Naive ASP.NET Session Count Wrong

Question

I use the following code to count the number of currently open sessions in my ASP.NET (2.0/3.5) application (ASMX web service, legacy code), but if it runs long enough the count stops matching the built in performance counters (my count is higher, Session_End seems to not be invoked sometimes). The sessions are InProc. What might I be missing?

public class Global : System.Web.HttpApplication
{
    protected void Application_Start(object sender, EventArgs e)
    {
        Application["OpenSessionCount"] = 0;
    }

    protected void Session_Start(Object sender, EventArgs e)
    {
        Application.Lock();
        Application["OpenSessionCount"] = (int)Application["OpenSessionCount"] + 1;
        Application.UnLock();

        /* Set other Session["foo"] = bar data */

    }

    protected void Session_End(Object sender, EventArgs e)
    {
        Application.Lock();
        Application["OpenSessionCount"] = (int)Application["OpenSessionCount"] - 1;
        Application.UnLock();
    }
}

"Just use performance counters!"

Yes, I'm just asking because I'm curious where I went wrong.

score 1 · Answer 1 · answered Sep 22 '15 at 21:53

1

The Session_End is invoked in two situations:

When Session.Abandon() is called
Immediately after the Session expires

If you close the browser, the Seesion_End event fire when Session Expires.
See MSDN lib

answered Sep 22 '15 at 21:53

Ricardo Carvalho

223
5
14

Are there any other ways for a session to end? I didn't think there were any. – Anonymous Coward Sep 23 '15 at 17:44
You could use javascript for monitoring the close browser event, and send a request to logoff page with Session.Abandon() rotine. [close event sample](http://stackoverflow.com/questions/1631959/how-to-capture-the-browser-window-close-event) – Ricardo Carvalho Sep 23 '15 at 18:04
Thanks for the suggestion Ricardo but this is a web service not a web application so there are no browser events. Also, since I already update the count in Session_End(), both logout (which calls Session.Abandon()) and session timeout are taken care of. I'm trying to find out what else might end a session without calling Session_End. An exception in Session_End before the count is updated might do it but the update is pretty much the first think the code does so I don't see where the exception could happen. – Anonymous Coward Sep 23 '15 at 19:04

score 0 · Answer 2 · edited May 23 '17 at 12:06

Sessions do not actually begin unless you store something in the Session dictionary. So, you won't get a Session_End event for any that don't actually have a session object allocated.

From MSDN:

When using cookie-based session state, ASP.NET does not allocate storage for session data until the Session object is used. As a result, a new session ID is generated for each page request until the session object is accessed. If your application requires a static session ID for the entire session, you can either implement the Session_Start method in the application's Global.asax file and store data in the Session object to fix the session ID, or you can use code in another part of your application to explicitly store data in the Session object.

public class Global : System.Web.HttpApplication
{
    protected void Application_Start(object sender, EventArgs e)
    {
        Application["OpenSessionCount"] = 0;
    }

    protected void Session_Start(Object sender, EventArgs e)
    {
        Application.Lock();

        // Store something every time to ensure the Session object is allocated.
        HttpContext.Current.Session["dummy"] = "Foo";
        Application["OpenSessionCount"] = (int)Application["OpenSessionCount"] + 1;
        Application.UnLock();

        /* Set other Session["foo"] = bar data */

    }

    protected void Session_End(Object sender, EventArgs e)
    {
        Application.Lock();
        Application["OpenSessionCount"] = (int)Application["OpenSessionCount"] - 1;
        Application.UnLock();
    }
}

Reference: ASP.NET: Session.SessionID changes between requests

We do set a value in the Session in Session_Start() but we do it after the increment. Should that make a difference? — Anonymous Coward, Sep 23 '15 at 17:41
I don't think so. The case I was pointing out is when you have some condition that decides whether to store something in session or not. When you don't, then you didn't actually begin a session. — NightOwl888, Sep 23 '15 at 19:05

Naive ASP.NET Session Count Wrong

2 Answers2