Question

Reading syslog rfc

6.3.3. SD-PARAM

   Each SD-PARAM consists of a name, referred to as PARAM-NAME, and a
   value, referred to as PARAM-VALUE.

Can param-value contain spaces? or it has to be a one-word name?

Answer 1

Reading the rest of that section:

To support international characters, the PARAM-VALUE field MUST be
encoded using UTF-8. A syslog application MAY issue any valid UTF-8
sequence. A syslog application MUST accept any valid UTF-8 sequence
in the “shortest form”. It MUST NOT fail if control characters are
present in PARAM-VALUE. The syslog application MAY modify messages
containing control characters (e.g., by changing an octet with value 0
(USASCII NUL) to the four characters “#000”). For the reasons
outlined in UNICODE TR36 [UNICODE-TR36], section 3.1, an originator
MUST encode messages in the “shortest form” and a collector or relay
MUST NOT interpret messages in the “non-shortest form”.

Inside PARAM-VALUE, the characters ‘”‘ (ABNF %d34), ‘\’ (ABNF %d92),
and ‘]’ (ABNF %d93) MUST be escaped. This is necessary to avoid
parsing errors. Escaping ‘]’ would not strictly be necessary but is
REQUIRED by this specification to avoid syslog application
implementation errors. Each of these three characters MUST be
escaped as ‘\”‘, ‘\\’, and ‘\]’ respectively. The backslash is used
for control character escaping for consistency with its use for
escaping in other parts of the syslog message as well as in
traditional syslog.

A backslash (‘\’) followed by none of the three described characters
is considered an invalid escape sequence. In this case, the backslash
MUST be treated as a regular backslash and the following character as
a regular character. Thus, the invalid sequence MUST not be altered.

A space character can certainly be part of a “valid UTF-8 sequence”. The second quoted paragraph mentions three characters that must be escaped; the space character isn’t one of them.

Conclusion: the PARAM-VALUE field can contain blanks.