Both the browser and the Outlook clients make a large number of web service calls to Crm, and each of those will show in the IIS logs as a separate request, so you do see a lot of activity in the IIS logs. A peak in the morning is most likely due to the
Outlook client starting up.
The Crm audit log, as proposed by Andrii, gives a more manageable view on user logins
Microsoft CRM MVP - http://mscrmuk.blogspot.com/ http://www.excitation.co.uk