The problem is that logs does not contain what you see in Audit viewer
It looks like that
March 23rd 2017, 14:55:14.248 <143>2017-03-23 14:55:14,245 x.x.x.x audit 1 1 0 Timestamp=Mar 23 2017 14:54:14.227 EDT,EntityName=m@m.com,Category=Guest User,Action=ADD,User=mabc