As far as I know, it was originally ONLY a book. Then something appeared on MS Web, and now many of its utilities are freely downloadable. KIXTART itself was always included with it. It's also included in the MS Technet subscription.

Returning to the question, do not forget the BACKUPEVENTLOG() function of Kixtart (since the 3.61 version). The file obtained could be easily scanned with readline to look for specific data. But, from my point of view :
1. it's easier (and quicker) to place some code in the login script of the users.
2. do not rely too much on logout events on the Event Viewer. Users like a lot to switch off the power instead then logging out ...