I believe the only accurate and reliable way to do this is enable security logging in the application server (WAS, Liberty or Tomcat). But such information can be buried in the logging of other components, and it will be quite difficult to analyze.

Checking the license usage is another way, although not accurately reflecting the user login behavior, it should be enough for your purpose (and your question should probably have been "how long a user does not require an RTC license). You can enable licensing logging, use the built-in license report, and even use the standalone reporting tool.
https://jazz.net/forum/questions/215630/were-hoping-to-get-cal-license-usage-reports-per-user
https://jazz.net/wiki/bin/view/Deployment/RationalLicenseKeyServerAdministrationAndReportingTool#Example_User_Based_report

Note that a user does not necessarily check out a license just by logging in. Only when the intended operation requires a license, for example use SCM or submit a work item, a license will then be checked out. In other words, if a user just logs in and view a work item, a license is not required (and not checked out). Also, if a user already acquires a compatible license, another particular type of license may not be necessary - for example, a user holding an RQM license may submit work items in RTC. You need to take all this into account when analyzing the license logging and determine whether a user has "used" the application in a given period of time.