parameter 4020 will enable you to create log review workflows for blank ff sessions. in these sessions, ff would only have logged in, but not executed any t-code. this is supported by the fact that GRACACTUSAGE table is blank.
you can also try GRAC_EAM_LOG_SYNC_TIMEBASED, for regenerating missing wokflows