sometimes got redirected to a page saying that they entered the forum with an URL that contained invalid Session ID when they submitted a post.

A: There are two modes to set up an IIS 6 server. One is called worker process isolation mode and the other IIS 5 isolation mode.

Our forum software uses ASP.NET's built-in session object to manage sessions and it runs fine on either modes for IIS 6, unless you use the Web Gardens feature to manage more than 1 worker processes under worker process isolation mode. The default value is 1.

To configure a Web Garden back to its original setting (see figure 1):

In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
Click the Performance tab, and under Web garden, in the Maximum number of worker processes box, type 1.
Click OK.

Also, the other cause could be the Health Monitoring feature on IIS6 recycling the worker process once in a while.

By default IIS 6.0 is configured to recycle its worker process every 29 hours. This is a bit aggressive for an application running ASP.NET and it is recommended that automatic worker process recycling is disabled (see figure 2).

It is also recommended to turn of idle timeout shutdown as well (see figure 1).

A user of ours, Gun, told us why the problem still persists on his site after following the above suggestion (I edited his message a bit):

We just solved lost login problem. It was caused by the "20 cookie per domain" limit. In previous years we modified our ad program to use cookies. But in the forum there are lot of banner zones so once a user is filled with cookies (I have seen 23) previous cookies start getting deleted by the browser. So after the influx of our banner cookies, APG's session cookies get deleted and users are forced to log out.

So, if you still have these lost login problems after following my suggestion above, check out the other web based software that you use because it is very possible that under the hood the other software is using cookies excessively which will force our session cookies to be deleted.

The general rules for cookie are:

4,000 byte (4Kb) limit for each cookie
Maximum limit of 20 cookies per domain

IIS 6, isolation, worker process, session lost, ASP.NET, cookie, recycle