I know, we can query LoginHistory to find out who has logged in today - but that doesn't tell us who logged in and is STILL logged in ...
You can see currently logged in users in Setup > Security Controls > Session Management. For more information, have a look here: https://help.salesforce.com/htviewhelpdoc?id=security_user_session_info.htm&siteLang=en_US
You can also use the AuthSession object to use this information in your code: https://www.salesforce.com/developer/docs/api/Content/sforce_api_objects_authsession.htm
You can query the
AuthSession object to get the active sessions, which will include any that haven't ended due to timeout or the user explicitly logging out.
There will generally be multiple
AuthSession records per user because a Visualforce session is created in addition to a normal UI session. There will also be non-interactive sessions for users accessing Salesforce through the API, including other applications that access Salesforce on behalf of the user using OAuth.
Finally, users may log in multiple times throughout the day creating multiple sessions which haven't timed out yet.
So if you want to get the best estimate of the number of Users accessing Salesforce through the web interface, this is probably your best bet:
SELECT COUNT_DISTINCT(LoginHistory.UserId) FROM AuthSession WHERE LoginType = 'Application' AND SessionType = 'UI'