Are PHP session files ever deleted?

Question

I see there are thousands of files in my "/tmp" directory (a CentOS machine) and almost all of them are PHP session files.
I'm worried about the possible impact this might have on my system.
Are those files ever deleted either by the OS, Apache or PHP? or I have to take care of it myself?

Answer 1

They should be deleted by the PHP garbage collector. The frequency is controlled by the session.gc_maxlifetime setting in php.ini. Possibly if this is not kicking in you have other problems.

Answer 2

You could setup a cron script to clean them up automatically. It's generally a good idea to test for creation date older than what the life of cookies is set up to be on your system.

Limiting cookie life is done thusly (must be done before script outputs anything):

<?php
session_name('my_site_name');
session_set_cookie_params(1209600); # max cookie age of 14 days
# send cookie headers
session_start();
?>

Then, in your cleanup script:

#!/bin/sh
find /tmp -type f -maxdepth 1 -name 'php_session_file_prefix*' -ctime +15 -exec rm -f {} \;

Then, in your crontab:

# Run daily cron jobs at 03:40 every day
40 3 * * * /path/to/php-session-cleanup.sh

Answer 3

Also at reboot - as /tmp is always cleared out on reboot.

Answer 4

The PHP cookies get deleted at closing of the browser.But permanent cookies may be created using a database entry or a server side file as a cookie.

Answer 5

This might be an old question, but no one nailed it right to the head: No, by default session files are not deleted at any point of time (at least on a php 5.3 / ubuntu/debian standard set up). php.ini says it like this:

; Lifetime in seconds of cookie or, if 0, until browser is restarted.
; http://php.net/session.cookie-lifetime
session.cookie_lifetime = 0

To be honest, i'm am a little bit shocked by this ! I mean, this will cause hundreds of thousands of files ... A browser restart will mean that the user gets a new session id, so the "old one" will never be deleted.