Assuming this is a web app, look into the HttpSessionListener. There are a couple ways to get an implementing class hooked up to the events. If you're in a cluster this will only monitor the one clone it's running on and a user could possibly show up in two places at once.
A good question is never answered. It is not a bolt to be tightened into place but a seed to be planted and to bear more seed toward the hope of greening the landscape of the idea. John Ciardi