Application.cfc is executed for every request but only parts of it are run depending on the situation. The pseudo-constructor (where you set this.name type settings) is executed each time and cannot be changed problematically. onApplicationStart() only runs if the application doesn't exist. The application scoped variables are accessible to every session and only exist once per application instance (not session instance). onSessionStart() only runs the first time a new visitor hits the site. There are other event specific functions
Here is another thread that may may help with your question.
ColdFusion Application.cfc - order of execution
As well as adobe docs:
http://help.adobe.com/en_US/ColdFusion/10.0/CFMLRef/WSc3ff6d0ea77859461172e0811cbec22c24-74fa.html
An active user counter is as easy as something like pseudo code:
onApplicationStart {application.activeUsers = 0}
onSessionStart {application.activeUsers++}
onSessionEnd {application.activeUsers--}
Clearing up some confusion
The 'this' scope is used to set application settings such as the name, sessionTimeOut, or customTagPaths. These settings are built into ColdFusion.
<cfscript>
this.customtagpaths = expandPath('./customtags');
this.name = "myCoolWebsite";
this.sessionmanagement = "Yes" ;
this.sessionTimeOut = CreateTimeSpan(0,0,20,0);
</cfscript>
Although the 'this' scope is related to the application, you cannot use it to set persistent application scope variables. Application variables are set by using the 'application.' syntax and is usually initially set in the onApplicationStart() function.
<cfset application.myVariable = "I am the same value for every user">