as tmp.log
( SORTED_DATA=`cat tmp.log | sort -k4 -k3 -k1 -k2`; KEY=`echo "$SORTED_DATA" | awk '{print $NF}' | uniq`; echo "$KEY" | ( while read k; do ENTRYS=`echo "$SORTED_DATA" | grep $k`; RESULT_IN=`echo "$ENTRYS" | grep IN: | tail -n1`; RESULT_OUT=`echo "$ENTRYS" | grep OUT_ADM: | head -n1`; RESULT=`echo "${RESULT_OUT}\n${RESULT_IN}"`; [ -n "$RESULT_IN" ] && IN_TIME=`date -d "$(echo "$RESULT_IN" | awk '{print $1" "$2}')" +"%s"`; [ -n "$RESULT_OUT" ] && OUT_TIME=`date -d "$(echo "$RESULT_OUT" | awk '{print $1" "$2}')" +"%s"`; [ -n "IN_TIME" ] && [ -n "$OUT_TIME" ] && TIMEDIFF=$(( $IN_TIME - $OUT_TIME )) || TIMEDIFF="n/a"; echo "User: $k's logs: $TIMEDIFF seconds\n$RESULT"; done ) )
results:
User: PI2's logs: n/a seconds
2019/05/02 03:07:55 IN: PI2
User: QRA's logs: 3836 seconds
2019/04/30 17:30:37 OUT_ADM: QRA
2019/04/30 18:34:33 IN: QRA
User: systemdbuser's logs: 14402 seconds
2019/04/30 18:00:00 OUT_ADM: systemdbuser
2019/04/30 22:00:02 IN: systemdbuser