Question about User Login (WebGUI) at Syslog or log User Login with other commands

Hello,

had a question about logging user logins at syslog.

If there is a login from webgui then there is the following message:

Nov 11 17:34:05 Server webGUI: Successful login user root from IP

This message is not the problem, it's clear that a Login come from webGUI from a specific IP.

My question is about the user logout from webGUI.

The message are:

Nov 11 17:38:39 Server ool www[20674]: Successful logout user root from IP

1. What "ool" stands for?
2. "www" stands for logout from webGUI?
3. "[20674]" whats this number? It's not the same number always.

My goal is to log user login from webgui into my own python script.

I tried to use the following command for this:

ps -o command,tty

This gives me the following output:

COMMAND                     TT
Xvnc -nolisten tcp -noliste pts/0
bash --login                pts/0
ps -o command,tty           pts/0

The "bash --login" signals that there is a login from webgui.

The problem is if I use this command into my python script, with subprocess or psutil this only works if I start the script in the terminal and don't logout.

After I logout and login again, the command output don't work after all.

Output is complete different, I think if the script runs in background that don't work.

At this point I am thinking about, watching at syslog and get info about  login/logout from webgui from there.

Maybe there is another method to get user login/logout from webgui safe?

Best regards