We have a wiki where all users are required to be authenticated. The session timeout is 3 hours, so that users don't need to reathenticate frequently.

When we upgraded from 2.4.82 to 2.4.100, the wiki started asking users to re-login very quickly, sometimes after only a few minutes, sometimes after an hour.

The problem seems to be random--sometimes many users will lose their login at the same moment, sometimes only a few. When multiple logouts happen, they seem to happen at the same time.

The problem seems to happen more frequently when the wiki is doing more work--lots of folks editing pages at the same time.

When we rolled back to the intermediate version 2.4.91, the problem *seemed* to disappear.

I saw that in version 2.4.97, this was added: "WikiEventDelegate now stores all listeners as WeakReferences". Speaking out of my own ignorance, the bug we're seeing looks like a weak reference being reclaimed too soon. Is there any way to log when these weak references are reclaimed, so that we could corelate that with the time that a user reports being logged out? Or can we get the wiki to log when (and why) sessions are discarded, so that we can pin down what's going on?

The thing is that the EventManager does not manage sessions. The switch to WeakReferences was mandatory because the sessions were not being released at all, which results in a pretty bad memory leak.

My guess is that SessionMonitor is at fault here, but it'll take a bit of thinking.

--JanneJalkanen, 29-Mar-2007

Can you please check out the JSPWIKI_2_4_BRANCH and check if that helps? I committed a possible fix to 2.4.101, but I'd like you to test it in your environment before release.

--JanneJalkanen, 29-Mar-2007

Waiting for bug reporter

--HarryMetske, 30-Mar-2007