saved search on login audit trail? maybe with a date range? it only gives successful / failed logins so technically, someone could be able to stay logged in for a long period of time and be outside of that range, whatever it is, but i would think that would be pretty accurate.