I always look at:
The start-time of the ppp processes , it gives me the login-time of the ppp-process and an ip-address
root 9977 9976 0 21:13 ? 00:00:00 /usr/sbin/pppd local file /etc/ppp/options.pptpd 460800 10.0.1.150:10.0.1.198
then I check
/var/log/radius/accounting.log
this gives me for that login-time a username
and using
pppstats
I get a live view of the total traffic. To split the trafic for different users, you could use iptraf .