cool — let me know if you have additional questions. but if you enable user_events on a test host, and do some logon events, I bet you will see a fair bit of what you are looking for.