@MontyJ
With both Pagekite and apache login enabled what should have happened is that your users first need to login to Pagekite and second login to apache/COPS.
if the PageKite logincodes were still in the browserchaches or stored as logincredentials in their browsers they (in their experience) gp straight to the apache/login. Enable both, get double safety!
. (And as a bonus your statistics.)
COPS does not have it's own logfiles.
You should search for the apache "access.log" logfile. There the users activity (login, files downloaded) is logged.
What do you want/need to know? Somewhere in this forum (probably many many pages back) this was solved in a number of post between a user from Australia and me (he did the heavy lifting). If you want I can try to adopt what we were doing for your purpose, if possible.
As I do not have a QNAP ......... you are at the mercy of other helpful members of this forum.