Based on Rainers text, the issue's/problems of Chris, and the expirence in implementing it. The following text is proposed to be included in syslog-sign.
""" The TAG is a string of visible (printing) characters excluding SP, that MUST NOT exceed 64 characters in length. The first occurrence of a SP (space) will terminate the TAG field, but is not part of it. It is RECOMMENDED to terminate the TAG with a colon (':'), which if used, is part of the TAG. The TAG is used to denote the sender of the message. And is RECOMMENDED to have the following syntax: TAG = full-stat-id full-dyn-id ':' full-stat-id = path path-sep progname full-dyn-id = '[' proc-id thread-part ']' path = VISUAL * path-sep = ( '/' | '\' ) progname = VISUAL * proc-id = ALFANUM * ; recommended: number thread-part = ( EMPTY | thread-sep ALFANUM ) thread-sep = VISUAL ; recommended: ",", or ':', or '.' EMPTY = "" ; nothing! VISUAL = ([a-zA-Z0-9...], excusing '[' (hope I have the this syntax OK --please correct ALbert) The PROGNAME part is special, as it is frequently used by relays to determine the routing of a message. As a note to implementors: it can be found by getting the visual part before the first occurrence of '[', and after the last '\' of '/' part of that segment. An example of a TAG is: (without the quotes) "/path/to/PROGNAME[123,456]:" Systems that use both process-ID's and thead-IDs, SHOULD fill both the proc-id and the thread-part. For other systems it is RECOMMENDED to use the proc-id only. Receivers SHOULD, to be consistent with the format described in RFC3164, accept TAGs that terminate with a single colon, without a space following it. Then the colon is both the last character of that TAG, and the field separator with the next field (MSG). """ -- ALbert Mietus Send prive mail to: [EMAIL PROTECTED] Send business mail to: [EMAIL PROTECTED] Don't send spam mail!