subcode 0 is normal for ERR_HOLDTIMEREXPIRED; don't print "unknown subcode" for this. OK?
Index: log.c =================================================================== RCS file: /cvs/src/usr.sbin/bgpd/log.c,v retrieving revision 1.56 diff -u -p -r1.56 log.c --- log.c 10 Jun 2012 11:16:08 -0000 1.56 +++ log.c 10 Jan 2013 09:34:16 -0000 @@ -291,7 +291,8 @@ log_notification(const struct peer *peer suberrname = suberr_cease_names[subcode]; break; case ERR_HOLDTIMEREXPIRED: - uk = 1; + if (subcode != 0) + uk = 1; break; case ERR_FSM: if (subcode >= sizeof(suberr_fsm_names)/sizeof(char *))