IIS log entry for a OWA/ActiveSync/Outlook client successful logon - exchange-server

Question

I am researching on finding the exact entry in the IIS logs when user logs in to on-prem exchange using OWA/Active Sync/Outlook client for monitoring purpose.
Can somebody help OR point me to the right source to get this information?
For example, for OWA, should I be looking for /owa in the URI but what else I should be looking to get the successful login entry?
#Software: Microsoft Internet Information Services 8.5
#Version: 1.0
#Date: 2018-10-24 00:19:19
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken x-forwarded-for
2018-10-26 00:13:46 10.0.0.1 GET /owa/ layout=mouse&CorrelationID=<empty>;&ClientId=YQLYPNOFKSDKWPEHODWG&cafeReqId=d74215fd-b921-4e6b-9826-3af8bf29e4ba; 443 john.doe#example.com 8.8.8.8 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/69.0.3497.100+Safari/537.36 - 200 0 0 62 114.41.44.77
2018-10-26 00:13:47 0.0.0.1 POST /Microsoft-Server-ActiveSync/default.eas User=john.doe#example.com&DeviceId=PATM1AFVF52GBCM8U028IBAGNK&DeviceType=iPhone&Cmd=Sync&CorrelationID=<empty>;&ClientId=0DWZQBEIPKLJLMMGW&cafeReqId=9dcd908d-6404-4bbb-ae07-0ea969dd6fc6; 443 john.doe#example.com 8.8.8.8 Apple-iPhone9C4/1601.404 - 200 0 0 62 114.41.44.77

Answer 1

You don't say if this is O365 or On-Prem or whether you configured EAS endpoints to be located by Autodiscover, or whether you have other EAS controls / attributes in place, like, DeviceID, MDM, etc...
As Lex Li, points out, start with Fiddler. It is like Wireshark for web apps. Even if you do not know the initial item you are after, the results from the fiddler trace are filterable by strings.
Meaning, you can just search for your OWA URL or a username/alias, device identity (if you are using that), EAS session information, etc. From there you take a look at the IIS logs and App logs for correlation data for what Fiddler gives you.
You can turn on EAS mailbox logging as well.
Set-CASMailbox alias -ActiveSyncDebugLogging:$true
Exchange ActiveSync (EAS) mailbox logs are protocol-level logs that
show the traffic between Exchange and the EAS device. This is
assuming of course, that the device actually connects, gets past IIS,
and into Exchange code. When troubleshooting EAS issues, this is
often the most useful piece of information. Gathering these logs can
be quick if you use PowerShell to do so, versus gathering them via
ECP.
See also:
Export-Active​Sync​Log
This cmdlet is available only in on-premises Exchange.
Use the Export-ActiveSyncLog cmdlet to parse the Internet Information
Services (IIS) logs and return information about Microsoft Exchange
ActiveSync usage, either on the screen or in an output file.
Update per the OP's response
OK, I missed your On-prem statement.
As for the URL, it's whatever, you published. the default is /owa, but of course that can be changed. So, look for the DNS or Exchange entry for your OWA internal/external URL. From your reverse proxy you should be able to get attempts to hit the OWA URL by users.
If you lean toward the logging approach (Exchange version and where these can be set is important), then you can turn on logging for the Directory Service (DS) and Information Store (IS) services, then look for the kinds of events OWA generates. you'll see six or seven events logged each time an OWA user logs on. You'll typically see event IDs 1170, 1136, 1137, 1007, and 1009, and you might see more than one of each. These events will tell you who logged on and when.
You can automate a user simulated user OWA logon, use this script...
PowerShell Script to Simulate Outlook Web Access URL User Logon
… monitoring that execution real time.
Similar approaches exist for EAS as well. Beyond that you need a 3rdP solution and there are several of those out there, for example Exoprise or manageengine..
remember anything that requires a logon, will show up in the Security event logs as success / failure events.