questions about increasing session timeout

[sbh]

Description:

1. What is the effect of increasing the session timeout? Why does the documentation say "Adjust this timeout setting to no more than a few hours, although up to 24 hours is workable"? Does increasing the timeout cause a huge performance hit?
2. Would adding a Remember Me check box to the login screen be a better solution? Is that possible with single sign-on?

Background:

Our ServiceNow fulfillers are frustrated by the default 30-minute timeout. Our governance committee initially approved a request to increase it to "8 hours or 1 day, whatever the system recognizes." When I noted that the documentation at https://docs.servicenow.com/bundle/madrid-platform-administration/page/administer/user-sessions/conc... says "Making the interval longer can lead to the unnecessary maintenance of inactive sessions in memory. Adjust this timeout setting to no more than a few hours, although up to 24 hours is workable", they changed the request to increase it to 4 hours, which I just did. I've asked them to let me know as soon as possible if they notice any issues.

We don't have the Remember Me check box because we have single sign-on. We use the same login screen to log in to all apps that our university credentials give us access to but - currently - we still have to log in to each of those apps separately, and we have different sessions for each. There are plans to change that in the future, though it may not be soon. (The idea is to allow us to just log in once a day to gain access to any or all of those apps, though I'm not sure how that works with sessions.) I don't know if there's a way to add a Remember Me check box while using either form of single sign-on. Has anyone else done this?

Thank you!!

[Giles Lewis]

I think in a university setting, values of 4 hours and 8 hour are pretty common. I have never heard of it becoming a performance issue. I think if you go over 8 hours it becomes a security issue.

[Michael Ritchie]

So the high level technical answer of why there is language in the Doc article about "Making the interval longer can lead to the unnecessary maintenance of inactive sessions in memory" is that when a user session is active in the platform the application server is retaining a user session for this user and various things are cached for that user in that memory.  So if the user remains obviously the memory is being consumed.

Not knowing anything about your user volumes, I would suggest you open a case in Hi and work with support to ensure your instances have enough "head room" to accommodate this change just to protect yourselves.  This is a common situation where there is large user growth as example for customer and support can make sure your instance is adequately sized.

[sbh · Accepted solution]

Thank you both for your prompt and helpful replies. I had opened a case with HI just before I posted my question (the reverse of the usual procedure) and Timothy Tang told me pretty much what you two told me, plus a little:

• the warning about increasing the timeout by too much is to prevent a performance hit caused by the maintenance of so many active sessions at once
• "The remember me checkbox is only available to local sign on of servicenow instances" and can't be done with single sign-on
• he consulted with someone else about a rough estimate of the effect on performance (we have over 20,000 active users listed) - he thought that 4 hours or maybe even 8 hours wouldn't be bad, but that 24 hours would be terrible.

Giles, I forwarded your answer to our governance committee because it referred specifically to universities and because it included the security issue.