A new module that helps with busy sites has been released.
This is the session expire module.
On busy sites, the number of rows in Drupal's sessions table can be really high. We saw sites with 1.7 million rows in it!
Drupal's core relies on PHP garbage collection to do this cleanup, but the options are sometimes not set correctly in php.ini, and vary from distro to distro, so the cleanup may not kick in at all. Moreover, the cleanup can be triggered by normal page views.
This module makes session cleanup more predictable and consistent, and also more configurable. By using Drupal's hook_cron, we avoid the uncertainity of PHP's garbage collection and its susceptibility to option settings.
Options are provided for : how often should the cleanup be attempted, the age of the sessions to be expired, and whether to expire only anonymous sessions or both anonymous and authenticated sessions.
A watchdog message notice is logged with the number of rows deleted from the sessions table.
You can download the module from the session expire module project page on Drupal.org.
This screenshot shows the options available in the module: