This is right the last_visit field get's updated on Login only, thats our problem.
I couldn't start the work on the patch to day, I'll do it tomorrow. I thing doing it with an ns_cache object is an good idea.
How can I find out how many different subsites (the URL's they are running on) are on the System?
Having an ns_cache for each subsite could increas the performance I thing, the subsite check would only needed to be doen once (to find the right ns_cach object), instead of checking the URL for every user(_id) in one single ns_cache object.
We then would have one ns_cache object
online_subsite_users
Wich holds the ns_cache objects (values) for the different subsite Url's (Key's), with user_id (key) and timestamp (value).
I just checked the ns_cache doc again an it locks like the timeout (if secified) is ment for the whole ns_cache object. Meaning the whole ns_cache object will be cleand up after 10 min. not just the enrys older then 10 min.