We're trying to track down some suspicious activity on one of our web apps involving a large number of downloads in a very short period of time. The user's id appears in the usage logs, but does not appear to be in the IIS logs. This raised the question of what SharePoint activity is actually recorded to the IIS logs. My guess is that any downloads/uploads done through Windows Explorer view would not appear in the IIS logs, as I believe that works through an ActiveX control? I assume the user hitting the library page should appear in the IIS logs, somewhere. A follow up question would be: does logging in through ISA server interfere in anyway with what is recorded in the IIS logs? Thanks in advance for any and all speedy replies!

Explorer view uses WebDAV and most certainly makes requests to IIS and thus there should be HTTP logs. See Deva's blog post Troubleshooting: IIS/Exchange logs and WebDAV functions for information about what you should be looking for. Jason Warren Infrastructure Architect Habanero Consulting Group habaneroconsulting.com/blog