Few users are getting session timeouts frequently

[Jason Miser]

Have about 5 users that are reporting they are getting logout of Jira ServiceDesk frequently during the day.

The timeout is still the default of 300 minutes.
Have DUO integrated (no session limitations from what I can see)

It has been going on for a while, where some days are worse for them than others.

I have seen the article about the atlassian-bot-killer plugin, though that does not seem to apply here.

A snippet from atlassian-jira-security.log for the user on a really bad day:

2018-03-12 12:28:51,053 http-nio-127.0.0.1-8080-exec-15 smithj 748x1292666x1 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:28:51,058 http-nio-127.0.0.1-8080-exec-19 smithj 748x1292668x3 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:28:51,059 http-nio-127.0.0.1-8080-exec-21 smithj 748x1292669x4 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:28:51,066 http-nio-127.0.0.1-8080-exec-20 smithj 748x1292667x2 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:28:51,067 http-nio-127.0.0.1-8080-exec-22 smithj 748x1292670x5 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:28:51,068 http-nio-127.0.0.1-8080-exec-13 smithj 748x1292671x6 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:28:51,137 http-nio-127.0.0.1-8080-exec-3 smithj 748x1292672x1 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:28:51,139 http-nio-127.0.0.1-8080-exec-18 smithj 748x1292673x2 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:28:51,145 http-nio-127.0.0.1-8080-exec-10 smithj 748x1292674x3 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:28:51,147 http-nio-127.0.0.1-8080-exec-17 smithj 748x1292675x4 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:30:05,361 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [ptqzwj] destroyed for 'smithj'
2018-03-12 12:30:05,361 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [w5s61l] destroyed for 'smithj'
2018-03-12 12:30:05,361 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1cs3wfg] destroyed for 'smithj'
2018-03-12 12:30:05,361 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1s9wj43] destroyed for 'smithj'
2018-03-12 12:30:05,361 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1h8nyzv] destroyed for 'smithj'
2018-03-12 12:30:05,361 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1lmcbc] destroyed for 'smithj'
2018-03-12 12:30:05,362 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1dx88zu] destroyed for 'smithj'
2018-03-12 12:30:05,362 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [esp402] destroyed for 'smithj'
2018-03-12 12:30:05,362 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1l7hads] destroyed for 'smithj'
2018-03-12 12:30:05,362 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [c0ah1h] destroyed for 'smithj'
2018-03-12 12:43:51,057 http-nio-127.0.0.1-8080-exec-13 smithj 763x1295948x1 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:43:51,066 http-nio-127.0.0.1-8080-exec-8 smithj 763x1295949x2 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:43:51,070 http-nio-127.0.0.1-8080-exec-23 smithj 763x1295950x3 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:43:51,075 http-nio-127.0.0.1-8080-exec-2 smithj 763x1295952x5 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:43:51,079 http-nio-127.0.0.1-8080-exec-6 smithj 763x1295951x4 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:43:51,092 http-nio-127.0.0.1-8080-exec-25 smithj 763x1295953x6 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:43:51,123 http-nio-127.0.0.1-8080-exec-21 smithj 763x1295954x4 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:43:51,125 http-nio-127.0.0.1-8080-exec-7 smithj 763x1295955x3 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:43:51,127 http-nio-127.0.0.1-8080-exec-24 smithj 763x1295956x4 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:43:51,144 http-nio-127.0.0.1-8080-exec-20 smithj 763x1295957x4 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:45:05,799 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1049qn2] destroyed for 'smithj'
2018-03-12 12:45:05,799 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [2c39ms] destroyed for 'smithj'
2018-03-12 12:45:05,799 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [gr4jzc] destroyed for 'smithj'
2018-03-12 12:45:05,799 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1099fav] destroyed for 'smithj'
2018-03-12 12:45:05,800 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [6cgacz] destroyed for 'smithj'
2018-03-12 12:45:05,800 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1j3fhig] destroyed for 'smithj'
2018-03-12 12:45:05,800 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1v77cp3] destroyed for 'smithj'
2018-03-12 12:45:05,800 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [ybgg0z] destroyed for 'smithj'
2018-03-12 12:45:05,800 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [foa827] destroyed for 'smithj'
2018-03-12 12:45:05,800 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1k5ym4h] destroyed for 'smithj'
2018-03-12 12:58:51,084 http-nio-127.0.0.1-8080-exec-25 smithj 778x1297729x1 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:58:51,085 http-nio-127.0.0.1-8080-exec-21 smithj 778x1297732x4 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:58:51,089 http-nio-127.0.0.1-8080-exec-24 smithj 778x1297730x2 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:58:51,090 http-nio-127.0.0.1-8080-exec-15 smithj 778x1297733x5 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:58:51,095 http-nio-127.0.0.1-8080-exec-19 smithj 778x1297734x6 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:58:51,101 http-nio-127.0.0.1-8080-exec-12 smithj 778x1297731x3 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:58:51,138 http-nio-127.0.0.1-8080-exec-3 smithj 778x1297735x6 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:58:51,161 http-nio-127.0.0.1-8080-exec-11 smithj 778x1297736x2 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:58:51,162 http-nio-127.0.0.1-8080-exec-10 smithj 778x1297737x3 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 12:58:51,163 http-nio-127.0.0.1-8080-exec-9 smithj 778x1297738x4 - 168.13.45.10,10.20.20.8,127.0.0.1 /rest/gadget/1.0/issueTable/filter The user 'smithj' has PASSED authentication.
2018-03-12 13:00:06,097 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [dpjbpb] destroyed for 'smithj'
2018-03-12 13:00:06,097 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [o2fazm] destroyed for 'smithj'
2018-03-12 13:00:06,097 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1wsrnzt] destroyed for 'smithj'
2018-03-12 13:00:06,097 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [13w1t1l] destroyed for 'smithj'
2018-03-12 13:00:06,097 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [pqv2fn] destroyed for 'smithj'
2018-03-12 13:00:06,098 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [1brqdt] destroyed for 'smithj'
2018-03-12 13:00:06,098 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [tip56c] destroyed for 'smithj'
2018-03-12 13:00:06,098 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [14uo77b] destroyed for 'smithj'
2018-03-12 13:00:06,098 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [ncb7sm] destroyed for 'smithj'
2018-03-12 13:00:06,098 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [wyicmp] destroyed for 'smithj'

[David Yu]

It's interesting how your user smithj is getting a new sessionid on each request. Does he have cookies enabled or some weird browser extension installed?

[Jason Miser]

Will check with user about browser extensions.

Checked the security log for number of sessions destroyed for each user, and there are a few users with high numbers per day.

What causes a destroyed session?

[David Yu]

My guess would be the BotKiller plugin. You can always test disabling it to see what happens.