Thanks a lot for your great tip!
There are lots of details in the event log of parental control.
I found events of the following types:
1 SettingChange (by admin)
6 Media Playback
18 WebOverride (by admin)
2 through 10 are listed only for my son's account.
1 and 18 for the admins account.
You can filter the eventlog by user, event-ID and by date.
Actually the events date back to 2007-10-06 (that was when I set up the computer). Hence the logfile seems to be
However in parental control there are no events about user login/logout.
So I looked for other categories:
does not contain any events (although it is enabled).
UAC contains only 2 errors.
Seems as if parental control gets login/logout dates from anywhere else.