Register the actual log-out time of a user

I'm working on a large PHP (Yii framework) web application where users have accounts and can log in and开发者_开发技巧 out. Lets assume for the sake of simplicity that I have two functions login(...) and logout(...) in the system.

I need to record the log-in and log-out time for each user. The problem is, users might not actually click the 'Log In' and 'Log Out' buttons at all. For example, they might simply close the browser and open it to resume work the next day. In this case neither a log-out nor log-in event would be recorded.

How do I get around these difficulties, so as I find out how much time each user actually spent working in the system each day?

Whether or not the browser window is open is probably not the best way to determine if the user is working in the system or not. I would rather store a 'last action' timestamp, either through javascript sending updates or actual page requests from urls to determine when the user 'starts working', and 'logs out' in terms of leaving the page (even if that means simply leaving an open tab in his browser). If actions are sufficiently close to each other in time, treat it as one session, and if there's no action for say 3 hours, treat the session as abandoned.

One way would be to write yourself a simple session handler: http://ar.php.net/manual/en/function.session-set-save-handler.php This way you can handle the appropriate functions which will get called when the session is being closed, destroyed, garbage collected, etc...

Sessions will be automatically garbage collected and destroyed after timeout. However, you could do some tricks to detect that the user is not there anymore, and force the closing.

This is a tough question. For example, what constitutes working?

• Simply having the browser window open?
• Moving around between pages?
• etc.

You could have a ajax widget that would periodically update the database with "heartbeats". But this would only serve to tell you that the browser window was open. Once you stopped getting hearbeats they "logged out" and once they resumed, provided the session was still available, you could call it "logging in".

But again, I'm not sure this is the best way to track "working".