# Bugs #2809: Sessions not counted **URL:** \ **Category:** eGW-tracker\ **Created:** [April 9, 2011, 1:57pm UTC](https://help.egroupware.org/t/bugs-2809-sessions-not-counted/46834 "2011-04-09T13:57:50Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![tracker-3](https://help.egroupware.org/letter_avatar_proxy/v4/letter/t/d07c76/32.png) [@tracker-3](https://help.egroupware.org/u/tracker-3)\ **Post date:** [April 9, 2011, 1:57pm UTC](https://help.egroupware.org/t/bugs-2809-sessions-not-counted/46834/1 "2011-04-09T13:57:50Z")
Ticket modified by Sebastian Steinhuber at 2011/04/09 15:57 Tracking System: Bugs Category: Admin Version: Version 1.8.001 Status: Open Resolution: Rejected Completed: 10% Priority: 5 - medium Created By: Peter Tuhársky Created on: 2011/01/21 10:25 Assigned to: Ralf Becker Summary: #2809 - Sessions not counted After upgrade from 1.6 to 1.8, eGW no longer counts the open sessions - there is always 0. This obviously affects the monthly statistics too. Comment by Sebastian Steinhuber at 2011/04/09 15:57: \> E.G. for Debian or Ubunto you have also to take care of the \> suhosin-extension: \> On Debian/Ubunto often the suhosin-extension is installed. With this \> extension, the active session data is encrypted and therefore EGroupware \> is not able to read \> the session data. This causes the “display of active sessions” and \> notification-popups not to work as expected. Great, that has put me into the right direction. I must admit that I didn’t RTFM of the suhosin extension completely. Please, let me leave some comments though. \> In this case proceed as follows: \> • chmod o+r /var/lib/php5 (enables read for “other”) Are you supposing that ‘session.save\_path = /var/lib/php5’? IMHO the directory $session.save\_path must be readable only by the web server, but never by other without a good reason. /var/lib/php5 is [drwx-wx-wt root root] on debian. In an EGroupware install with the official package, $session.save\_path defaults to /var/lib/egroupware/sessions, for what I set permissions to 700 for www-data:www-data from the default 755 which is working fine now. Please tell me why if I’m wrong with 700. \> • edit: /etc/apache2/conf.d/egroupware In row: php\_admin\_value \> open\_basedir add the value :/var/lib/php5 (as in .bashrc a path is \> added, in this file a additional path will be added with a „:“ as \> seperation , is there no value given, add it without „:“) $session.save\_path must be part of $open\_basedir, got you? \> • edit: /etc/php5/conf.d/suhosin.ini and change the line: \> suhosin.session.encrypt=off to „off“ (default is „on“) -this disables \> the encryption of the suhosin-extension Editing egroupware.conf, /etc/apache2/conf.d/egroupware and adding ’php\_value suhosin.session.encrypt off’ works as well. Please consider to add this statement in /etc/apache2/conf.d/egroupware for the next release of EGroupware. We got one step closer, but there is another issue apart from encryption. Both with active and removed suhosin extension, the session counter gets updated only after I opened http://$egroupware/index.php?menuaction=admin.uicurrentsessions.list\_sessions, i.e. ‘show current sessions’ in admin menu. Thanks for your time and attention, Sebastian Comment by Birgit Becker at 2011/04/08 12:41: Hi Peter which distribution are you using? Birgit E.G. for Debian or Ubunto you have also to take care of the suhosin-extension: On Debian/Ubunto often the suhosin-extension is installed. With this extension, the active session data is encrypted and therefore EGroupware is not able to read the session data. This causes the “display of active sessions” and notification-popups not to work as expected. In this case proceed as follows: • chmod o+r /var/lib/php5 (enables read for “other”) • edit: /etc/apache2/conf.d/egroupware In row: php\_admin\_value open\_basedir add the value :/var/lib/php5 (as in .bashrc a path is added, in this file a additional path will be added with a „:“ as seperation , is there no value given, add it without „:“) • edit: /etc/php5/conf.d/suhosin.ini and change the line: suhosin.session.encrypt=off to „off“ (default is „on“) -this disables the encryption of the suhosin-extension • then restart the apache webserver: /etc/init.d/apache2 restart This needs to be adapted for other distributions … Comment by Peter Tuhársky at 2011/04/05 12:45: I have added /var/lib/php5 to the php\_admin\_value open\_basedir in the file /etc/egroupware/apache.conf Restarted Apache, however, sessions still not counted. Comment by Tracking System at 2011/02/18 17:01: This Tracker item was closed automatically by the system. It was previously set to a Pending status, and the original submitter did not respond within 14 days. Comment by Sebastian Steinhuber at 2011/02/03 00:10: I got this issue in current trunk. Session files are created and deleted according to the login, and access is granted to the web server user. I have no clue why EGroupware ignores them. There are these apache directives in my VirtualHost config: php\_value session.save\_handler files php\_value session.save\_path /var/lib/egroupware/sessions php\_value open\_basedir /var/www/egroupware/:/var/lib/egroupware/:/usr/share/php/:/usr/bin/php:/tmp:/var/www/jpgraph/:/usr/bin/aspell:/usr/bin/crontab:/etc/debian\_version (no difference when adding /var/lib/egroupware/sessions to open\_basedir) #ls -al /var/lib/egroupware/sessions drwxrwx–T 2 root www-data 60 2. Feb 19:02 . drwxr-xr-x 4 www-data www-data 4096 12. Jan 14:48 … -rw------- 1 www-data www-data 446080 2. Feb 23:00 sess\_p0r09cmp271o532b23jpqho6m2 Cheers, Sebastian Comment by Klaus Leithoff at 2011/01/26 10:48: Either in the php.ini, or your egroupware.conf, or in your vhost configuration open\_basedir is the name. Comment by Peter Tuhársky at 2011/01/25 16:05: Please, where should I look for the directive? Comment by Klaus Leithoff at 2011/01/25 16:02: Check if your/a open\_basedir directive is in effect. If it is, include the php session path into the directory list. Restart your WebServer process. After that EGroupware should be able to read / browse the session directory (given the needed rights), and with that count the sessions. Comment by Peter Tuhársky at 2011/01/25 15:10: Yes, there is a thread, however with no useful information. Clearly it affects more users than just me. Comment by Birgit Becker at 2011/01/24 14:27: Hi Peter, i can not confirm that in general - as far as i know this can happen by a mis-configuration, but i do not know exactly what needs to be changed. I think there have been already some threads on the user-lists about that. Birgit linked entries: [http://www.egroupware.org/egroupware/index.php?menuaction=tracker.tracker\_ui.edit&tr\_id=2809&no\_popup=1](http://www.egroupware.org/egroupware/index.php?menuaction=tracker.tracker_ui.edit&tr_id=2809&no_popup=1)