GDPR for Office Web Apps Server and Office Online Server
Office Online Server and Office Web Apps Server telemetry data is stored in the form of ULS logs. You can use ULS Viewer to view ULS logs from your on-premises tenant.
Every log line contains a CorrelationID. Related log lines share the same CorrelationID. Each CorrelationID is tied to a single SessionID, and one SessionID may be related to many CorrelationIDs. Each SessionID may be related to a single UserID, although some sessions can be anonymous and therefore not have an associated UserID. In order to determine what data is associated with a particular user, it is therefore possible to map from a single UserID to the SessionIDs associated with that user, from those SessionIDs to the associated CorrelationIDs, and from those CorrelationIDs to all the logs in those correlations. See the below diagram for the relationship between the different IDs.
Gathering Logs
In order to gather all logs associated with UserID 1, for example, the first step would be to gather all sessions associated with UserID 1 (that is, SessionID 1 and SessionID2). The next step would be to gather all correlations associated with SessionID 1 (that is, CorrelationIDs 1, 2, and 3) and with SessionID 2 (that is, CorrelationID 4). Finally, gather all logs associated with each of the correlations in the list.
Launch UlsViewer
Open up the uls log corresponding to the intended timeframe; ULS logs are stored in %PROGRAMDATA%\Microsoft\OfficeWebApps\Data\Logs\ULS
Edit | Modify Filter
Apply a filter that is:
EventID equals apr3y
Or
EventID equals bp2d6
Hashed UserIds will be in the Message of either one of these two events
For apr3y, the Message will contain a UserID value and a PUID value
For bp2d6, the Message will contain quite a bit of information. The LoggableUserId Value field is the hashed UserID.
Once the hashed UserId is obtained from either of these two tags, the WacSessionId value of that row in ULSViewer will contain the WacSessionId associated with that user
Collect all of the WacSessionId values associated with the user in question
Filter for all EventId equals "xmnv", Message equals "UserSessionId=<WacSessionId>" for the first WacSessionId in the list (replacing the <WacSessionId> part of the filter with your WacSessionId)
Collect all values of Correlation that match that WacSessionId
Repeat steps 10-11 for all values of WacSessionId in your list for the user in question
Filter for all Correlation equals the first Correlation in your list
Collect all logs matching that Correlation
Repeat steps 13-14 for all values of Correlation in your list for the user in question
Types of Data
Office logs contain various different types of data. The following are examples of the data that ULS logs may contain:
Error codes for issues encountered during use of the product
Button clicks and other pieces of data about app usage
Performance data about the app and/or particular features within the app
General location information about where the user's computer is (for example, country/region, state, and city, derived from the IP address), but not precise geo location.
Basic metadata about the browser, for example, browser name and version, and the computer, for example, OS type and version
Error messages from the document host (for example, OneDrive, SharePoint, Exchange)
Information about processes internal to the app, unrelated to any action the user has taken