Managing Session State with REDIS and Spring Session Ram Gopinathan Principal Technology Architect, T-Mobile 

Who Am I? • Ram Gopinathan • Full stack engineer with 22+ years of experience building web, mobile and distributed applications. • Multi-cloud experience (Azure, AWS, GCP) 

About T-Mobile ▪ As America's Un-carrier, T-Mobile US, Inc. is redefining the way consumers and businesses buy wireless services through leading product and service innovation. ▪ NASDAQ traded public company – TMUS ▪ Two flagship brands: T-Mobile and MetroPCS ▪ Based in Bellevue, Washington 

No content

Connecting with Customers • Multiple ways for customers to connect with T-Mobile • Stay connected & Listen to customers 

“Web applications continue to dominate in most of the enterprises” 

Problem Definition • “HttpSession” based session state management approach is not reliable in modern cloud/microservices based architectures • Does not confirm to 12 factor App methodology • Specifically #6 which states Twelve- factor processes are stateless and share-nothing. Any data that needs to persist must be stored in a stateful backing service, typically a database. 

Plan Management Order Management Solution Architecture Micro Apps BFF Subscriber Management Eureka Server Payment ELB Microservices Layer Gateway/Routing Layer Experience Layer Service Discovery Gateway Config Server 

Spring Session Primer • Provides API and implementations required for managing user’s session • Redis, JDBC, Mongo, Gemfire, Hazelcast • Roll your own implementation • Supports clustered sessions without being tied to application container specific solution • SessionIDs can be exchanged via Headers to work with REST APIs • Websocket support 

Redis Overview • In memory key value database that provides fast access to data • Data can be persisted to disk • Written in C • Variety of Redis client implementations exist for various programming languages • Deploy in master/slave or cluster mode for HA and scale 

Redis deployment options • Open source (Run your own) • AWS Elastic Cache • Azure Redis Cache • Redis Labs Azure Redis Cache Redis Labs 

Monitoring Redis • Collect metrics that help with troubleshooting • Useful System Metrics Metric Comments Alert? CPU Usage High CPU usage is not a bad thing as long as you don’t max out Alert triggered when threshold is reached Memory Usage Dependent on how many keys and values. OS needs memory too Alert triggered when threshold is reached Network Bandwidth Related to number of connections and size of those request. Helps with troubleshooting Disk Usage If you are persisting to disk ensure enough space left for new data, logs, temp files, snapshots or backups Alert triggered when threshold is reached 

Monitoring Redis • Availability related metrics Metric Comments Alert? connected_clients Number of clients connected to REDIS. For session data this would be number of active sessions rdb_last_save_time Timestamp when data was last persisted to disk Alert when it doesn’t meet your acceptable timeframe rdb_changes_since_last_save Number of changes to the db since it was last persisted. Data that you would lose upon restart. connected_slaves Number of slaves connected to master Alert when connected slaves is not equal to number of slaves in cluster master_last_io_seconds_ago Seconds since last interaction between slave and master Alert when it doesn’t meet your acceptable timeframe evicted_keys Number of keys removed due to reaching memory limit blocked_clients Clients blocked while waiting on BLPOP, BRPOP, or BRPOPLPUSH rejected_connections Number of connections rejected due to hitting max client limit Alert when it exceeds acceptable threshold 

Monitoring Redis • Performance related metrics Metric Comments Alert? latency Avg. time taken to respond to query Alert when > 200ms or when it doesn’t meet your acceptable criteria used_memory Memory consumed by REDIS. mem_fragmentation_ratio High ratio will lead to memory swapping and perf degradation Alert when greater than 1.5 instantaneous_ops_per_sec Commands processed per second hit rate keyspace_hits / (keyspace_hits + keyspace_misses) 

Monitoring tools • redis-cli commands • Info • Monitor • redis-stat • redmon • RedisLive • Collectd • Telegraf 

Spring Configuration Properties 

Why use REDIS for Session Store ? • Externalize session data • Combine cache and session store use cases • Expire/Kill user sessions • Easily Identify number of active users in the system • Works very well in clustered environment • No need for LB sticky sessions • Scales well • Performance 

Real world use cases 

Web Application used in MetroPCS Retail channel • Application developed as a single web system for stores, dealers and call centers • Major design patterns • Complements and simplifies existing front ends • Maximum Reusability • Ability to support Metro Mobility, Metro WEB and Dealers systems as part of the platform modernization • Innovative and creative - new technologies, looking ahead and addressing clients needs (Industry is going digital) • Cloud ready • System design is based on production-proven solutions by Spring and Netflix 

AEM based Web CMS system • Web application used by existing customers • Externalized Tomcat Http Session state to Redis • Increased performance due to better web server resource utilization • Eliminate LB sticky sessions • Easily swap the session data persistence store in future 

Demo • Using redis for managing web application session state 

• Min 3 node Master/Slave deployment with Sentinel for HA • Use connection pooling • Set max-active to at-least the number of tomcat connections to redis • set max-wait configuration property to an appropriate value • Redis connection time out • spring.redis.timeout -> set appropriate value • Expired sessions cleanup • Consider cluster mode deployment with sharding to distribute data across multiple nodes Things to consider for Production 

Resources • https://docs.spring.io/spring- session/docs/current/reference/html5/#introduction • http://projects.spring.io/spring-session/ • https://12factor.net/ • https://redis.io/topics/sentinel • http://code.hootsuite.com/mysql-to-redis/ • https://www.datadoghq.com/blog/how-to-monitor-redis- performance-metrics/ • https://redis.io/topics/partitioning 

Q/A Getting in touch • Blog: http://rprakashg.io/blog • Twitter: http://twitter.com/rprakashg • LinkedIn: https://www.linkedin.com/in/rprakashg • Email: mailto:ramprakash.gopinathan@t- mobile.com