The PeopleSync Frontend IIS logs can be analyzes with “log parser”, a Microsoft tool. It can be downloaded here.
The following queries can be used to answer specific questions regarding CardDAV operations.
Are Clients using the Address List Service account?
Clients should not use the address list’s service account, as they would have write access to the address list.
In the following query, replace ‘peoplesync@example.com’ with the your address list service account.
SELECT c-ip, cs-method, [cs(User-Agent)], extract_prefix(extract_suffix(cs-uri-stem,2,'/'), 0, '/'), count(*) FROM '[LOGFILEPATH]' where (cs-method = 'REPORT' or cs-method = 'PUT' or cs-method = 'DELETE') and extract_prefix(extract_suffix(cs-uri-stem,2,'/'), 0, '/') = 'peoplesync@example.com' and [cs(User-Agent)] <> 'CardDav+.NET/0.1' group by c-ip, cs-method, [cs(User-Agent)], extract_prefix(extract_suffix(cs-uri-stem,2,'/'), 0, '/') order by c-ip, cs-method, [cs(User-Agent)], extract_prefix(extract_suffix(cs-uri-stem,2,'/'), 0, '/')