Zimbra is logging a lot of crap between useful information pieces.
This was my way go get them away from our centralized syslog server:
if $programname == 'zimbramon' and $syslogseverity >= '6' then ~ :msg, contains, "SSL_accept error from monitoring" ~ :msg, contains, "connect from monitoring" ~ :msg, contains, "lost connection after CONNECT from monitoring" ~ *.* @syslog.mydomain.local:2514
service rsyslog restart