Scan event log for workstation lock/unlock events