I recently had an issue with Moodle which turned out to be due to the counter-intuitive value of the "Last Login" user search filter. I had thought that the term "Last Login" meant the user's last login, i.e. their most recent login time. But it actually searches their second-most recent login time. This is because there are two database columns in the mdl_user table tracking a user's recent logins, "currentlogin" and "lastlogin". "currentlogin" records their most recent login, and "lastlogin" records the login before that. The search filter "Last Login" searches against the lastlogin field.
I've noticed that I'm not the only user to have this confusion. There's a bug tracker issue and a forum post both pertaining to it:
This confusion causes seemingly paradoxical results for the user. For instance, I was trying to search for Moodle user accounts that had never logged in. So, I did a search filter of "Last Login is before Friday, 17 May 1991 (Never Included)". This pulled up a big list of users, however I found that some of them had values other than "Never" in the "Last access" column, so they seemed to be users who had paradoxically never logged in, but somehow had a non-zero "Last access" value. Of course once I understood that the "Last Login" field is actually their second-to-last-login, I figured out these were users who had logged in exactly once.
Here's how to replicate this:
1. Load up a moodle instance that has some users who have never logged in, some users who have logged in exactly once, and some users who have logged in multiple times.
2. Go to Users->Accounts->Browse list of users
3. Click "Show Advanced"
4. Under "Last Login" check "is before", and select "1991" for the year, and check the "Never included" checkbox.
5. Click "Add filter"
6. Click the "Last access" column header to sort by last access.
7. Note that you now have an active filter of "Last login is before 1991 (Never included)", but also some user accounts with a "Last access" other than "Never".
So, I'm proposing this patch. It replaces the "Last Login" search filter with a filter labelled "Most recent login" which searches against the "currentlogin" field instead of the "lastlogin" field.