Apache + ISPconfig = ?

[SamTzu]

Has anyone figured out a way to get the syslog more intuitive?
Now all we can see from the log is that something happened with Apache. This will not tell us who did it. And yet almost all our sites all ready use ISPConfig3's suPHP and suExec. Any way to replace the www-data with webNR?

Jan 28 05:00:02 www1 postfix/pickup[23426]: C9E25B0E477: uid=33 from=<www-data>
Jan 28 05:00:02 www1 postfix/cleanup[25029]: C9E25B0E477: message-id=<20120128030002.C9E25B0E477@www1.internet-content.net>
Jan 28 05:00:02 www1 postfix/qmgr[596]: C9E25B0E477: from=<www-data@www1.internet-content.net>, size=899, nrcpt=1 (queue active)
Jan 28 05:00:02 www1 postfix/local[25031]: C9E25B0E477: to=<www-data@www1.internet-content.net>, orig_to=<www-data>, relay=local, delay=0.04, delays=0.03/0/0/0.01, dsn=2.0.0, status=sent (delivered to mailbox)