Capturing User Events

General
1

I’m looking to capture 2 things, the record of a user logging in/out and all of their activity.

  1. I’m assuming that the log in/out has something to do with the authenticator. Where or how would I attach to the authenticator to capture these events?
  2. I’d like to capture all of the users activity. When they pressed the submit button, what the contents of the call/command was, etc. Would this be captured in the kernel? How would I access this?

Thanks,
Nick