Which identifier is used to describe the application or process that submitted a log message?

Action is not a defined syslog field - it does not appear in the syslog message format as specified in RFC 5424.

A selector combines both facility and severity to filter syslog messages, it is not an identifier for the source application alone.

Priority is a calculated value derived from combining the facility and severity fields, not a standalone identifier for the originating process.

The facility field in the syslog protocol is specifically designed to identify the application or process that generated the message, such as kern (0), user (1), mail (2), or daemon (3). It is a numeric value encoded in the priority field (PRI) of the syslog message header. This allows log management systems to filter and route messages based on their originating process.