Searching audit.log is probably your best bet, since there's no real notion of "logged in". We know when a user mail client sends a request, but because the protocol is SOAP over HTTP, it's not like the server can ping the client to find out what it's doing. |