Your query looks really strange. Here is the cleaned up version:
SELECT u.id AS userid,
u.firstname,
u.lastname,
FROM_UNIXTIME (l.time) AS rvisit,
c.fullname AS rcourse,
agg.days,
agg.numdates,
agg.numcourses,
agg.numlogs,
r.name AS role
FROM mdl_log l
JOIN mdl_user u ON l.userid = u.id AND u.deleted = 0
JOIN mdl_role_assignments ra ON ra.userid = u.id
JOIN mdl_context ct ON ct.id = ra.contextid AND ct.contextlevel = 50
JOIN mdl_course c ON c.id = ct.instanceid AND l.course = c.id AND c.format <> 'site'
JOIN mdl_role r ON r.id = ra.roleid
JOIN (
SELECT
30 AS days,
l1.userid,
MAX(l1.time) AS maxtime,
COUNT(DISTINCT DATE(FROM_UNIXTIME(l1.time))) AS numdates,
COUNT(DISTINCT l1.course) AS numcourses,
COUNT(*) AS numlogs
FROM mdl_log l1
JOIN mdl_course c ON l1.course = c.id
WHERE
l1.time > UNIX_TIMESTAMP(CURRENT_TIMESTAMP - INTERVAL 30 DAY)
AND
c.format <> 'site'
GROUP BY l1.userid
) agg ON l.userid = agg.userid
WHERE l.time = agg.maxtime
GROUP BY userid
ORDER BY l.time DESC