I'm working on a large PHP (Yii framework) web application where users have accounts and can log in and out. Lets assume for the sake of simplicity that I have two functions login(...) and logout(...) in the system.

I need to record the log-in and log-out time for each user. The problem is, users might not actually click the 'Log In' and 'Log Out' buttons at all. For example, they might simply close the browser and open it to resume work the next day. In this case neither a log-out nor log-in event would be recorded.

How do I get around these difficulties, so as I find out how much time each user actually spent working in the system each day?

Whether or not the browser window is open is probably not the best way to determine if the user is working in the system or not. I would rather store a 'last action' timestamp, either through javascript sending updates or actual page requests from urls to determine when the user 'starts working', and 'logs out' in terms of leaving the page (even if that means simply leaving an open tab in his browser). If actions are sufficiently close to each other in time, treat it as one session, and if there's no action for say 3 hours, treat the session as abandoned.