The PeopleSync Frontend IIS logs can be analyzed with “log parser”, a Microsoft tool. It can be downloaded here.
The following queries can be used to answer specific questions regarding CardDAV operations.
Are Clients using the Address List Service account?
Clients should not use the address list’s service account, as they would have write access to the address list.
In the following query, replace ‘peoplesync@example.com’ with the your address list service account.
SELECT c-ip, cs-method, [cs(User-Agent)], extract_prefix(extract_suffix(cs-uri-stem,2,'/'), 0, '/'), count(*) FROM '[LOGFILEPATH]' where (cs-method = 'REPORT' or cs-method = 'PUT' or cs-method = 'DELETE') and extract_prefix(extract_suffix(cs-uri-stem,2,'/'), 0, '/') = 'peoplesync@example.com' and [cs(User-Agent)] <> 'CardDav+.NET/0.1' group by c-ip, cs-method, [cs(User-Agent)], extract_prefix(extract_suffix(cs-uri-stem,2,'/'), 0, '/') order by c-ip, cs-method, [cs(User-Agent)], extract_prefix(extract_suffix(cs-uri-stem,2,'/'), 0, '/')
Are contacts deleted by clients and recreated by agent?
Look for rows where cs-method alternates between DELETE and PUT.
SELECT top 1000 date, time, c-ip, cs-method,cs-uri-stem,sc-status, [cs(User-Agent)] FROM '[LOGFILEPATH]' where cs-uri-stem like '%' and ((cs-method = 'PUT' and [cs(User-Agent)]='CardDav+.NET/0.1') or (cs-method = 'DELETE' and sc-status=204)) order by date, cs-uri-stem, time