There is no "standard" way to have a count of all the "active" sessions in a servet container. You have top maintain your own, maybe using a map that stores the session when the user logs in and remove it when the user logs out.

If the user doesn't log out properly, you can check if the session is still valid based on computing the time difference between the default timeout interval (HttpSession.getMaxInactiveInterval()) and the last activity performed by the user (HttpSession.getLastAccessedTime()).