Zimbra is logging a lot of crap between useful information pieces.

This was my way go get them away from our centralized syslog server:

 

/etc/rsyslog.d/syslog-server.conf

if $programname == 'zimbramon' and $syslogseverity >= '6' then ~
:msg, contains, "SSL_accept error from monitoring" ~
:msg, contains, "connect from monitoring" ~
:msg, contains, "lost connection after CONNECT from monitoring" ~

*.* @syslog.mydomain.local:2514
service rsyslog restart