The Log in As feature is great, and the fact that the Moodle logs record this information (who logged in as whom and what they did while logged in) is fantastic. The only bug I see is when that user clicks "Log out" to stop impersonating the other user – the "User logged out" event shows the impersonated user instead of mimicking the previous log entries.

In the logs, I expect to see "TeacherA as StudentB" – User Logged out

Instead, I see "StudentB" - User Logged out

I don't think it should be possible to have "log out" log entries when there are no "log in" log entries, though I don't see any "TeacherA logged in as StudentB" entry either. Otherwise, it makes it appear that the user was "in the system" when in actuality it was someone logged in as them using the "Log in As" feature who then logged out.

Steps to Reproduc in Moodle 4.1:

Part 1:

1. Log in to Moodle as a Moodle Administrator, example: Terri Admin.
2. Immediately log out of Moodle. 
3. Lock back to Moodle as the same Moodle Administrator, example: Terri Admin. 
4. Go to your profile and click Today's Logs
5. Verify there are two log entries: "User has logged in" followed by "User has logged out" (there may be a "Course Viewed" entry in between).
6. Verify both log entries have "Terri Admin" listed in the User full name column. 

Part 2: 

1. While still logged in as a Moodle Administrator, example: Terri Admin; go to any course's "Participants" page
2. Click on the name of a student from the Enrolled Users list, example: Sam Student.
3. Click the "Log in as" link on the student's profile. 
4. Verify the message "You are logged in as 'Sam Student'" appears, and click continue.
5. Immediately log out of Moodle.

Part 3:

1. Log in to Moodle as a Moodle Administrator, example: Terri Admin.
2. Go to the Moodle Front Page
3. Click "Site Administration" - "Reports" - "Logs" (DO NOT DO THIS FROM WITHIN COURSE LOGS as they will filter out site events)
4. Select "Same Student" and "Today" from the dropdown menus and click "Get these logs". 
5. Verify there are two log entries: "User has logged in" followed by "User has logged out" (there may be a "Course Viewed" entry in between).
6. Expectation: both entries would have "Admin User as Same Student" listed in the User full name column, just as it is for the "Course Viewed" entry.
7. Actual: It it logged that "Sam Student" has performed the "Log in" and "Log out" actions (note that the IP address is indeed different).

After thinking about this deeper, it does make sense that I would have to go to the Logs of "Terri Admin" to see "User logged in as another user".... but, what I don't see there is "User logged out as another user" – instead that log out appears on the "Students" profile as if the student did this action (again, it at least does show a different IP address)...

This issue tends to come up when we tell families that their child hasn't been logging into school, so when they look at their child's logs, they can be a little misleading at times when we have a case of someone using the Log in As Feature (we do try to tell the parents about using the IP address column, but some of them aren't as tech savvy, just as we tell them about the Origin column to see if the log entry is 'web' based versus 'cli'). Just wondering if it's possible to somehow indicate the log out was not a direct student action log.