This is how debian Woody (and all sane systems) clean up PHP disk based (the default) sessions:

  1. Every x (default: 1000) requests, PHP will delete all outdated sessions.

    This is how Debian Sarge does it:

  2. Every half hour (at 9 and 39 past) run a script
  3. This script runs a second shell script that parses the PHP config file with a regex to get the value for how long sessions should last (Which is odd, because a PHP script will get this automatically)
  4. The first script will then find all session files older than that value
  1. Delete them.

    WHY? WHY WHY WHY?

    This is the kind of braindead overcomplication stuff I’d expect from Gentoo, but the whole point of Debian is that it’s /sane/.