ProtonVPN

ProtonVPN is a VPN application made by the people who make ProtonMail.

Logs are stored at the above location and, while they don't provide much information that can be parsed, you will be able to see when the user was connected to ProtonVPN.

Logs appear to follow the following convention: app.YYYY.MM.DD.0.txt, although the 0 could increment if the log gets too large, presumably. One log per day.

When I tested connecting to VPN and then disconnecting shortly thereafter, I found the following entries in the app.txt file:

2020-09-04 06:48:29.1233 INFO Connect requested

2020-09-04 06:48:43.6800 INFO Disconnect requested

Target v1.1, tested from Proton VPN v4.3.11

- Log file names are now in the format client-logs.txt and service-logs.txt respectively, with logs rolling over at ~400KB and renamed e.g. client-logs.1.txt

- client-logs.txt include connection events, connected VPN server external IP and window focus, service-logs.txt include VPN connection RemoteIP and wireguard server IP