You have to enable the auditing engine of Alfresco to trace the login event:
I think that you can follow these steps:
1. Enabled auditing by adding the following in alfresco-global.properties
audit.enabled=true
audit.alfresco-access.enabled=true
2. Start the server
3. Verify auditing is enabled with
curl -u admin:admin http://localhost:9080/alfresco/service/api/audit/contol
Below output is shown, as expected
{
"enabled" : true,
"applications":
[{ "name": "Alfresco Tagging Service", "path" : "/tagging", "enabled" : true }
,
{ "name": "alfresco-access", "path" : "/alfresco-access", "enabled" : true }
]
}
4. List the audit entries using the following command
curl -u admin:admin http://localhost:8080/alfresco/service/api/audit/query/alfresco-access?verbose=true
Hope this helps 
hi
thanks for your reply.
after enable audit as you said, i could get result as follow. problem is when i refresh alfresco page, that entries are filled manytimes. this does not return correct last logged date of user.
{
"count":21,
"entries":
[
{
"id":5,
"application":"alfresco-access",
"user":"admin",
"time":"2016-10-21T13:39:25.573+05:30",
"values":
{
"\/alfresco-access\/login\/user":"admin"
}
},
{
"id":6,
"application":"alfresco-access",
"user":"admin",
"time":"2016-10-21T13:39:26.684+05:30",
"values":
{
"\/alfresco-access\/transaction\/sub-actions":"readContent"
,"\/alfresco-access\/transaction\/action":"READ"
,"\/alfresco-access\/transaction\/type":"cm
erson"
,"\/alfresco-access\/transaction\/path":"\/sys:system\/syseople\/cm:admin"
,"\/alfresco-access\/transaction\/user":"admin"
}
},
