What do you mean by filter? It seems odd to try to use a Moodle filter for this.
The natural way to do it is to analyse the data Moodle already collects in the logs. Logins are easy. The bit that is hard is that mostly people do not log off. They just close their browser tab, and that is not logged. So you need to measure time from when they log on, to when they stop doing stuff.
The natural way to do it is to analyse the data Moodle already collects in the logs. Logins are easy. The bit that is hard is that mostly people do not log off. They just close their browser tab, and that is not logged. So you need to measure time from when they log on, to when they stop doing stuff.