Thanks for the reply, but I do already forward my logs to the SIEM tool. The problem I have is that the only Zimbra logs that get forwarded is the /var/log/zimbra.log and the normal messsages log.
I need the audit and mailboxd log to be forwarded to syslog, but it does not seem to want to work. I am using SLES 10.2.
Thanks for the help.