What does 'last login time' actually track on the user record?

[Ambrosia1]

We are trying to track when a user has logged into the system. I added the field 'last login' time to the user record, and looked at the audit history for that field.

In that list, it is showing the user as logging in every few minutes or so, including a week when this user was out of the country, so it seems to be a little inaccurate. . I am curious what the system is actually counting as a 'login' in this case? 

I've included a screenshot of the audit history of this use for just today as an example of why I think the data may be inaccurate. This user according to this logged in every ten minutes or so, and then two minutes after at one point. These listed "login" times also do not match with the system events login event. 

I know you can track login events in the System logs > events list (which also doesn't seem to be reflecting correctly) but my question is what is this particular field I mentioned above tracking?

Thanks ahead of time!

[ARG645]

last Login Time gets updated via a Script Action named SNC User Clear. This script action gets executed when the event named login gets fired. 

So a possible reason for the behavior you are describing may be there is somewhere something in the code that is triggering the login event. Or somewhere something in the code that is trying to update this field. If you have any Code Search tool, try to search for the column name last_login, this will give you all the scripts that are using this column name. 

Thank you,

Aman Gurram

If my answer helped you somehow, then please mark it helpful.

[Ambrosia1]

Well it looks like 'SNC User clear' clears failed login attempts once a successful login is made, it only uses the 'last_login' field to update the password attempt date/time.

However, searching for 'last_login' did yield the script action 'Last login time' which is the script that updates the time/date for the users's last login. This still unfortunately doesn't explain the random last login times being added. 

Even looking at my own user record, it has shown that I've logged in several times today and I haven't actually 'logged in' in several weeks. I've just been logged in this whole time. 

[ARG645]

Oh yes, my bad, the script action name is Last login time , not SNC User Clear. I got them swithced.

- So, I would suggest you to Contact HI Support. This is really a strange behavior and it might impact the performance if this is happening for every user in the sys_user table.

[Tony Chatfield1]

The user could also have some sort of browser refresh\plugin installed
Is the last_login_device always the same value
Does the users login create matched home page type transactions records