a bit more work on syslog decoding