also i have this in IIS logs:
2013-06-08 12:31:52 192.168.1.251 POST /owa/auth.owa - 443 - 192.168.1.251 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) https://mail.e-legion.com/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fmail.e-legion.com%2fecp 401
2 64 0
2013-06-08 12:31:52 192.168.1.251 POST /owa/auth.owa - 443 - 192.168.1.251 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) https://mail.e-legion.com/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fmail.e-legion.com%2fecp 401
2 5 0
2013-06-08 12:31:52 192.168.1.251 POST /owa/auth.owa - 443 - 192.168.1.251 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) https://mail.e-legion.com/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fmail.e-legion.com%2fecp 401
1 2148074254 0
2013-06-08 12:31:52 192.168.1.251 POST /owa/auth.owa - 443 elegion\administrator 192.168.1.251 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) https://mail.e-legion.com/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fmail.e-legion.com%2fecp
400 0 0 15
2013-06-08 12:31:52 ::1 GET /ecp/ - 443 - ::1 AMProbe/Local/ClientAccess - 302 0 0 0
2013-06-08 12:31:59 ::1 POST /OWA/auth.owa - 443 ELEGION\SM_790ad54513e14317b ::1 AMProbe/Local/ClientAccess - 400 0 0 15
2013-06-08 12:32:09 127.0.0.1 GET /AutoDiscover/ - 443 ELEGION\SM_790ad54513e14317b 127.0.0.1 AMProbe/Local/ClientAccess - 200 0 0 0
2013-06-08 12:32:14 ::1 GET /ecp/ReportingWebService/ - 443 - ::1 AMProbe/Local/ClientAccess - 302 0 0 0