I have not found any documentation on the format of the log entries. I'm trying to understand entries in the audit log that look like the ones below.
2007-10-19 11:03:45,837 INFO [http-443-Processor94] [email@example.com;mid=30;ip=126.96.36.199; ua=ZimbraWebClient - IE7 (Win)/4.5.6_GA_1023.UBUNTU6;] security - cmd=Auth; firstname.lastname@example.org; protocol=zsync;
2007-10-19 11:04:13,543 INFO [http-443-Processor95] [name=linda;mid=69;DeviceId=0077BOGUSB676A263D777E0 0C9D7D777;DeviceType=PocketPC;SyncCmd=Ping;] security - cmd=Auth; email@example.com; protocol=zsync;
For the most part the "name" part of the log entries match the "account" part but a few like those above do not. I sure would appreciate some help interpretting audit log entries.