Session problems when APC is turned on

We have a problem with PHP session when APC is enabled on our server.

The app works great without APC. However, since we enabled APC, the sessions seems to be getting mixed up when the server experiences heavy load, i.e. users are randomly logging on as another. Everything reverts back to normal once we disabled APC. We can't seem to find an开发者_如何转开发yone with the same problem, except a related problem with these guys (set-cookie was being cached in MS ASP): http://msdn.microsoft.com/en-us/magazine/cc163577.aspx#S2

Anyone else has similar experience? Can you recommend any suggestions?

PS: We have all our sessions handled by files in php.ini. We are also running apache2.

---

We're having a similar issue here. APC is only a primary suspect at this point because it's been difficult to reproduce.

We're using Zend Framework w/ session management and the theory is that Zend's code is cached in APC and when the system is under severe load the code is using a previously cached SID instead of the current one.

Our safeguard is to save the session ID inside the session data and compare the values when the session is retrieved. If the IDs are different we destroy the session and exit.

---

well please verify that apc really mixes up data... the only possible i can think of when this could happen is when it gets full and does a stackoverflow. please check the usage and maby increase the cache size.

---

There is a problem that crops up with APC where custom session handling objects get destroyed before the session data is saved. It could be unrelated to your problem, but an explicit call to session_write_close before the regular PHP shutdown fixes that one.

Your problem sounds a bit different though, but I can confirm that issues do exist.

---

Just to complete the post, we had success in reducing this problem with three things:

1) We made extra checks to make sure that the IP is matched to the session ID, and logout the user otherwise. We could then use this to track how often the problem occurs.

2) We switched to XCache and immediately saw lower number of confused session IDs. However, under very heavy load the problem rears its ugly head again.

3) We then double the memory for Xcache in the php config (xcache.size and xcache.var_size) and now the problem is gone.

So we suspect either APC or Xcache running out of memory was the problem. We're still waiting to see if this is a permanent solution.