Tomcat (as a servlet container) is able to manage sessions. When the session expires, tomcat have to invalidate it. As far as I'm concerned tomcat has a scheduler, which checks sessions expiration (am I right? I've tried to write a listener which implemented the HttpSessionListener (expiration period == 1 minute), and it's sessionDestroyed method was notified after a minute but I'm not sure what session was invalidated).
The question is, what is the scheduler's check period?
Short answer: by default checks are made every 60 seconds
Long answer: The checks are made by a background processing thread. Each container (Engine, Host or Context) may have its own background processing thread. If a container does not have a background processing thread, it uses the background processing thread from its parent. Engines have a background processing thread by default that checks every 10s. Hosts and Contexts do not have background processing threads by default. Additionally, session managers only run the session expiration code every processExpiresFrequency executions of the background processing thread. The default value for this is 6 so session expiration is executed every 6*10s = 60s by default.
