and yes use active record session then your tmp/session folder will be empty.
The folder will be empty but you'll have a growing sessions table. Either way you need a cronjob (or pick your favourite mechanism for scheduling scripts to run) that deletes sessions a some regular interval.
Fred
… or you can just call a cleanup method at the login page depending on the amount of traffic your site gets, works just as well.
Best regards
Peter De Berdt