可以通過實現(xiàn)HttpSessionListener接口來進(jìn)行session的管理，實現(xiàn)sessionCreated和sessionDestroyed就可以監(jiān)聽session的創(chuàng)建和銷毀了，如果不按servlet標(biāo)準(zhǔn)的話看tomcat源碼吧，然后反射拿到內(nèi)部的session集合就行了，之前有這樣干過。

遍歷Session,獲得上一次更新時間,與現(xiàn)在時間比較,大于一定值刪掉.

public class HttpSessionCollector implements HttpSessionListener {
    private static final Map<String, HttpSession> sessions = new HashMap<String, HttpSession>();

    @Override
    public void sessionCreated(HttpSessionEvent event) {
        HttpSession session = event.getSession();
        sessions.put(session.getId(), session);
    }


    @Override
    public void sessionDestroyed(HttpSessionEvent event) {
        sessions.remove(event.getSession().getId());
    }

    public static HttpSession find(String sessionId) {
        return sessions.get(sessionId);
    }

}

How do I get a list of all HttpSession objects in a web application?