We also need to capture all log-in activity like Chris do, but capturing by using event logs is not 100 percent correct. I try to test with many user in remote area, we found that after they log-in to PLM. Event logs didn't record anything, but when i ask some colleague whom sit close to me, for login. I found that it's record correctly. I don't know why?
I'm not sure that I understand your scenario, or what you are saying isn't working. Can you explain?
Every time a user is logged in, a message gets added to the event log, like so:
User: <username> has logged in at <datetime>...
Are you not seeing that in the logs?
Otherwise, you could log an enhancement request, or perhaps even write a customization to the authentication strategy that does some custom logging of user logins.