In the man page, it says that ipmon logs to the facility "security", but in the Handbook it says that ipmon logs to the facility local0.
Testing shows that the Handbook is correct.
Fix: Here is a patch for the man page.
An alternative fix would be to change the facility in the ipmon code, and change the Handbook. I chose the path of least resistance.
Patch attached with submission follows:
For bugs matching the following criteria:
Status: In Progress Changed: (is less than) 2014-06-01
Reset to default assignee and clear in-progress tags.
Mail being skipped