for those people that log in
if login succesfull{
session['log']=+1
}
the hard part no matter which way you do it, is the decrement of the counter when the user doesn't log out properly...
see here for session_cache_expire on the server side, you should be able to work this as a trigger to reduce the session counter for those people that don't log in
from that page...
<?
if(!isset($_SESSION)) session_start();
$expire=606024752; # sec, min, hours, days, weeks ?
Client
setcookie(session_name(), session_id(), time()+$expire, "/");
....
Server
session_cache_expire($expire);
?>
hth