This has been rehashed a lot of times in a lot of different places. What you need to do is determine what you need as criteria for "logged in". Presuming you are using sessions, you probably will want to code a database handler for your session information. I found a nice little code chunk around here last night. Not only does this make it a lot easier to deal with session related data, but at least on my system, accessing the session data (when loading/parsing pages) is insanely faster.
I set it up to expire all sessions if their data hasn't been updated in 30 minutes, so that way if someone doesn't click "Logout" it will start ignoring their stale session information. Then I just pull the count of how many non-stale sessions are listed in the database.
