Following your comments, it seems strange you got duplicates if you are actually using
/dev/urandom as entropy source and sufficiently long session IDs.
- Are you sure that PHP is correctly configured? As of PHP 5.4.0, PHP defaults are now secured, but it happens that some historical server settings remains over time and decrease the security compared to current defaults (PHP may not be actually using
/dev/urandom, or it may gather to few entropy from it),
- Are you sure that the issue hasn't been caused by a third party issue, like unvoluntary session fixation ? Such a bug for instance could occur if the session ID can be passed as URL parameter, and that URL containing the session is shared by some way, either explicitly (URL sent from one person to another) or by some unexpected way (content caching at the server or a proxy for instance).
/dev/urandom can be generally considered as a trusted entropy source. If by any chance you still want to investigate it, you can use
ENT tool for this purpose. You can find a usage example on this page.
A quick an dirty check on your file would be to ensure that there was at least no collision encountered during your session ID generation test:
LC_ALL=C sort /path/to/sample_file | uniq -d
/path/to/sample_file with your actual file containing your generated session ID, it should output all duplicated entries. Under normal circumstances it should therefore produce no output.
Testing the actual security quality of these files would be more tricky. A session ID must not only be unique, but it must not be predictible, this means that it should be evenly and randomly spread over a sufficiently large space of possibilities. This may be difficult to properly demonstrate. As said in my comment, there has already been a discussion on such topic, and while some web application security tools offer session ID analysis, the conclusion seemed that the most reliable way remains to analyse the application code and configuration itself.