Before all you need to create a table for example called hours_table with number from 00 to 23:
CREATE TABLE `hours_table` (`hour` char(2) DEFAULT NULL);
hour
----
00
01
02
03
04
..
After you execute this query:
SELECT hour, (count(DISTINCT(li.user)) - count(DISTINCT(lo.user))) AS usersloggedin FROM hours_table
LEFT JOIN audit_table AS li ON DATE_FORMAT(li.time, '%Y%m%d%H')<=CONCAT('20130702',hour) AND DATE_FORMAT(li.time, '%Y%m%d')='20130702' AND li.action='login'
LEFT JOIN audit_table AS lo ON DATE_FORMAT(lo.time, '%Y%m%d%H')<CONCAT('20130702',hour) AND DATE_FORMAT(lo.time, '%Y%m%d')='20130702' AND lo.action='logout'
GROUP BY hour
In place of 20130702 you put an other day in format yyyymmdd remove DATE_FORMAT(time, '%Y%m%d')='20130702' if you consider user logged yesterday active today.