Consider entering them and their session ID into a database of "current logins" as they log in; this will allow you to keep track of active sessions in a global fashion.
Remember, though, that the server has no real way of knowing if someone has logged out unless they do so explicitly; it can't tell if they just closed the browser and wandered off.
So to keep track of "active" sessions, you will want to have a timestamp field in the database alongside the session that is updated every time the user does something (this can be built into whatever session-registering code you're using).
The database can be checked occasionally (eg. a random 1% of page hits that use the session database) and any sessions that haven't seen any action in, say 30 minutes (your results may vary) are regarded as "stale" and summarily logged off.
