You may be able to track session objects with
JBoss's JMX Console.
I don't know if you can use this under Tomcat standalone.
There's something about Tomcat Monitoring with JMX at Tomcat's homepage,
like accessing session attributes.
Take a deep breath and have look
here. It seems quite advanced.