I see loads of log messages reading like the following, for different users:
2018-09-06 07:57:30.534 DEBUG [scheduler-4] com.haulmont.cuba.security.app.UserSessions - Removing session due to timeout: xxxxxxxxxxxxx [xxxxxx], since: Tue Aug 2
1 07:39:20 UTC 2018, lastUsed: Tue Aug 21 17:04:00 UTC 2018
Such messages appear if a user doesn’t log out from the app but just close the browser, which is pretty common. If you want to suppress this message in the log, add the following line to tomcat/conf/logback.xml: