php5 should come with a default cron job to remove session files.
In Debian/Ubuntu, it is like the following one (direct copy from Ubuntu 12.04 LTS)
/etc/cron.d/php5
# /etc/cron.d/php5: crontab fragment for php5
# This purges session files older than X, where X is defined in seconds
# as the largest value of session.gc_maxlifetime from all your php.ini
# files, or 24 minutes if not defined. See /usr/lib/php5/maxlifetime
# Look for and purge old sessions every 30 minutes
09,39 * * * * root [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f -cmin +$(/usr/lib/php5/maxlifetime) ! -execdir fuser -s {} 2>/dev/null \; -delete
It run every half an hour, and remove expired session base on session.gc_maxlifetime in php.ini.
So you should do following:
- Check if you have the above cron job file. Add it if missing.
Check value of session.gc_maxlifetime in /etc/php5/apache2/php.ini
Default value of session.gc_maxlifetime on Ubuntu is 1440sec = 24min
session.gc_maxlifetime = 1440
If the above 2 looks normal, try run the command line in cron job manually. That will print all error on screen.
- Grep for cron error in /var/log/syslog. See if they are php related.
Regarding the billions session files already exist, you have to delete them manually for now.
To put the current situation under control
service apache2 stop
mv /var/lib/php5 /var/lib/php5.delete
mkdir /var/lib/php5
chmod 733 /var/lib/php5
chmod o+t /var/lib/php5
service apache2 start
Then deleted /var/lib/php5.delete. It may takes hours. At the same time, keep an eye on file number in new /var/lib/php5 directory. If it is increasing in an abnormal way, you properly have problem other than removing files.
Run cron job command line manually
Just put the portion after root in command prompt, as follow
[ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f -cmin +$(/usr/lib/php5/maxlifetime) ! -execdir fuser -s {} 2>/dev/null \; -delete