The additional "logout" event is introduced in SGOS 6.5.1.1. The reason why is because every closed TCP connection to the management console is logged.

This has no record in the recent release note. 

When a session successful login, download some objects during console login, then tcp connection is closed and "logout" event will be generated.   

An example events:

"Administrator login, user 'xxxxx', realm 'Radius', from fd00:0:18:1004::161, read-write access, request='/Secure/Local/console'"  0 250046:96   authconsole.cpp:474

"Administrator logout, user 'xxxxx', realm 'Radius', from fd00:0:18:1004::161"  0 250042:96   authconsole.cpp:335

or

"Administrator action, user 'admin', from 10.1.1.1', Viewed event log tail"  0 60003:7D   cag_agent.cpp:1382

"Administrator logout, user 'admin', from 10.1.1.1"  0 250042:96   authconsole.cpp:335