By default, the IP in [] is the source IP of the client that the appliance sees. This may be unique for all users or it could be the same (depending on the NAT & FW rules) ... View more