the idea is next
in
/ tool netwatch

and add ip of user
on UP
:log error "user x log on"
on Down
:log warning "user x log off"

but on down message on LOG how to see uptime of user
from time when message "user x log on" was display

Set global variable on UP and on DOWN calculate time. Isn't that working?

any example will be good begining
am not scripting guru

is there a option to be seen used traffic up/down also,
as on VPN connections

on UP:
:global myTime [/system clock get time ] ;

on DOWN:
:log info ("Uptime is" . ( [/system clock get time] - $myTime ) );

but users is more then one is this problem ?

or only to repleace "myTime"