Should values kept in Tomcat Session be set to null when session is being destroyed? Or they are automatically destroyed?
When a session get invalidated, its attributes will just be dereferenced. When they aren't referenced by any other object, then they will be eligible for GC. Once GC runs, then they will be destroyed, yes.
We had a problem with multiple .ser files in tomcat folder. Could that be because we do not set values kept in session to null after using them ?
No. This sounds like as if Tomcat crashed during startup or shutdown. I'd read the logs.