Since you're computing time spent in various places by comparing timestamps from one line to another, you could introduce a bug in the indexing of those pre-computed times. For example, comparing everything against the last match of any user, rather than the last match for that user. Or perhaps comparing the timestamp on each line with the first line on which that user's ip address ever appears, for times that continue to increase into infinity.

Perhaps a bug in the regular expression that causes two non-identical IP addresses to match each other when they should not.

I'm shootin' in the dark here. It would be easier if we could see the code. :)