PRB: Session variables are lost intermittently in ASP.NET applications

Session variables may be lost intermittently in Microsoft ASP.NET applications.

When this problem occurs on a Microsoft Application Center 2000 cluster, the sessions will drop on the controller when antivirus software scans the Web.config or the Global.asax files. The scan will trigger a replication, causing sessions to be lost on each member server in turn as the file is replaced.

There are many possible causes for this problem. This article addresses one possible cause: session data that is lost because of antivirus software activity.

This problem can occur when antivirus software scans the Web application files. During the scanning process, the antivirus software may mark the Global.asax, the Web.config, and/or the Machine.config files as modified. This modification prompts the Microsoft .NET Framework restart the Web application. If the session data is stored in-process, all session data is lost whenever a Web application is restarted.

To resolve this problem, use one of the following methods:

• Configure your antivirus software so that it does not scan .asax and .config files.
• Contact the antivirus software manufacturer for instructions.
• Configure your Web application to store session data out-of-process. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
  307598  (http://support.microsoft.com/kb/307598/ ) ASP.NET state management overview

This behavior is by design.

Steps to reproduce the behavior

Note This sample assumes that your Web application stores session data in-process (which is the default behavior).

1. Follow these steps to create a Web application in Microsoft Visual Basic .NET:
   1. Open Microsoft Visual Studio .NET.
   2. On the File menu, point to New, and then click Project.
   3. In the New Project dialog box, click Visual Basic Projects under Project Types, and then click ASP.NET Web Application under Templates.
   4. In the Location text box, type http://localhost/TestWeb1.
   5. Click OK to create the project. WebForm1.aspx is added to your project by default.
2. In the Solution Explorer window, right-click WebForm1.aspx, and then click View Code.
3. Add the following code to the Page_Load event procedure:

   Response.Write("<b>Session Variable Test</b><br>&#xa0;<br>")
   If IsNothing(Session("TestVal")) Then
       Response.Write("TestVal old value: <b>nothing</b>")
       Session("TestVal") = 0
   Else
       Response.Write("TestVal old value: " & Session("TestVal"))
   End If
   Session("TestVal") += 1
   Response.Write("<br>TestVal new value: " & Session("TestVal"))
   					

4. On the Build menu, click Build Solution.
5. In the Solution Explorer window, right-click WebForm1.aspx, and then click View in Browser.
6. In your browser, click Refresh. Notice that the page displays the initial value of the session variable as nothing.
7. Click Refresh again several times. Notice that the initial value of the session variable changes to a number that increments whenever you refresh the page.
8. Leave the page open in your browser.
9. In Notepad, open the Global.asax file from your project's folder. The Global.asax file of this TestWeb1 project is typically located in the C:\Inetpub\wwwroot\TestWeb1\Global.asax folder.
10. Move the insertion point to a blank line in the Global.asax file, and then press ENTER to add a second blank line. You must perform this step to mark the file as having been modified.
11. Save your changes to the Global.asax file.
12. In the browser, click Refresh again. Notice that the TestVal session variable displays an initial value of nothing. Your in-process session variables are lost.

For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base: