How to recognise if actual login event took place

I think you are looking for Log Streams.