correct parser, add test, conform my style

The parser didn't work with syslog restart (and other?) messages that had '<program> <version>:' - fix that and add a test for it.

I messed up if( stuff in my previous pull - I should probably document that functionality better too :)