How to audit owa/exchange 2003 logon/logoff events

You could check

https://www.experts-exchange.com/questions/21768855/How-can-i-audit-email-accouts-for-users-500-point.html

If you want JUST OWA, then you could use the logs on the web server. You will need something to parse the logs though, as there will be a lot of fluff you don't need.

Simon.

Yes, that is the other part of a later question. What do you recommend to parse thru. I am looking for something that I can shove a .evt file at and it allows me to specific/pick the user and then shows me the date ranges of events... anything close to that would be good.

What properties would I configure on IIS 6 to log the owa events?

Thanks.
Tony

you can use the msft kit
http://www.microsoft.com/downloads/details.aspx?familyid=56fc92ee-a71a-4c73-b628-ade629c89499&displaylang=en
or you can get like webtrends, surfstat....etc.

Where in IIS/Exchange do I turn on the specific items I need to turn on to capture this detail?

So this is not in Exchange that I need to turn up the logging settings? IIS, and modify the Exchange Web no not the Default web?

you are changing the setting for the default web...OWA is a sub folder in the default web.

sembee: is there any specific log settings I should use in your opinion? What events do I look for in my security log or is it the app log?
thanks.
tony