# How long before deleting sessions?

**URL:** <https://www.ruby-forum.com/t/how-long-before-deleting-sessions/60366>\
**Category:** Rails\
**Created:** [May 12, 2006, 5:14pm UTC](https://www.ruby-forum.com/t/how-long-before-deleting-sessions/60366 "2006-05-12T17:14:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\
**Post date:** [May 12, 2006, 5:14pm UTC](https://www.ruby-forum.com/t/how-long-before-deleting-sessions/60366/1 "2006-05-12T17:14:03Z")

</div>

What is the recommended amount of time to keep sessions around in the  
database (i store them in a sessions table). IF you get 1 million  
requests  
per day you are going to get 1 million new session entries in the DB.  
This  
would need some serious cleaning so just wondering what a safe cleanup  
time  
would be.

Also does anyone know how to prevent new sessions records from being  
created  
if session vars are not needed? This seems like a lot of work for no  
reason.

thanks  
adam

---

<div class="post-metadata">

**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\
**Post date:** [May 12, 2006, 6:50pm UTC](https://www.ruby-forum.com/t/how-long-before-deleting-sessions/60366/2 "2006-05-12T18:50:47Z")

</div>

On May 12, 2006, at 8:10 AM, Adam D. wrote:

> What is the recommended amount of time to keep sessions around in  
> the database (i store them in a sessions table). IF you get 1  
> million requests per day you are going to get 1 million new session  
> entries in the DB. This would need some serious cleaning so just  
> wondering what a safe cleanup time would be.

Databases happily eat millions of rows with no trouble. Put an index  
on session\_id and set up a cron job to ‘delete from sessions where  
updated\_at \< ?’ every now & then.

> Also does anyone know how to prevent new sessions records from  
> being created if session vars are not needed? This seems like a lot  
> of work for no reason.

Turn sessions off if you don’t use them:  
[http://api.rubyonrails.org/classes/ActionController/](http://api.rubyonrails.org/classes/ActionController/)  
SessionManagement/ClassMethods.html#M000102

jeremy

---

<div class="post-metadata">

**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\
**Post date:** [May 12, 2006, 6:57pm UTC](https://www.ruby-forum.com/t/how-long-before-deleting-sessions/60366/3 "2006-05-12T18:57:15Z")

</div>

well i was kind of asking how long a session should remain in the DB.  
so  
update\_at \< ? should be how many days ?

Also I _do_ need sessions, I didnt think i needed an entry in the DB for  
one  
if a session never got populated. Seems like overkill to me especially  
for  
a website that gets tons of traffic.

thanks  
adam

---

<div class="post-metadata">

**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\
**Post date:** [May 12, 2006, 7:10pm UTC](https://www.ruby-forum.com/t/how-long-before-deleting-sessions/60366/4 "2006-05-12T19:10:26Z")

</div>

Even if you don’t explicitly use a session, it will be created unless  
you turn them off in your environment.rb ( it may be turned off  
somewhere else, I’m not near my normal computer to check).

Charlie B.  
[http://www.recentrambles.com](http://www.recentrambles.com)

---

<div class="post-metadata">

**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\
**Post date:** [May 13, 2006, 1:11am UTC](https://www.ruby-forum.com/t/how-long-before-deleting-sessions/60366/5 "2006-05-13T01:11:17Z")

</div>

Adam D. wrote:

> well i was kind of asking how long a session should remain in the DB.  
> so update\_at \< ? should be how many days ?

That depends on your application. What makes sense for your app? If you  
have a news site, it probably makes sense for the session to expire in a  
couple of days. If you have a store, you might want the contents of  
someone’s shopping cart to reappear even if they haven’t visited for a  
couple of months.

It’s worth thinking a little about the dynamics of the session  
population which vary among different types of sites.

If you are planning for 1 million visits per day, how many of those are  
new visitors? Are you using cookies, or logins, to reattach users to  
their sessions? That means that you aren’t going to be adding 1 million  
new rows to the session table, only some fraction that depends on the  
number of new users.

If 90% of your visitors are returning in the interval before your  
sessions expire, that means that your db is only growing by 100,000 new  
sessions per day.

On the other hand, if 90% of your visitors are new, then your sessions  
table is growing by 900,000 per day.

If 90% of your visitors are new, then there probably isn’t much value in  
the state of you application, so you can expire sessions more quickly,  
but if 90% of your visitors are returning, there is probably some value  
in holding onto the state longer.

> Also I _do_ need sessions, I didnt think i needed an entry in the DB for  
> one if a session never got populated. Seems like overkill to me  
> especially for a website that gets tons of traffic.

If you store your sessions in the db, then you need a entry in the db.  
You have already made that decision unless you are willing to undertake  
the effort of developing a two-tier session store. You could mark some  
sessions as keepers based on rules that only you know, but unless you  
have evidence that this is really a problem, I wouldn’t bother.

–

Ray

---

<div class="post-metadata">

**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\
**Post date:** [May 12, 2006, 7:03pm UTC](https://www.ruby-forum.com/t/how-long-before-deleting-sessions/60366/6 "2006-05-12T19:03:31Z")

</div>

“Adam D.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
writes:

> What is the recommended amount of time to keep sessions around in the  
> database (i store them in a sessions table). IF you get 1 million requests  
> per day you are going to get 1 million new session entries in the DB.

Not really, a session is not created per request. Rather it is  
associated with  
a certain user, machine and a browser combination.

> This  
> would need some serious cleaning so just wondering what a safe cleanup time  
> would be.

A session can be cleaned up when the user logs out.

> Also does anyone know how to prevent new sessions records from being created  
> if session vars are not needed? This seems like a lot of work for no reason.

Don’t store anything in the session, and I think you should be good.

## Hope this helps.

Surendra S.  
[http://ssinghi.kreeti.com](http://ssinghi.kreeti.com), [http://www.kreeti.com](http://www.kreeti.com)  
Read my blog at: [http://cuttingtheredtape.blogspot.com/](http://cuttingtheredtape.blogspot.com/)  
,----  
| “O thou my friend! The prosperity of Crime is like unto the lightning,  
| whose traitorous brilliancies embellish the atmosphere but for an  
| instant, in order to hurl into death’s very depths the luckless one  
| they have dazzled.” – Marquis de Sade  
`----