When a user start a RES Workspace Manager session. Every action is logged into the Event Log. Administrators can use this log for fine tuning the environment. What I always do is filtering out which steps take a lot of time, and dig into that step to make the login procedure faster and faster. The only thing I always ran into is the Date/Time stamp before an event. Is it the beginning of the ending of the event?
First start the event viewer. This can be done (there are more ways) by clicking on: Diagnostics –> User Sessions –> Double click on the users you want to view.