After ignoring the zephyr code for a while (the logger has Just Worked
for rather a while, barring network outages, and it restarts well
enough after those) I took another look at ctypes. One key difference
is that pyrex imports the abstract (as much as C ever is) structure
definitions... so you can define fields by name based on what's
visible and part of the API... because under the covers it is
compiling against the header files; with ctypes, you have to duplicate
the physical C structure, because it isn't compiling at all, just
building up the same thing in memory.
Given that, it still only took 95 lines of code to cook up the notice type, initialize one, and send it (unauthenticated). I still need to wrap it up in a more useful interface, but this convinces me that it works for a library like this... next step is authentication, and then maybe gssapi...