I'm not sure you can do this, at least easily. I suspect there would be security issues involved in providing an API that could access arbitrary sessions.
However, have you taken a look at the Session Lifecycle API (specifically the HttpSessionListener)? You may be able to deal with things yourself through this, and since it's got to be setup via web.xml, security shouldn't be as big of an issue)
Thnak you for the reply.
I was already using the HttpSessionListener to do this.
But I wanted to know is that if Jboss provides any custom APIs for that like weblogic which provides an API getOpenSessions().
Though on the other hand, it might be a better thing to do it using HttpSessionListener as that is part of the standard specification and makes porting to another application server easier.
There are a couple of ways you can do this (at least) --
Install the OpenSymphony webwork and the beta release of the ClickStream [http://www.opensymphony.com/clickstream/]. That's the easy method. The other is make a monitor class and mbean that stores the list of monitor objects. When someone logs in, create a session and a monitor class for that session and add it to the mbean. have a method to lsit the objects ont he mbean as well as remove them when they log out (match the session with the object in the mbean).
..And the monitor class should be implementing the HttpSessionBindingListener class which is what the OpenSymphony object uses as well.