Memcache+PHP session tuning: How does memcache expire keys?

Question

Update, 24OCT2011: I moved this to ServerFault, which is probably more appropriate and which is where I meant to post this in the first place. However, I couldn't find a "move to SF" option so really, I just copied it there. Can anyone help with actually moving this?

I've done some research into this and have not found a definitive answer.

We have a web app that is using the PHP+Memcache session handler.

I have several questions, all interrelated, but ultimately my issue is, "Why are PHP sessions apparently not expiring when we think they should be?" ie The end user should be logged out of the app after a set time, but is not.

Here are the dots, please help me connect them, and tell me where I am mistaken:

• My understanding is that Memcache expires keys based on the set time, in seconds (or unix timestamp for larger values).
• The expiration is lazy -- ie nothing is deleted in advance
• The PHP memecache session handler uses the sessions.gc_max_lifetime to set the memcache key expiration. idk, maybe it doesn't?
• Memcache should, on serving a requested key and seeing that it is expired, not serve it (and then maybe also delete it?). But at least not serve it.
• This act of not serving it should, to PHP, equate to a deleted session and the user being logged out.

Users are not being logged out.

How can I even debug this? Memcache isn't exactly transparent.

Update I should have specified that the example case that has not been working is a site with a session timeout set to two hours. An example user would last use the site at night, and then, 8 - 10 hours later, come back to the site and still be logged on.

Answer 1

The end user should be logged out of the app a set time after their last request to the server . Every time a client makes a request, his expiration resets. If the expiration is 3 minutes, and you make a request every 2 minutes, your session will never expire.