private void evictExpiredOrInvalidSessions() {

            // Get start time of session check time
            long sessionCheckStart = System.currentTimeMillis();

            logger.debug("Checking for expired or invalid sessions...");

            // For each session, remove sesions which have expired
            Iterator<Map.Entry<String, GuacamoleSession>> entries = sessionMap.entrySet().iterator();
            while (entries.hasNext()) {

                Map.Entry<String, GuacamoleSession> entry = entries.next();
                GuacamoleSession session = entry.getValue();

                try {

                    // Invalidate any sessions which have been flagged as invalid by extensions
                    if (!session.isValid()) {
                        logger.debug(
                                "Session \"{}\" has been invalidated by an extension.",
                                entry.getKey());
                        entries.remove();
                        session.invalidate();
                    }

                    // Do not expire sessions which are active
                    if (session.hasTunnels())
                        continue;

                    // Get elapsed time since last access
                    long age = sessionCheckStart - session.getLastAccessedTime();

                    // If session is too old, evict it and check the next one
                    if (age >= sessionTimeout) {
                        logger.debug("Session \"{}\" has timed out.", entry.getKey());
                        entries.remove();
                        session.invalidate();
                    }

                }
                catch (Throwable t) {
                    logger.error("An unexpected internal error prevented a "
                            + "session from being invalidated. This should "
                            + "NOT happen and is likely a bug. Depending on "
                            + "the nature of the failure, the session may "
                            + "still be valid.", t);
                }

            }

            // Log completion and duration
            logger.debug("Session check completed in {} ms.",
                    System.currentTimeMillis() - sessionCheckStart);
            
        }
Iterates through all active sessions, evicting those sessions which
are beyond the session timeout, or are marked as invalid. Internal
errors which would otherwise stop the session eviction process are
caught, logged, and the process is allowed to proceed.
guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java