Here is a login table I use for one of my sites. The datetime can either be logged as a datetime or as a timestamp. If you use datetime make sure to consider the timezone of your mysql server.
There is plenty of stuff to track. Then you can just query it later. Each of these column names should be self explanatory with a google search.
CREATE TABLE `t_login` (
`id_login` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
`id_user` INT(10) UNSIGNED NOT NULL DEFAULT '0',
`id_visit` INT(10) UNSIGNED NOT NULL DEFAULT '0' COMMENT 'fk to t_visit',
`id_org` INT(10) UNSIGNED NOT NULL DEFAULT '0',
`when_attempt` TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
`uname_attempt` VARCHAR(100) NOT NULL DEFAULT '' COMMENT 'attempted username' COLLATE 'latin1_swedish_ci',
`valid_uname` TINYINT(1) UNSIGNED NOT NULL DEFAULT '0' COMMENT 'valid username',
`valid_uname_pword` TINYINT(1) UNSIGNED NOT NULL DEFAULT '0' COMMENT 'valid username and valid password together',
`pw_hash_attempt` BINARY(32) NOT NULL DEFAULT '\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0',
`remote_ip` CHAR(20) NOT NULL DEFAULT '' COLLATE 'latin1_swedish_ci',
`user_agent` VARCHAR(2000) NOT NULL DEFAULT '' COLLATE 'latin1_swedish_ci',
PRIMARY KEY (`id_login`),
INDEX `when_attempt` (`when_attempt`),
INDEX `rempte_ip` (`remote_ip`),
INDEX `valid_user` (`valid_uname`),
INDEX `valid_password` (`valid_uname_pword`),
INDEX `username` (`uname_attempt`),
INDEX `id_ten` (`id_org`),
INDEX `id_user` (`id_user`),
INDEX `id_visit` (`id_visit`)
)
COLLATE='utf8_general_ci'
ENGINE=InnoDB
AUTO_INCREMENT=429;