... and some more comment: > However, anyone trying to convey information of > "Myproc[PID,Threadid]:" > may have a problem with something like > > syslog[12345,C:\usr\sbin\cron]:
I would place the burden on the emitor. The colon must be disallowed. The emitor could use something like syslog[12345,C\\usr\sbin\cron]: I think it would take too much to support this. I guess my primary intention in showing this was that the implemntor should be careful. > > Albert suggests just having "syslog" in the cert/sig-block messages > but that seems to be inconsistent with the possible formats of the > normal syslog messages. I think I don't fully understand this here. "syslog" would be fine, wouldn't it? Of course, it must be terminated with either SP or a colon, but other than that, I am currently seeing no issue. Rainer