27 May 2010

Sessions never expire bug in ColdFusion 8.01

A couple of times a year I’ve encountered a strange problem in our ColdFusion servers where sessions mount up and aren’t removed after they should have expired. Just today we had 100’s of sessions left in memory with all of the session scope variables still there at the end of the day, hours after they should have been deleted. Automated session housekeeping ceased to be.

Two other symptoms drew my attention to the above problem which must surely be related. Emails stopped being sent, the spool directory filled up without any cfmail files leaving. And from the website CF sporadically threw the error “The session is invalid” which was temporarily resolved by closing the browser and logging into the app again.

Restarting the CF services doesn’t resolve the situation because the service refuses to stop if asked politely. A full reboot is the only way to restore normality with confidence.

You’re probably thinking what good is it complaining now because 8.01 isn’t the current release and we should upgrade to 9.x. Well how do we know that 9.x has fixed this problem? Are Adobe aware of the issue? We could run a 30 day trial of 9.x on a test server but we’d have to run it for at least 6 months with a constant load to mimic our production server keeping in mind the rare appearance of the bug.

If you have encountered this problem before or know how to fix it then please let me know.


  1. Gary,

    A few items:

    1. Adobe does care about bugs in 8.x. They know that not everyone can upgrade immediately, and I have always seen them take an interest in fixing bugs in CF for at least the current version and the most immediate prior release.

    2. Based on the error "The session is Invalid" that you stated you received, I think you are using JEE sessions. Is that correct? If so, then JEE sessions are handled by the servlet container, not CF. It could be a problem there. If it is JRun, then it is still Adobe's issue, but if it is Tomcat, GlassFish or something else, then the problem MIGHT lie elsewhere. Also, if it is a JEE session issue, have you looked at which JVM you are using? Tried updating it?

    3. Finally, reporting things like this on your blog is a great way to find out if others are having similar problems. But it is not the way to notify Adobe. If you have not done so already, and you really feel that it is a CF bug, then you should report it in the bugbase.


  2. Thanks for the comments, Jason. Yes, we're using JEE sessions and JRun. Adobe aren't keen on fixing bugs that only 1 or 2 people report. Take the cfspool bug I encountered in July 2008. http://garysgambit.blogspot.com/2009/04/cfmail-spool-bug-in-coldfusion-801.html

    After some pleading an engineer was given permission by his manager after about 6 months to work on a fix. He came up with something but it didn't work and I haven't heard back from Adobe for a year now. Bug 72580 (not publicly searchable).

    That's why I don't think they're too concerned about bugs that aren't reported by more than one person. Blogging about bugs increases the chance of finding others in the same position and teaming up can build a stronger case to present to Adobe.

    I will add my new bug to the Adobe bugtracker as you suggest and see what happens.

  3. The ColdFusion bugtracker has a bug! It wouldn't let me submit my bug report. See here for a screenshot of the server's error message: http://garysgambit.blogspot.com/2010/05/coldfusion-bugtracker-bug.html