Hey, Drupal fans! I would like to alert you to an issue that I encountered today. While doing some unrelated database work, I found that our sessions table had grown to over 3,700,000 records. While not posing any immediate danger to the website, this may have been slowing down backup and just isn’t tidy. Drupal relies on PHP garbage collection to cleanup session tables, but apparently this does not happen properly on Debian systems. Solutions include setting PHP defaults to encourage garbage collection and installing the Session Expire module. The problem is fixed in Drupal 7 through php.ini overrides.
I chose to install Session Expire on our Drupal 6 site, feeling that Drupal should clean up its own garbage. It also has the advantage of providing a choice between deleting anonymous sessions, authenticated user sessions, or both. The module is extremely simple and could be implemented on a Drupal 7 site if one would prefer to delete old sessions that way. The module took an hour to delete 3.7m records on a test copy of our site. You might prefer to just truncate the table instead, though this will log off people currently using the site.