Ah, usually with switches we just see infrequent error messages and config changes, not a ton of exciting stuff.
For Windows servers, the Windows Filtering Platform data (from the windows firewall) might include that, but it also includes a ton of noise about regular activity so it might be tough to suss out (or might be off/not logging).
With IIS, you will be able to see all the pages being accessed, and if users are logged in when accessing the site, it will include their username. Otherwise the IP addreses, which page, error codes, that sort of thing. They will come through as WebTrafficAudit events.
