you should be able to rely on the glassfish audit system to track user logins, logouts are not typically managed by the container, so they may be harder to auidt. I am not sure is session timeouts are audited, but you likely audit such events from a session listerner.
please take a look at the audit facilities provided by glassfish, as imo, it would be better to use a, perhaps custom, audit module than to write audit data to server.log
[Message sent by forum member 'monzillo' (monzillo)]
http://forums.java.net/jive/thread.jspa?messageID=277542