SharePoint 2013 : Cookie dropped from Distributed Cache with Event ID: air4a
You experience logon failures with SharePoint 2013 such as “access denied” errors or redirection to a logon page. When this issue occurs, the following logs appear in the SharePoint ULS logs:
01/09/2015 01:16:15.94 w3wp.exe (0x1D58) 0x27EC SharePoint Foundation DistributedCache air4a Monitorable Token Cache: Failed to get token from distributed cache for '0e.t|DOM|4019c581-8990-4729-b9a3-779f6bbf3ee3'.(This is expected during the process warm up or if data cache Initialization is getting done by some other thread).
01/09/2015 12:12:17.39 w3wp.exe (0x19C8) 0x1FFC SharePoint Foundation DistributedCache air37 Monitorable Token Cache: Reverting to local cache to Add the token for '0).w|s-1-5-21-2076828631-2543552492-1570323127-500'. 0328de9c-0cba-10fd-9061-7a15457058e0
CAUSE
Users intermittently lose their token from the Distributed Cache caused by the Application Pool being recycled. This behavior is by design. In this scenario, the code logic follows this path:
1. Find the cached token
2. Verify that the SPDistributedSecurityTokenCacheInitializer is initialized
3. If SPDistributedSecurityTokenCacheInitializer is not initialized, look for the token in the local cache
4. If the token is not found in local cache, generate logging
This issue occurs when the Application Pool is recycled on a SharePoint Front End Server (WFE) and the site has not been accessed after the recycle occurred. The Distributed Cache will not initialize for that WFE server until the site is accessed from the WFE, so this issue will be intermittent on a per-server basis. As soon as the Application Pool is warmed up, Distributed Cache will be initialized until the next recycle.
WORKAROUND
Configure the site by using warm up scripts to force Distributed Cache initialization after an Application Pool is automatically recycled.
MORE INFORMATION
Example of Warm up PowerShell script:
Get-SPWebApplication | ForEach-Object { Invoke-WebRequest $_.url -UseDefaultCredentials -UseBasicParsing }
This script should be scheduled as a task on each WFE Server in the farm that runs after the scheduled application pool recycles.