How to determine as to how many sessions are too many for a web application

Question

I have Jboss application server running Oracle Commerce. I have 5 Page serving instance[VM Servers] and around 300 users browsing site at any given time. I am trying to come up with a number for Session timeout, so that customer have enough time to browse and checkout, but then also do not want too many open sessions that would hold up the memory. So my question is there a rule of thumb to determine the session timeouts?

Jboss 7, Java 7 with 8gb memory for each jvm. Currently session timeout is set at 10 mins. Would like to increase it to 30 mins.

Answer 1

Here are the things I can think of: - Session size. - Thread pools - the number of concurrent threads to be server. This is configurable by the application server. There are several thread pools available for the JBoss for example you have several pool for the servlet container separate for the EJB container and so on. You can read some details here. https://developer.jboss.org/wiki/ThreadPoolConfiguration#jive_content_id_Deploying_Threading_Components - Your use case. How many concurrent users you expect.

If you run out of threads all further requests will be queued (I think this depends a bit on the Executor) but in the general case it is like that. This puts a strain on the Memory. So you should not operate above the maximum pool size.

The size of the session and the number of concurrent users you expect will help you out to figure out how your memory will grow over time. You should take into account pick hours and how the site usage has grow in the last couple of years.

Here it should be noted that since you have online application you should prefer small HEAP size over large Heap size because of the garbage collector. Probably it will be a good idea to use the new G1 Garbage collector.

Edit based on last comment: One naive way to measure the heap without very strong precision with help of profiler is: 1. Start server , make a test run with single user in order to initialize all the classes. 2. Force garbadge collection and take a benchmark 3. Run for large sample of parallel users and observer your peak memory and how much the GC is able to free (force the GC again) when your pick memory is reached.

Now this is a naive approach.

A more complex approach would be to calculate the size of the session with the help of some object allocation monitoring tool (Use again profiler).

Answer 2

Additionally you should consider to check the memory of the JVM by enable GC logging. It will give a good idea when it get exhausted. Another indicator is the CPU utilization. It depends on the user activity and the application what is needed, if you have enough memory you can increase the number of parallel session as long as you have enough CPU power to handle the requests.

Answer 3

(i know this is an old post but this may help someone)

Cdesai,

If you want to provide users with ample amount of time to browse and checkout without worrying about timeouts, you may consider using JavaScript to keep the session alive. As long as the window is up and the javascript is running the session remains active. Once the window is closed or navigated away then your session timeout will continue with its countdown. Should the user come back and the session timeout hasn't expired then the Javascript will ping the server to restart the countdown. This also helps with too many active sessions bogging down the server. I use a similar setup but my session timeout is set low, 5 minutes, and the keepAlive function is at a two minute interval.

 function keepAlive() { var httpRequest = new XMLHttpRequest(); httpRequest.open('GET', "/restricted_file_url"); httpRequest.send(null); } setInterval(keepAlive, 840000); //My session expires at 15 minutes 

see Ivar's solution here