Hi,
CUCM 5.x onwards, MLA is enabled by default and you cannot disable it.
For logs, you need to look for the a combination of traces to find out the which user logged in and what webpages were visited.
You want to look at security logs to find the date, time and userid that accessed the system. You need to look at the Cisco CCMAdmin Web Service to look at what pages were accessed in the CCMAdmin area, Cisco CCMService Web server to look at what pages were accessed in the Serviceablity are.