@RonniTyger
Your questions indicate a real desire for quality instruction, but an unfamiliarity with Canvas (perhaps on the part of the person requesting the data). There have been some lengthy discussions here in the Community about the lack of accurate information for many of the things you're asking about.
You don't log into a course in Canvas, you log into the instance. A login may last an indefinite time depending on authentication settings (how long before you timeout a login?) and whether the teacher is using the app or the browser. There can be a lot of activity that goes on that isn't reflected in the last login date.
What you can measure, is what @jerry_nguyen mentioned: the activity spent in the course. Canvas documents that the user needs to spend more than 2 minutes in the course to pick up changes, but the number that it keeps is highly inaccurate. For example, it says I spent 606 hours in my statistics course last semester. That's almost 38 hours per week. I know I spent a lot of time in the course, but not that much. Even if you count the time that I put in before the semester started, it's still not that much. That means that the total_activity_time is pretty worthless for an individual, but can be used as evidence when other flags are present.
There is also a last_activity_at that shows the last time that an enrollment within a course was active. This sounds the most promising for checking whether someone has been active within the last three days. Except that this datetime is also unreliable. Some of the activity that happens automatically within the app when it is opened triggers an update to that value (at least it used to), so I would have students showing that they had been active, but their total activity time never increases.
What I found to be most reliable is to use a combination of the two. I gather the data nightly for each user and archive it in a database. Then, I look for the last date that the total_activity_time changed as the last activity. You will also need that tracking in place because Canvas Data isn't going to give you that information from a historical perspective. The last activity is worthless if a teacher came in the night before you checked but hadn't been in for 3 months prior to that. The total time in the course is worthless without looking at it historically because they may have spent a lot of time preparing the course to do little after that.
There are other things that can be done.
You can use the Access Report to see when they were doing things. Unfortunately, that's not easily available without being logged in to Canvas. I wrote a script that downloaded it for all students within a course and wrote a demonstration script that would do it for faculty, but it was really inefficient and tended to time out.
Much of the information that shows up in the Access Report (and some that doesn't) is available through Live Events. You can set up Live Events through Canvas Data Services that will send an event message each time a selected task occurs. I use it to see when users look at assets, submit quizzes, etc., but you could look at when grades are changed, conversations happen, discussions are used, submission comments are made, etc. This occurs in near-real time, rather than the delay of Canvas Data.
Live Events can miss stuff (it attempts to send the message exactly once if the servers aren't too busy), but that's typically not an issue, especially with something like what you're wanting to do. It also has stuff in that Canvas Data doesn't, but it provides events that you have to then operate on and accumulate yourself rather than getting summary data (through the API or Canvas Data).
You may also want to consider a pre-existing solution. The one that our college uses is made by AspirEDU ( @Chris_Munzo ). They are one of Canvas' partners and they have a product called Instructor Insight that does much of what you're asking for (they also have software that helps identify struggling students called Dropout Detective).
