{"record":{"id":"401f8e001c19832a","repo":"crowdsecurity/crowdsec","slug":"eol-after-timestamp-401f8e","errorCode":null,"errorMessage":"EOL after Timestamp","messagePattern":"EOL after Timestamp","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":326,"sourceCode":"\t\treturn errors.New(\"EOL after PRI\")\n\t}\n\n\terr = r.parseVersion()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after Version\")\n\t}\n\n\terr = r.parseTimestamp()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after Timestamp\")\n\t}\n\n\terr = r.parseHostname()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after hostname\")\n\t}\n\n\terr = r.parseAppName()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after appname\")","sourceCodeStart":308,"sourceCodeEnd":344,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L308-L344","documentation":"In the sequential RFC5424 Parse, after the timestamp is parsed the input must still contain the hostname field; end-of-buffer at this point means the message was truncated after TIMESTAMP (fewer than the required header fields), so parsing stops with this error.","triggerScenarios":"Parse([]byte(\"<13>1 2024-01-01T00:00:00Z\")) — parseTimestamp() succeeds and the cursor reaches the end of buffer.","commonSituations":"Truncated network transmission (UDP datagram cut, TCP stream terminated mid-line); a buggy sender that stops building the message after the timestamp; manual test strings missing later fields.","solutions":["Fix the sender to emit the full header: hostname, appname, procid, msgid, structured data, then message","Check network path for datagram truncation (UDP payload limits, MTU)","Use lenient parsing (stripPRI / DisableRFCParser) if truncated lines must still be ingested"],"exampleFix":"// before\nline := \"<13>1 2024-01-01T00:00:00Z\" // truncated\n// after\nline := \"<13>1 2024-01-01T00:00:00Z myhost myapp 1234 ID1 - hello\"","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := p.Parse(line); err != nil {\n    log.Printf(\"syslog line truncated after timestamp: %q: %v\", line, err)\n    return\n}","preventionTips":["Send complete headers — use '-' for nil hostname if unknown","Check intermediate relays for truncation","Enable crowdec's RFC3164 fallback for legacy senders"],"tags":["syslog","rfc5424","truncated-message","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}