Login and logout of remote access VPN creates a syslog event. The event id varies according to what type of VPN it is. The easiest way to confirm them is to make sure you have informational logging level set and watch your syslog viewer while logging in and out on a test basis.
You can then add those ids to an event list and set it up to be sent to a syslog server or emailed to you.
