If your Palo is scanning the syslog entries as noted above... you can write a log line entry in the ACCESS_POLICY_COMPLETED event. This will catch the logouts, timeouts, and disconnects (disconnects will hit this event via idle timeout).
Advantage to using this event is that the APM session variables are still avalible.
If you are using a sideband to call the Palo's API, you will need to be creative; perhaps write the info to a table and make the API call in a different event.
Note: "This event is triggered outside of flow context (similar to RULE_INIT) when a session goes away. The iRule commands which require a flow context (for e.g. TCP, HTTP and SSL commands) can not be used in this event."