Tomcat's manager application can tell you the number of active sessions. This doesn't necessarily correlate to the actual number of people using your application. HTTP is a stateless protocol. There is nothing to end a session if a user moves on to another site or cloeses their browser.
If this is a feature of the application, then I would use a HttpSessionListener to count/register all the sessions created/removed into a context attribute, say a Map. And now, any servlet (better protected by some security features) can access the context attribute and count the number of active session object there.