This week's book giveaway is in the General Computing forum. We're giving away four copies of Arduino in Action and have Martin Evans, Joshua Noble, and Jordan Hochenbaum on-line! See this thread for details.
I am not sure about Tomcat specific tools. But I'd do it manually in my application. Use a HttpSessionListener to register the sessions created into the servlet context. Now we could write an admin servlet to retreive the registered sessions from the servlet context which tell us many things including no. of current users.
The Tomcat Manager application can tell you how many current sessions a given web application has. I use it all the time for a quick glance at the state of the server. Naturally this is only the count of sessions that have not expired so it is a maximum, not the number of active users. In order to use the Manager you have to configure a user with permission to see it - the default Tomcat installation has an extensive discussion. Bill