Not sure exactly how Facebook does this but if you serve a page to the user that has javascript in it, which makes asynchronous requests at a specific interval say every minute. Then when you receive a request the user is marked online with a timeout slightly greater then the ajax interval. If the time-out expires without another ajax request the user is marked offline.
You could possibly hook into the page load and page close events to only send requests when a user loads the page or leaves it as well. This would require less requests.
EDIT
I see your using socket io I'm not super familiar with this but I imagine you could use the socket connection / disconnection events provided.