most Microsoft Exchange Server components, you can turn on diagnostic logging by using the Diagnostic Logging tab in the component's Properties dialog box. However, because Outlook Web Access (OWA) isn't an Exchange component (strictly speaking), there's no external interface exposed that you can use to log OWA-related events. However, if you know what types of events OWA generates, you can turn on logging for the Directory Service (DS) and Information Store (IS) services, then look for the kinds of events OWA generates. To get an idea of what OWA is doing, first you have to turn on some particular logging categories:
Open Exchange Administrator, and navigate to the OWA server.
Select the server, and use the File, Properties command to open its Properties dialog box.
Switch to the Diagnostics Logging tab, and select MSExchangeDS from the list of components.
Set the logging level for Security, ExDS interface, Messaging API (MAPI), Directory Access, Lightweight Directory Access Protocol (LDAP) interface, and Name Resolution to maximum.
Expand the MSExchangeIS item in the component list.
Select the System item under MSExchangeIS, and set the logging level for Connections and General to maximum.
Select the Private item under MSExchangeIS, then set the logging level for General and Logons to maximum.
Stop and restart the IS.
Once you do this, you'll see six or seven events logged each time an OWA user logs on. You'll typically see event IDs 1170, 1136, 1137, 1007, and 1009, and you might see more than one of each. These events will tell you who logged on and when. (See "XWEB: Diagnostic Logging Levels for OWA Defined in the Exchange Administrator Program," Microsoft article Q246248, for more detail on the pertinent events.)