This is actually a Open Symphony error - it looks as though the log4J logger in the User object is not marked as transient...

I have a number of these errors in the logs.

2003-06-12 20:57:14 StandardContext[]: Reloading this Context is completed
2003-06-12 23:32:53 StandardManager[] Cannot serialize session attribute os_security_defaultauthenticator_user for session B7F30118137340E1701B9B2FB6D1C17D
java.io.NotSerializableException: org.apache.log4j.Logger
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1054)
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1330)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1302)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1245)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1052)
at java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:278)
at java.util.ArrayList.writeObject(ArrayList.java:530)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:324)
at java.io.ObjectStreamClass.invokeWriteObject(ObjectStreamClass.java:795)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1294)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1245)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1052)
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1330)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1302)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1245)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1052)
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1330)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1302)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1245)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1052)
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1330)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1302)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1245)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1052)
at java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:278)
at org.apache.catalina.session.StandardSession.writeObject(StandardSession.java:1427)
at org.apache.catalina.session.StandardSession.writeObjectData(StandardSession.java:869)
at org.apache.catalina.session.StandardManager.unload(StandardManager.java:507)
at org.apache.catalina.session.StandardManager.stop(StandardManager.java:662)
at org.apache.catalina.core.StandardContext.stop(StandardContext.java:3591)
at org.apache.catalina.core.ContainerBase.removeChild(ContainerBase.java:1036)
at org.apache.catalina.core.StandardHostDeployer.remove(StandardHostDeployer.java:420)
at org.apache.catalina.core.StandardHost.remove(StandardHost.java:852)
at org.apache.catalina.startup.HostConfig.undeployApps(HostConfig.java:919)
at org.apache.catalina.startup.HostConfig.stop(HostConfig.java:899)
at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:370)
at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:166)
at org.apache.catalina.core.ContainerBase.stop(ContainerBase.java:1221)
at org.apache.catalina.core.ContainerBase.stop(ContainerBase.java:1233)
at org.apache.catalina.core.StandardService.stop(StandardService.java:554)
at org.apache.catalina.core.StandardServer.stop(StandardServer.java:2224)
at org.apache.catalina.startup.Catalina$CatalinaShutdownHook.run(Catalina.java:622)

– Nick Minutello