While poking around in the tables on my test 2.3.3 install, I noticed that the timestamps in the mdl_user and mdl_log practically never match (see pic).
I was comparing mdl_user's first and last access for a given user & mdl_log's time stamps for any action logged for that user. Except for admin's firstaccess, all the times in mdl_log trailed by a few seconds to several minutes.
Puzzled, I checked my 2.2.1 Moodle and noticed the same thing.
Why would this be? Is there any user action that would update the "access" fields in mdl_user and mdl_user_lastaccess, but that would not be recorded in mdl_log?
Also, since authentication is always the first action that actually identifies a user to Moodle, wouldn't that timestamp always be identical in mdl_user's "first access" field and the first mdl_log record for that user (the "login" action)?