you could setup a table called "logins" that looks something like this:
login_id (INT) PK
session_id (VARCHAR)
user_id (INT)
update (TIMESTAMP)
when a user logs in a session is started and a new records is INSERTed. During each page request, the "update" column is UPDATEd with the current timestamp. When the user logs out, simply delete the record and run [man]session_destroy[/man].
as far as deleting old records after inactivety, run an hourly cronjob that scans the table for "updates" that are older than 1 hour (or whatever time interval you want) and deletes the records and the corresponding session file.