> hm -- we have no sample log lines for these

right. better than making it up and its derived from source.

> strange: so the line should end with ": " ?

yes I did a double take on that too. http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_authz_core.c?view=markup#872