rsyslogd: [origin software="rsyslogd" swVersion="[0-9.]*" x-pid="[0-9]*" x-info="http://www.rsyslog.com"] restart$
rsyslogd: -- MARK --$