I guess the way I'd put it is:
- For current active user count and list: see Server Status page, MBean dump and/or JMX console
- For past active user count and list: Security Audit Reporting, Query Builder, etc.
In 10.x releases one can also get active user counts for the last 120 days from the (non-modeled) SMHealthStats table and a chart linked to from the active user count on the server status page. This data is generated every 10 minutes from every server manager, rather than upon each user login/logout, however, so it is less accurate in between the 10 minute samples.