alibaba/arthas · error · SessionNotFoundException

SessionId is required for this operation

Error message

SessionId is required for this operation

What it means

Thrown as SessionNotFoundException by CommandExecutorImpl.getCurrentSession when the caller supplied a blank/null sessionId AND one-time sessions are not allowed for this operation (oneTimeIsAllowed == false). The executor requires a real session id for stateful commands; only explicitly whitelisted one-time commands may run without one.

Source

Thrown at core/src/main/java/com/taobao/arthas/core/command/CommandExecutorImpl.java:57

 */
public class CommandExecutorImpl implements CommandExecutor {
    private static final Logger logger = LoggerFactory.getLogger(CommandExecutorImpl.class);
    private static final String ONETIME_SESSION_KEY = "oneTimeSession";
    
    private final SessionManager sessionManager;
    private final JobController jobController;
    private final InternalCommandManager commandManager;

    public CommandExecutorImpl(SessionManager sessionManager) {
        this.sessionManager = sessionManager;
        this.commandManager = sessionManager.getCommandManager();
        this.jobController = sessionManager.getJobController();
    }

    public Session getCurrentSession(String sessionId, boolean oneTimeIsAllowed) {
        if (sessionId == null || sessionId.trim().isEmpty()) {
            if (!oneTimeIsAllowed) {
                throw new SessionNotFoundException("SessionId is required for this operation");
            }

            Session session = sessionManager.createSession();
            if (session == null) {
                throw new SessionNotFoundException("Failed to create temporary session");
            }
            session.put(ONETIME_SESSION_KEY, new Object());
            logger.debug("Created one-time session {}", session.getSessionId());
            return session;
        } else {
            Session session = sessionManager.getSession(sessionId);
            if (session == null) {
                throw new SessionNotFoundException("Session not found: " + sessionId);
            }
            sessionManager.updateAccessTime(session);
            logger.debug("Using existing session {}", sessionId);
            return session;
        }

View on GitHub (pinned to 21cf2e9ba5)

Solutions

1. Open a session first (createSession) and pass the returned sessionId on every stateful call.
2. If the command is genuinely one-shot, ensure it is routed through the one-time-allowed code path.
3. Validate/normalize sessionId on the client side and surface a clear error to the user instead of sending blank.

Example fix

// before
executor.execute(commandLine, timeout, null /*sessionId*/, false);

// after
String sid = sessionManager.createSession().getSessionId();
executor.execute(commandLine, timeout, sid, false);

if (sessionId == null || sessionId.trim().isEmpty()) {
    sessionId = sessionManager.createSession().getSessionId();
}

static boolean isBlankSessionId(String s) { return s == null || s.trim().isEmpty(); }

try {
    Session s = executor.getCurrentSession(sessionId, false);
} catch (SessionNotFoundException e) {
    // open a session and retry with the new id
}

When it happens

Trigger: Call CommandExecutorImpl with a null, empty, or whitespace-only sessionId while oneTimeIsAllowed=false. Common with HTTP/programmatic callers that omit the sessionId header/param for a stateful command (watch, trace, monitor, dashboard, etc.).

Common situations: Calling the Arthas HTTP API without a sessionId (or with an empty string); a client that drops the session cookie/param; chaining a stateful command without first opening a session.

Related errors

• Failed to create temporary session
• Session not found: {sessionId}
• Required parameter '{paramName}' cannot be empty
• {iface} missing newInstance method
• {iface} is not an interface

AI-assisted analysis of alibaba/arthas@21cf2e9ba5 (2026-08-14). Data as JSON: /api/errors/4162144de7aa98b2. Report an issue: GitHub.