logon/logoff should be in utmp/wtmp/lastlog usually logged via syslog. The rest depends on MAC support.
Oliver's Law: Experience is something you don't get until just after you need it.
Forum Rules
