In Sec 2.2 says - "a colon terminates the TAG" Does this imply the TAG __needs__ to end with a colon? Or does any other 'not valid' char also terminates the TAG?
-"a space MUST follow a colon, for Signatures/Payload messages. Does this mean, the TAG end in ": " (which means the TAG is not terminated by the first colon)? Or, does it mean the MSG part will start with a " ". In the later case, sections 3.1 and 4.2 should be updated. They say "syslog " should be used as TAG (terminating with a space), and do no mention de colon (or ": ") insite the MSG part. Better, remove this remark on 2.2. Let the TAG be "syslog" (no space, as ``all fields are separated by a space'' in already defined.). And keep the MSG part as is. Then, the 2 lines below (only the start) are correct. <175>2003-08-27T16:07:44+02:00 labtop.ons-huis.net syslog @#sigSIG[...] <175>2003-08-27T16:07:45+02:00 labtop.ons-huis.net syslog @#sigCER[...] #PRI #---TIMESTAMP------------ #----HOSTNAME----- #-TAG- #-MSG:COOKIE,etc-- Hope it helps. Implementing, seams a to help reviewing:-) --ALbert Mietus Send prive mail to: [EMAIL PROTECTED] Send business mail to: [EMAIL PROTECTED] Don't send spam mail!