in reply to Analyze Traffic of ssh port using perl script
capturing & parsing output from the w,who,and finger commands may get you some of what you need. I don't know where to retrieve time of disconnect however.