Cleaning session table from auto action

Our website is being accessed by some bots, and as a result our session database has a LOT of entries for anonymous users.
The who's online frequently shows over 30000 users  We are also using an integrated version of phpBB and its session table also has that many entries.
This makes the loading of the home page slow. We have even seen php out of memory issues when we logon as administrator.
Deleting the entries for anonymous users from both session tables fixes that issue.

Of course we could set the session timeout to a very low number, but that will also negativelyt affect users that are logged in.
So I was thinking of creating a Sql script that deletes anonymous rows from both  session table after several minutes of inactivity.
Is this something that we can do with an Auto action?
And how would we do that?
Any hint would be appreciated.

Robert

Joomla uses keepalive to avoid logged in users sessions from expiring. So using a lower session time shouldn't really be a problem. What do you currently have it set to? The default is 15 minutes. Be sure within System > Manage > Scheduled Tasks that "Session GC" is published as it's responsible for clearing expired sessions so you could have sessions piling up simply due to the GC not happening. By default it runs once every day and you could increase that frequency if necessary.

You'd basically just be reinventing this process using CB Auto Actions so I'd recommend just making adjustments to Joomla itself. It is doable to clear sessions from CB Auto Actions though using a Query action and just deleting the table rows as needed in _session table.

Kyle,
Thanks for the reply. The timeout was set to 30 minutes. I'll reduce that to the default of 15.
I did not know that Joomla keeps the sessions from logged in users alive.

Robert

30 minutes should've also been fine. You shouldn't have issues with the table piling up with just 30 minutes. Are you sure session garbage collection is actually working? That might be the real problem here.

Kyle,
Yes the GC is working. But even then we see thousands (25.000 and more) anonymous connections. We seem to be under attack from some eastern european IP addresses.

Robert

That sounds more like a DDoS. I would contact your host about blocking that traffic at the host level.