After installing sysklogd-1.3.31-0.5 on RedHat 5.2 we began
receiving -- MARK -- messages in /var/adm/messages.  Our
syslog.conf contains:

	*.info		/var/adm/messages

The sysklogd doc isn't explicit on wether '*' includes mark
messages or not, but my previous experience was that it did
not.  The solaris man page on syslog.conf(4) is an example
of an implementation that does not include mark messages in
the definition of '*'.

The line in syslogd.c:

	if (*buf == '*') {
           for (i = 0; i <= LOG_NFACILITIES; i++) {

Can be changed to '< LOG_NFACILITIES' to stop including
mark messages by default (since mark is the last facility
added after all the real facilities)

I suspect the correct behavior is not to include -- MARK --
messages.  In any case I would suggest clarifying doc on
a few points:

* Inclusion or non-inclusion of mark in '*' be explicitly
  stated.

* Mentioning that mark messages are generated at the 'info'
  priority level.

* Mentioning that mark messages only appear when there has
  not been other recent output to a target.