I'm going to be working on a similar thing soon. I was planning on doing it by having a small table that is populated by only online users (ie they logon: entry goes in table, they logoff: entry comes out).
This would allow a fast, low impact (on resources) info to be gathered.
As for sessions, unless there's more to them than I think, these are more for keeping data between accesses, so more of an individual logon thing rather than an overview of everything that is going on.
Notes:
With this solution (small table), you will probably need some maintenance script that collects and chucks out users who have stopped using the system but have forgotten to log out. Thus time of last access might be a useful thing to store. This is the type of thing that can get really complex, but you can keep it simple too.
I hope this helps.