STAS logon type is 3 ??

The types are described here: https://support.sophos.com/support/s/article/KB-000038378?language=en_US

The times seems odd to me, those are old entries. The database seems to have old entries. 

I already give descritpion in my post

There are also old entries,i know. But there are new entries with logon type 3

The questions are :

1-WHY is 3 not 2 ?????

2- What to do with old entries ?

I already give descritpion in my post

There are also old entries,i know. But there are new entries with logon type 3

The questions are :

1-WHY is 3 not 2 ?????

2- What to do with old entries ?

You can enable logoff detection in STAS to flush them. 

And you should check the logs for the reason of the type 3. STAS offers an own log, which can be a good start to see the reason for those logs.