Fortigate 60C - traffic log?

I have a client with a 60C running 4.0MR3 and they say their data cap is getting hit early in the month with their ISP. I have logging enabled, I think, but I can never see any reports. Can someone help me assure that I configured logging properly to find the offending device(s)?

Thank you!

- Bill