This may not be the best way but you can look for the event "UserLoginSessionEvent" using powerCLI Get-VIEvent to get event for a time frame and the parse through them.
$events = Get-VIEvent -Start $dateStart -Finish $dateEnd -Types "Info" -MaxSamples 1000000 | Where { $_.CreatedTime -lt $dateEnd}
foreach ($event in $events) {
if ($event.GetType().Name -eq "UserLoginSessionEvent") {
($event.CreatedTime).ToString("MM/dd/yyyy") + "`t" + $event.UserName + "`"`t" + $event.FullFormattedMessage
}
}
You should get something like this:
02/03/2014 DOMAIN\Account User DOMAIN\Account@111.111.111.111 logged out (login time: Monday, February 03, 2014 7:38:12 PM, number of API invocations: 18, user agent: VMware VI Client/4.0.0)
02/03/2014 DOMAIN\Account UserDOMAIN\Account@111.111.111.111 logged in as VMware VI Client/4.0.0
What I have above is not efficient and can take a long while if you do not have a small environment.