Well, you could keep track of which users are open from the previous log and put a Start statement for each of those at the beginning of the new log. Then all you have to do is look in the new log for a Start with no Stop between it and the first log message with a timestamp after the time you're looking for.

You have to assume that some users might be logged in for more than one log file period, or that the log file might not yet contain a Stop (if they're still logged in).