SELECT Session_ID, TIMESTAMP, datediff(DAY, puzzsessions.TIMESTAMP, sysdatetime()) daysLogged   --logOn time - (current)system time
FROM puzzSessions
--logon
WHERE ActionName='LOGON' AND session_id NOT IN
        -- no LOGOFF
        (SELECT Session_ID
        FROM puzzSessions
        WHERE ActionName='LOGOFF')
ORDER BY TIMESTAMP DESC --login from 15th and 16th dec 2014 :)))
--RESULT: 31 IDs -  3 LOGONs w/o LOGOFF