This is something I pondered on for quite a while. The mystery was not solved, but revealed quite clearly at the recent user conference. There was a breakout session with architects of the various pieces (ESM, Logger, SmartConnectors, etc) and they discussed the variations.

To me it simply boiled down to this: If you want high performance above all else, put Logger in front of ESM. If you being able have all your correlated events properly connected with EventIDs, then put Logger behind ESM.

For most companies, having Logger in front of ESM may well be what the doctor ordered. This will make sure you have the highest performance and best assurance of not losing events if the database or ESM can not keep up.

If anyone else has other thoughts or I got this confused, let me know in the comments!