Not sure what the best date format for logging is, but we aren't particular consistent.

access_log: [08/Oct/2013:14:37:07 -0400]
audit_log: Tue Oct 08 14:21:31 EDT 2013
candlepin/error.log: Oct 08 14:03:25

(clonepin uses "[07/Oct/2013:16:58:44 -0400]", at least for the log entries with timestamps, fwiw)
(and for fun, client logs as "2013-10-08 15:40:59,861", which looks to be ISODATE)

Splunk best practices suggest microsecond resolution, 4 digit years, and tz info. None of the defaults do that though. (%d{ISO8601} doesnt include timezone).