Scott,
We had the same issue with the IP address not getting logged correctly to our syslog server. We had to get an ENHF to resolve the issue with tmm and tmm1 logging incorrectly. If you open a case and reference my case C1143974 you should be able to get the HotFix applied. Currently the HotFix is cut for 11.2 HF-1 so you would have to upgrade to get this. I was also told that this fix would be included in 11.3 when it is released which is supposed to be end of 2012 beginning of 2013.
Now we can use or SEIM tool or just unix commands on our syslog server to start matching everything up and see what user has what IP address.
Seth