I agree.  And none of these are being logged as EMERG.

What *is* being logged as EMERG is anything that causes a fatal error 
screen.  See Horde_ErrorHandler ('EMERG' logging happens after any 
authentication redirection occurs).

(Also, failure to save compiled CSS and JS files in the static 
directory will cause an EMERG log.  But that is also appropriate, 
since Horde web apps will be unusable without that data.)

How can I help to trace it down?

My first assumption is that this happens when one of the users 
accesses horde via webdav.
But everything seems to work fine, synchronization works in both ways.

I am also not sure, if he uses webdav or activesync and if I 
configured them properly.

I strongly disagree. This could happen all the time with perfectly 
correct and common user behavior. Think of people bookmarking IMP 
instead of Horde, or accessing any other Horde resources (tickets, 
repositories, wiki pages) that require authentication. We already 
handle this gracefully by redirecting to the login screen and from 
there back to the originally requested screen. No reason to log at 
EMERG level there.
But then again, I still cannot reproduce this.

You are confusing various logging sub-systems.  In the *Horde* 
environment, these *are* EMERG issues, since they indicate events that 
should never, ever happen and require immediate action by the admin.

For a Horde-specific logging backend (i.e. a horde-specifc log file) 
then EMERG is totally appropriate to describe the issue.

You instead chose a general-purpose system logging backend that treats 
an application EMERG the same as a kernel EMERG.  If that is not what 
you want, you should either configure syslog to log Horde actions at a 
different level or, instead, use a different log backend.

According to my local git repository which i also in use as the 
current webspace, I am on origin/master:

{{{
horde@myhost:~/local/src/horde.git/framework$ git branch -v
* master d143ae4 Use Horde_Date's timezone alias capabilites when 
importing events.

horde@myhost:~/local/src/horde.git/framework$ git log --graph -1 
--decorate d143ae4
* commit d143ae4842c7a24741a8f08bce57ca5e879957b2 (HEAD, 
origin/master, origin/HEAD, master)
| Author: Jan Schneider <jan@horde.org>
| Date:   Thu Apr 10 11:47:33 2014 +0200
|
|     Use Horde_Date's timezone alias capabilites when importing events.


horde@myhost:~/local/src/horde.git/framework$ git status .
# On branch master
# Changes not staged for commit:
#   (use "git add <file>..." to update what will be committed)
#   (use "git checkout -- <file>..." to discard changes in working directory)
#
#       modified:   Log/lib/Horde/Log/Handler/Syslog.php
#
no changes added to commit (use "git add" and/or "git commit -a")
}}}

In irc ynuosh also stated that logging will be done via notice, but I 
still get these messages to the consoles:

{{{
Message from syslogd@myhost at Apr 16 15:09:32 ...
  HORDE: User is not authorized [pid 1477 on line 1502 of 
"/home/horde/local/src/horde.git/framework/Core/lib/Horde/Registry.php"]
}}}


Right now I circumvent these messages via:
{{{
horde@tweddell:~/local/src/horde.git/framework$ git diff 
Log/lib/Horde/Log/Handler/Syslog.php
diff --git a/framework/Log/lib/Horde/Log/Handler/Syslog.php 
b/framework/Log/lib/Horde/Log/Handler/Syslog.php
index 89d7150..2f2ff48 100644
--- a/framework/Log/lib/Horde/Log/Handler/Syslog.php
+++ b/framework/Log/lib/Horde/Log/Handler/Syslog.php
@@ -53,7 +53,7 @@ class Horde_Log_Handler_Syslog extends 
Horde_Log_Handler_Base
       * @var array
       */
      protected $_priorities = array(
-        Horde_Log::EMERG   => LOG_EMERG,
+        Horde_Log::EMERG   => LOG_ALERT,
          Horde_Log::ALERT   => LOG_ALERT,
          Horde_Log::CRIT    => LOG_CRIT,
          Horde_Log::ERR     => LOG_ERR,
}}}



If I am completely wrong by using git branches, commits, checkouts, 
please tell me.

It's using the NOTICE level at least in Git master.

Using commit d143ae4842c7a24741a8f08bce57ca5e879957b2

If configured to use syslog, the Horde framework sends log messages 
with priority EMERG in certain cases.
I am pretty sure you don't want to do this. The priority EMERG intends 
to notify about an instable system on OS or kernel level, afaik. Given 
this, the default rsyslog configuration (from debian stable) sends 
EMERG message to all available consoles. That is very anoying to see 
messages like

{{{
HORDE: User is not authorized [pid 25210 on line 1502 of 
"/home/horde/local/src/horde.git/framework/Core/lib/Horde/Registry.php"]
}}}

popping up and destroying your console work.