watch: parse logon time