more work on syslog decoding