HttpSession destroyed

duely

Does anyone have users that has a high login count value? I noticed from my server logs in atlassian-jira-security.log, that anonymous creates HttpSession, but the user destroy the sessions. This occurs frequently and has inflated the login count value for the user in JIRA User Management.

Here's an example:

2018-12-10 18:40:23,242 http-nio-8080-exec-10232 anonymous 1120x8418373x1 - 87.100.100.100,25.25.25.55 /rest/api/2/search HttpSession created [zgmwkp]

2018-12-10 18:40:23,964 http-nio-8080-exec-10232 johndoe 1120x8418373x1 zgmwkp 87.100.100.100,25.25.25.55 /rest/api/2/search HttpSession [zgmwkp] destroyed for 'johndoe'

Here's a log of session being destroyed:

2018-12-10 18:40:17,382 http-nio-8080-exec-10267 johndoe 1120x8418352x1 17bjr9e 87.100.100.100,25.25.25.55 /rest/api/2/field HttpSession [17bjr9e] destroyed for 'johndoe'
2018-12-10 18:40:18,478 http-nio-8080-exec-10216 johndoe 1120x8418353x1 1xquqic 87.100.100.100,25.25.25.55 /rest/api/2/search HttpSession [1xquqic] destroyed for 'johndoe'
2018-12-10 18:40:19,369 http-nio-8080-exec-10182 johndoe 1120x8418358x1 1xyug8o 87.100.100.100,25.25.25.55 /rest/api/2/search HttpSession [1xyug8o] destroyed for 'johndoe'
2018-12-10 18:40:20,283 http-nio-8080-exec-10263 johndoe 1120x8418360x1 13ire5g 87.100.100.100,25.25.25.55 /rest/api/2/search HttpSession [13ire5g] destroyed for 'johndoe'
2018-12-10 18:40:21,202 http-nio-8080-exec-10159 johndoe 1120x8418361x1 geraro 87.100.100.100,25.25.25.55 /rest/api/2/search HttpSession [geraro] destroyed for 'johndoe'
2018-12-10 18:40:22,140 http-nio-8080-exec-10284 johndoe 1120x8418363x1 p0bjiv 87.100.100.100,25.25.25.55 /rest/api/2/search HttpSession [p0bjiv] destroyed for 'johndoe'
2018-12-10 18:40:23,060 http-nio-8080-exec-10248 johndoe 1120x8418370x1 1ptk7ka 87.100.100.100,25.25.25.55 /rest/api/2/search HttpSession [1ptk7ka] destroyed for 'johndoe'
2018-12-10 18:40:23,964 http-nio-8080-exec-10232 johndoe 1120x8418373x1 zgmwkp 87.100.100.100,25.25.25.55 /rest/api/2/search HttpSession [zgmwkp] destroyed for 'johndoe'
2018-12-10 18:40:24,220 http-nio-8080-exec-10235 johndoe 1120x8418375x1 6rk2pg 87.100.100.100,25.25.25.55 /rest/api/2/search HttpSession [6rk2pg] destroyed for 'johndoe'

Notice that the session destroyed has multiple entries within a minute. These session destroy gets tallied into the user login count value.

Josh Steckler

Http Sessions without associated logins are usually in my experience related to monitoring tools.

Users that have very high session counts are usually in my experience using the REST API for something. I would suspect this is what is happening for you.