with table1(last_update, event_name, user_login) as
(
select to_date('10.11.2017', 'dd.mm.yyyy'),  'login'  , 'ivanov' from dual union all
select to_date('15.12.2017', 'dd.mm.yyyy'),  'login'  , 'ivanov' from dual union all
select to_date('20.12.2030', 'dd.mm.yyyy'),  'logout' , 'ivanov' from dual union all
select to_date('10.01.2018', 'dd.mm.yyyy'),  'login'  , 'ivanov' from dual union all
select to_date('10.11.2017', 'dd.mm.yyyy'),  'login'  , 'petrov' from dual union all
select to_date('15.12.2017', 'dd.mm.yyyy'),  'login'  , 'petrov' from dual union all
select to_date('20.02.2040', 'dd.mm.yyyy'),  'logout' , 'petrov' from dual union all
select to_date('30.01.2018', 'dd.mm.yyyy'),  'login'  , 'petrov' from dual
)
select 
  t.*,
  last_value(last_update) over (partition by user_login order by decode(event_name, 'login', 1, 0), last_update rows between unbounded preceding and unbounded following) last_user_login_dt
from table1 t
order by user_login, last_update;