code: private void scavenge()
      {
          Thread thread = Thread.currentThread();
          ClassLoader old_loader = thread.getContextClassLoader();
          try
          {
              if (_handler==null)
                  return;
              
              ClassLoader loader = _handler.getClassLoader();
              if (loader!=null)
                  thread.setContextClassLoader(loader);
              
              long now = System.currentTimeMillis();
              
              // Since Hashtable enumeration is not safe over deletes,
              // we build a list of stale sessions, then go back and invalidate them
              Object stale=null;
              
  
              synchronized(AbstractSessionManager.this)
              {
                  // For each session
                  for (Iterator i = _sessions.values().iterator(); i.hasNext(); )
                  {
                      Session session = (Session)i.next();
                      long idleTime = session._maxIdleMs;
                      if (idleTime > 0 && session._accessed + idleTime < now) {
                          // Found a stale session, add it to the list
                          stale=LazyList.add(stale,session);
                      }
                  }
              }
              
              // Remove the stale sessions
              for (int i = LazyList.size(stale); i-->0;)
              {
                  // check it has not been accessed in the meantime
                  Session session=(Session)LazyList.get(stale,i);
                  long idleTime = session._maxIdleMs;
                  if (idleTime > 0 && session._accessed + idleTime < System.currentTimeMillis())    
                  {
                      session.invalidate();
                      int nbsess = this._sessions.size();
                      if (nbsess < this._minSessions)
                          this._minSessions = nbsess;
                  }
              }
          }
          finally
          {
              thread.setContextClassLoader(old_loader);
          }
      }
docs: Find sessions that have timed out and invalidate them.
  This runs in the SessionScavenger thread.