96

What is the default location of session files on an installation of Apache/PHP on Ubuntu 10.10?

3
  • 14
    just do a page with <?php phpinfo() ?> and look for the session.save_path. Commented Feb 7, 2011 at 23:23
  • 1
    Normally /tmp (IIRC) but check your php.ini for session.save_path
    – Mark Baker
    Commented Feb 7, 2011 at 23:23
  • @prodigitalson Hostinger's session.save_path by default points to a 1440 folder that doesn't exist, so I just changed it to a path with write permission and now session handling works ok. Commented Jan 6, 2023 at 23:13

8 Answers 8

93

The default session.save_path is set to "" which will evaluate to your system's temp directory. See this comment at https://bugs.php.net/bug.php?id=26757 stating:

The new default for save_path in upcoming releaess (sic) will be the empty string, which causes the temporary directory to be probed.

You can use sys_get_temp_dir to return the directory path used for temporary files

To find the current session save path, you can use

Refer to this answer to find out what the temp path is when this function returns an empty string.

7
  • 74
    And from the command line just do php -r 'echo session_save_path(), "\n";' Commented Aug 10, 2011 at 21:12
  • The location is set and not 'default' under Ubuntu 10.10. A clean build of PHP may give you this, but not under any Debian/Ubuntu builds I have used. The orig question pertains to Ubuntu 10.10. So, just look it up on command line per last comment (or my answer) as location can differ from 'default'/blank/tmp depending on Linux distribution used..
    – B. Shea
    Commented Apr 5, 2017 at 13:00
  • 5
    Warning!! I think running php -r 'echo session_save_path(), "\n";' as mentioned above will use a different php.ini file (perhaps /etc/php/7.0/cli/php.ini instead of /etc/php/7.0/apache2/php.ini), and therefore might have a different value of "session.save_path"
    – Magmatic
    Commented May 23, 2018 at 19:22
  • @Magmatic is correct, there are TWO php.ini files, php_info() will tell you which one is in use during the current eval, and locate php.ini will help you find them
    – Jonathan
    Commented Dec 5, 2018 at 20:33
  • Please note (as per last 2 comments): Using the CLI PHP version (command line) can produce different results depending on distro and compile. The main thing is it is NOT the Apache version. (Though the INI files may be identical as far as session paths). Better to look in/grep proper Apache PHP.INI.
    – B. Shea
    Commented Jun 27, 2019 at 19:45
78

First check the value of session.save_path using ini_get('session.save_path') or phpinfo(). If that is non-empty, then it will show where the session files are saved. In many scenarios it is empty by default, in which case read on:

On Ubuntu or Debian machines, if session.save_path is not set, then session files are saved in /var/lib/php5.

On RHEL and CentOS systems, if session.save_path is not set, session files will be saved in /var/lib/php/session

I think that if you compile PHP from source, then when session.save_path is not set, session files will be saved in /tmp (I have not tested this myself though).

8
  • 1
    I'm using Ubuntu 12.04.5 LTS and, for some reason (I have not changed anything in php.ini) my sessions are under /var/lib/php5/sessions
    – Felipe
    Commented Jan 30, 2015 at 19:35
  • 1
    "Not set"? It is set - but commented out in php.ini. This does not mean it doesn't have a value or isn't 'set'.. From command line just do: php -i | grep session.save_path for CLI (and probably Apache) session save path. Also, a given php.ini will normally show the 'default' path - it's just commented out.
    – B. Shea
    Commented Apr 5, 2017 at 13:09
  • And yes: if nothing compiled in as default path (not the case with most distributions), a blank will be used (compile default). Which would then use the system temp area (normally /tmp) as its fallback/default value. Please refer to php.net/manual/en/…
    – B. Shea
    Commented Apr 5, 2017 at 13:16
  • @bshea, by "not set", I meant set to the empty string
    – Rich
    Commented Apr 9, 2017 at 9:08
  • DEFAULT Ubuntu 16.04 : /etc/php/7.0/*/php.ini -> ;session.save_path = "/var/lib/php/sessions" -- A comment doesn't mean 'not set' is all I meant. It is set obviously to something other than 'blank' (/tmp).. and is NOT an empty/null string
    – B. Shea
    Commented Apr 10, 2017 at 16:23
17

If unsure of compiled default for session.save_path, look at the pertinent php.ini.
Normally, this will show the commented out default value.

Ubuntu/Debian old/new php.ini locations:
Older php5 with Apache: /etc/php5/apache2/php.ini
Older php5 with NGINX+FPM: /etc/php5/fpm/php.ini
Ubuntu 16+ with Apache: /etc/php/*/apache2/php.ini *
Ubuntu 16+ with NGINX+FPM - /etc/php/*/fpm/php.ini *

* /*/ = the current PHP version(s) installed on system.

To show the PHP version in use under Apache:

$ a2query -m | grep "php" | grep -Eo "[0-9]+\.[0-9]+"

7.3

Since PHP 7.3 is the version running for this example, you would use that for the php.ini:

$ grep "session.save_path" /etc/php/7.3/apache2/php.ini

;session.save_path = "/var/lib/php/sessions"

Or, combined one-liner:

APACHEPHPVER=$(a2query -m | grep "php" | grep -Eo "[0-9]+\.[0-9]+") && grep ";session.save_path" /etc/php/${APACHEPHPVER}/apache2/php.ini

Result:

;session.save_path = "/var/lib/php/sessions"


Or, use PHP itself to grab the value using the "cli" environment (see NOTE below):

$ php -r 'echo session_save_path() . "\n";'
/var/lib/php/sessions
$

These will also work:

php -i | grep session.save_path

php -r 'echo phpinfo();' | grep session.save_path

NOTE:

The 'cli' (command line) version of php.ini normally has the same default values as the Apache2/FPM versions (at least as far as the session.save_path). You could also use a similar command to echo the web server's current PHP module settings to a webpage and use wget/curl to grab the info. There are many posts regarding phpinfo() use in this regard. But, it is quicker to just use the PHP interface or grep for it in the correct php.ini to show it's default value.

EDIT: Per @aesede comment -> Added php -i. Thanks

1
  • 8
    Just FYI you can do php -i in CLI to get phpinfo() equivalent.
    – aesede
    Commented Oct 27, 2015 at 19:24
15

Another common default location besides /tmp/ is /var/lib/php5/

2
  • How come the /var/lib/php5/ is never writable and requires chmodding/chowning. Shouldn't PHP set the session location that is writable by default? Commented Jan 17, 2014 at 10:38
  • 2
    I imagine it is so on shared hosts other people cannot attempt to hijack peoples sessions. Ie, write to session saying "username:admin" and setting an arbitrary session ID, then setting PHPSESSID to that. Would be a very easy was to access something like Drupal or Wordpress on a shared host environment. (It would just log you in as the admin account)
    – Mattisdada
    Commented Apr 1, 2014 at 23:17
4

I had the same trouble finding out the correct path for sessions on a Mac. All in all, I found out that the CLI PHP has a different temporary directory than the Apache module: Apache used /var/tmp, while CLI used something like /var/folders/kf/hk_dyn7s2z9bh7y_j59cmb3m0000gn/T. But both ways, sys_get_temp_dir() got me the right path when session.save_path is empty. Using PHP 5.5.4.

3

Non of the above worked for me using the IUS repo for CentOS 7 with PHP 7.2:

php -v
> PHP 7.2.30 (cli) (built: Apr 19 2020 00:32:29) ( NTS )

php -r 'echo session_save_path(), "\n";
> 

php -r 'echo sys_get_temp_dir(), "\n";'
> /tmp

However, sessions weren't saved in the /tmp folder, but in the /var/lib/php/mod_php/session/ folder:

ls /var/lib/php/mod_php/session/
> sess_3cebqoq314pcnc2jgqiu840h0k  sess_ck5dtaerol28fpctj6nutbn6fn  sess_i24lgt2v2l58op5kfmj1k6qb3h  sess_nek5q1alop8fkt84gliie91703
> sess_9ff74f4q5ihccnv6com2a8409t  sess_dvrt9fmfuolr8bqt9efdpcbj0d  sess_igdaksn26hm1s5nfvtjfb53pl7  sess_tgf5b7gkgno8kuvl966l9ce7nn
3
  • for your kind information: session is not available in CLI. So, you'll not be able to use session related functions and variable in CLI Commented Feb 2, 2021 at 8:19
  • @AhmadAsjad That's not true, while it doesn't really make sense to use sessions in CLI, all methods are still available. It's possible the session save path isn't set automatically in CLI-mode, you may still set it manually, allowing you to access existing session data. If no path isset, it's reverted back to the system temp folder by default, but new sessions still can be created.
    – Tim
    Commented Feb 2, 2021 at 16:53
  • manually, you can change any default behaviour :) Commented Feb 4, 2021 at 16:22
2

The only surefire option to find the current session.save_path value is always to check with phpinfo() in exactly the environment where you want to find out the session storage directory.

Reason: there can be all sorts of things that change session.save_path, either by overriding the php.ini value or by setting it at runtime with ini_set('session.save_path','/path/to/folder');. For example, web server management panels like ISPConfig, Plesk etc. often adapt this to give each website its own directory with session files.

0

I believe its in /tmp/. Check your phpinfo function though, it should say session.save_path in there somewhere.

1
  • Although the PHP docs say that "/tmp" is the default, all linux distros that I've tried do not put the session files in /tmp -- do you know any that do? Is that the case if you build PHP from source? When the "session.save_path" is empty it can be tricky to figure out where the files go (hence this question, I suspect)
    – Rich
    Commented Aug 30, 2013 at 10:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.