Which identifier is used to describe the application or process that submitted a log message?

The 'action' describes what occurred in the log event, not the source application itself.

A 'selector' is a combination of facility and priority used in syslog configuration for filtering, not an identifier for the source application itself.

The 'priority' (or severity) describes the importance or criticality of the log message, not the application that sent it.

In syslog messages, the 'facility' field indicates the type of program or process that generated the log message, such as kernel, user-level, mail system, or security/authorization, allowing for systematic categorization of log sources.