Great question!
The main issue is that the HTTP protocol is stateless. In other words, when a visitor makes a request, you handle it, and then forget they exist, until the next time they visit your site again. This could be 20 minutes or 20 seconds, right.
But, you do have some options.
Each time visitor views a page, you could update your record to indicate the last time they visited the page. The when you need to know who is online, adjust your query to list users who are logged in and who have last visited a page in the last 5 - 10 minutes. You can adjust this.
Of course, if they log out of your system this is not an issue.
Depending on your site traffic, you may want to record user activity in memory or as an async process.
As far as which event you can use, I would think the Application_BeginRequest or Application_EndRequest would work fine for recording activity.
Here is a list of Global.asax events: http://www.codetoad.com/asp.net_globalasax.asp