Many years ago, I first tried to build a "logon trigger", but was sorely disappointed to receive the error that you cannot build a trigger against a table owned by SYS; and I cannot think of a non-SYS-owned table against which you would find success for logon information. If anyone has a successful login trigger, I too, would be eager to learn more.
As far as finding the last logon time for a user, you should be able to find it without triggers and without turning on auditing by looking in your listener.log file, which has all connections that occurred via the listener. To confirm the current location/file name for the listener.log, do a "lsnrctl", "status", which shows the path and file name for listener.log.