Missing user session logoff events

Dear Community,
We would like to ger the exact moment when a domain user logoff from his workstation and we are unable to get it.

We can correctly get the first logon event, then we see a continuos sequence of logon/logoff events (share access, etc).

But it seems to be quite tricky to get the effective user logoff event.

The audit options have already been granted.
Could you please help us?
Thanks!