One of the big controversies of session handling concerns the performance difference between storing session state in an HTTP session object and using a stateful session bean. My colleagues and I expected that it would be more efficient to store data in an HTTP session object, as we were under the impression that there is more overhead involved with the infrastructure of session beans in the EJB container. Therefore, we were interested in measuring the performance of each method, to prove or disprove our initial notion.

To test this out, we created a small application that we used to store a specified amount of randomly generated content in either an HTTP session object or in a stateful session bean (size=number_of_bytes_to_store). Our application consisted of a single class, the SessionServlet, which we used both as a servlet and as a session listener. The servlet methods were responsible for handling requests and storing data in the associated session, using a specified storage method. When the servlet was requested using the argument type=0, it stored data in an HttpSession object, but when run with the argument type=1, it stored the data in a stateful session bean. When we used the session bean, we still needed the HTTP session object to store the bean's handle, in order to associate the bean instance with the client.

In addition to being a servlet, the SessionServlet extended the HttpSessionListener interface. We did this to ensure that all session beans would be removed from the container when the associated session was invalidated. If we had not explicitly removed the session beans - by calling the ejbRemove() method, as you will see later - they would have been passivated by the bean container, resulting in a dramatic impact on performance.

The test environment was based on the WebLogic server 6.1 SP2 running out of the box (15 execute threads). We used JDK 1.3.1-b24 HotSpot Server and the only parameter we defined was the heap space of 128MB (-ms and -mx were the same). The computer was a Sun Ultra 60 with dual Ultra SPARC II 450MHz, 512MB of memory, running Solaris 2.7. All of the tests were conducted on a dedicated 100Mbps network in which the only traffic present was generated by the tests themselves.

Once the SessionServlet had been deployed, we used The Grinder (http://grinder.sourceforge.net) to generate a test load in which each simulated user executed a test script (see Listing 1). As you can see, every request stores a different amount of bytes. The total number of bytes stored per session is 3,200. Also note that there is no think time between requests. We did this deliberately to maximize the stress on the system.

To make sure that the stateful beans were removed at the end of every HTTP session, we set the HTTP session timeouts in the WebLogic server to 5 seconds and forced the test script to sleep for 6 seconds before starting a new HTTP session.

We ran the tests using 100, 200, 300, 400, and 500 simultaneous active users, each executing the test script in a sequential fashion for the duration of the test runs. The sample size was 10 minutes after ignoring the first 3 minutes of execution of the test. The results for the average response time can be seen in Figure 1.

The figure presents the aggregate average response time, which is the average of all the individual average response times for each of the 10 requests that make up the test script. We also present the average response time for the first request, which we expect to be a little more expensive than the other requests since this one has to establish the HTTP connection and create the HTTP session object (as well as the stateful session bean when type=1).

Notice how the first request becomes less expensive than the aggregate value of the response time as the load increases. This shows that under high loads the manipulation of the HTTP session object is more expensive than the HTTP handshake and the creation of the HTTP session object.

Looking at Figure 2, the total transactional rate, we notice that we have not yet reached the full capacity of the application server, as the curve has not stabilized.

The network utilization varied from an average of less than 1% for the case of 100 users all the way up to about 4% for 500 users (see Figure 3).

A similar occurrence was observed with the CPU usage of the computer running the application, which varied from an average of 20% for 100 users to about 90% for 500 users (see Figure 4).

The next set of tests uses the stateful session bean by specifying type=1 as an argument to the servlet. To our amazement, the results were basically the same as the comparison seen in Figure 5.

In the case of the transactional rate, the biggest difference was on the order of 1%, which can be considered negligible. We did observe that the network and CPU utilization of this set of tests was basically the same as the ones for the tests using the HTTP session object.

We had to acknowledge that the stateful session bean did not use the security features offered by the EJB container. Nevertheless, it was interesting to find out that under the test conditions the comparative costs of storing data in an HTTP session object are roughly the same as storing the same data in a stateful session bean. To say the very least, this came as a surprise.

I strongly encourage you to test your situation, taking particular care of the think times you use in the test scripts. Although I'm sure you'll see different raw performance numbers, I expect that the comparative costs between the two models will be roughly the same.

The think times can have a very big impact on the results you obtain. We did not use think times purposely to observe behavior in a high-stress situation. You must use the real think times that apply to the normal utilization of your application.

Using ejbRemove
One of the most common programming mistakes in J2EE is to forget to explicitly destroy or remove EJBs once they have been used. This usually happens when you call EJBs from servlets. We mentioned earlier that we took a lot of care in our previous tests to make sure that the EJBs were removed. We did this by implementing a session listener, which made sure that before a session was terminated, all the beans it may have been using would be terminated. In addition, we made sure that our test script waited until the HTTP session timed out, giving the listener time to remove the EJBs.

Failure to remove an EJB that should have been removed carries a very high price from the performance perspective. Basically, what happens is that the EJB will be passivated, a rather silly way of removing an EJB from the container. As you probably know, passivation is a very expensive operation, as it first serializes the bean, and then writes it to disk.

To clearly illustrate the expense of passivation, we modified the servlet used for the previous tests. We did this by adding a type=2 test that will not remove the stateful session bean when the HTTP session is terminated. The differences in performance are so big we had to use a logarithmic scale for the chart in Figure 6. The picture for the transactional rate is even worse (see Figure 7).

If we remove the EJB while the number of users increases, the throughput also increases; if we don't remove it, the throughput actually decreases as the number is users increases.

Conclusion
It's amazing to find out that the cost of storing data in an HTTP session object is basically the same as using a stateful session bean, assuming the bean is removed in a proper way at the time the session terminates. Not doing so will have a negative impact on the performance of the application. But knowing that the beans must be removed is one thing - actually getting it done in time is another. In fact, it takes a considerable programming effort to ensure that this is done correctly. In our case, we used the session listener mechanism to monitor the session lifecycle and then to cut in moments before the beans are passivated. For your own applications, you can use this method or any other you find more viable. In any case, always make sure to properly test and analyze the system before making any final decisions.

Acknowledgements
This article is an extract from the book J2EE Performance Testing by Peter Zadrozny (Expert Press, June 2002). Special thanks to Bjarki Hólm and Gareth Chapman for their help in preparing the application used for these tests.