有一种可能是因为 统计数的加减程序 没有设成synchronized
但还有一种可能：
When the server is restarted, if there are active sessions they are persisted by default. Then the server comes back up, and all these sessions are active, without a session created event, so your listener has a counter value of 0, but there are actually >0 active sessions. When these are destroyed as usual, sessionDestroyed() will be called for them, decrementing your counter and resulting in a negative value.