I'm picking on CIFS because each user has an individual session, with an identifiable beginning and end.
Note that a "session", from the standpoint of the CIFS client and server, can be spontaneously terminated by server or client, if no files are open on the connection, and spontaneously re-opened when a reference to a file on the file system in question is made.
In fact, they *are* spontaneously terminated by Microsoft's clients and servers, as well as by our server and probably other servers, after idle timeouts.
From the NFS point of view, it's similar to automounted file systems.
The creation and destruction of sessions could be logged, but note that not all session creations and destructions are the result of somebody "logging in" or "logging out" from their desktop machine. That may be acceptable.