There is some problem with $PID macro. We experienced this problem on boot, sometimes $PID macro contain normal string, that can't be converted to integer, for example : PCI0, LNKA, LNKB, LNKC, LNKD. As I understand this parameter was read from brackets [], but it isn't correct in that case. I read RFC document ( http://tools.ietf.org/html/rfc3164 ) about syslog messages, and I think the problem occur when syslog-ng parse whole message, but it shouldn't do this, at least for PID.
I will use the example from RFC document :

        Example 4

	<0>1990 Oct 22 10:52:01 TZ-6 scapegoat.dmz.example.org 10.1.2.3
	sched[0]: That's All Folks!

So as we can see the Log Message is "That's All Folks!" all other text belong to Log Header. So in that case "sched" is an proccess name and "0" is a PID of that proccess.
This is our log message :

	Feb 25 18:23:34 test-system kernel: ACPI: PCI Root Bridge [PCI0] (0000:00)

So here proccess name is "kernel" without PID identifier . As a result Log Message is "ACPI: PCI Root Bridge [PCI0] (0000:00)". So in that case PCI0 isn't a PID, but some text in Log Message. The problem is that we saw "PCI0" in $PID macro which I think must be zero length string "" or "0".
I use as rule this part of document :

5.3 Originating Process Information

   It has also been considered to be a good practice to include some
   information about the process on the device that generated the
   message - if that concept exists.  This is usually the process name
   and process id (often known as the "pid") for robust operating
   systems.  The process name is commonly displayed in the TAG field.
   Quite often, additional information is included at the beginning of
   the CONTENT field.  The format of "TAG[pid]:" - without the quote
   marks - is common.  The left square bracket is used to terminate the
   TAG field in this case and is then the first character in the CONTENT
   field.  If the process id is immaterial, it may be left off.
   In that case, a colon and a space character usually follow the TAG.
   This would be displayed as "TAG: " without the quotes.  In that case,
   the colon is the first character in the CONTENT field.

--
Kostyantyn Gushtin Software engineer
N-iX LLC

Solutions for Your success http://www.n-ix.com