Instant Log off. Yelling at the monitor doesn't work

Permalink
We have a legacy 5.7.5.13 site that is beginning to enter cranky old age.

There are approximately 40 people actively working on this site. However, they are unable to log into the website and are receiving "Access Denied" or "Account Deactivated" error messages. Changes, edits, and pages are unable to be updated or created due to the issue.

I logged in as admin and found myself able to get in for about one minute at a time before being dumped. Several times, I tried to find where the time allowed for inaction before logout might have gone loopy, but couldn't make it to the right place before timing out.

After several iterations, it just flat inactivated my account. I'm hoping it was only a temporary blacklisting, but that brings me back to the original issue.

Any ideas?

yfsneals
 
hutman replied on at Permalink Reply
hutman
This doesn't quite sound like the typical symptoms, but do you have a caching engine in front of the site (Varnish or Cloudflare)? Those can cause weird issues.

Otherwise, has your host recently update the PHP version on the server? I'm not sure why that would cause intermittent issues like this, but it could.
ConcreteOwl replied on at Permalink Reply
ConcreteOwl
Do you have a cron job setup on the server to clear out the application/files/tmp folder of all the session files and is it running too frequently?, or is your application/files/tmp folder full?
Or if you are storing session data in the database, are you suffering from database bloat..
yfsneals replied on at Permalink Reply
yfsneals
Thanks for the input. I had nothing to go on earlier.
Ideas in order of probability:
1. PHP version incompatability.
2. Full application/files/tmp folder: I don't know what the limit is.
3. Database log causing bloat: I've seen this happen, but it isn't turned on.
4. Cron job for clearing out the temp files: Again, I don't think so, that would have to be set up by me in Automated Jobs
5. Caching engine: Nope.

I don't have the keys to the server, but I've asked someone to check on nos. 1 and 2.
ConcreteOwl replied on at Permalink Reply
ConcreteOwl
4. Cron Jobs can be run in the back end of the server, in fact this is how I prefer to run mine, they are super efficient and don't rely on the concrete cms at all.
5. If your hosting is running a lightspeed server, lightspeed has a built in caching system that has to be disabled using htaccess like this
RewriteRule (.*) - [E=Cache-Control:no-cache]