That still leaves a question of what to do with Debug messages that also
go to syslog - it's easier to identify problems if the error message
appears somewhere close to the log of the original request. So we'd need
a tool to interleave these in order, if we had to pull messages both from
the binary log and from syslog. Or, we could define a new custom packet
type for these Debug/diagnostic messages, and just spit them out into the
PCAP file too. This might require us to write a custom parser plugin for
WireShark or whatever, to render these messages. That's still not a big
deal, compared to inventing our own entire log postprocessing framework.