{"record":{"id":"42426a0a66ac5590","repo":"crowdsecurity/crowdsec","slug":"eol-after-msgid","errorCode":null,"errorMessage":"EOL after MSGID","messagePattern":"EOL after MSGID","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":362,"sourceCode":"\t\treturn errors.New(\"EOL after appname\")\n\t}\n\n\terr = r.parseProcID()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after ProcID\")\n\t}\n\n\terr = r.parseMsgID()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after MSGID\")\n\t}\n\n\terr = r.parseStructuredData()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after SD\")\n\t}\n\n\terr = r.parseMessage()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}","sourceCodeStart":344,"sourceCodeEnd":380,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L344-L380","documentation":"The line ended immediately after the MSGID, before the structured data. RFC5424 mandates STRUCTURED-DATA (or '-') after MSGID, so input like '<13>1 <ts> host app proc msgid' is truncated and rejected.","triggerScenarios":"Parse() where parseMsgID() succeeds leaving r.position at r.len, e.g. '<13>1 2024-01-01T00:00:00Z host app 1234 ID47'.","commonSituations":"Transport truncation; senders that stop after the MSGID thinking the message part is optional (it is not here — parseMessage errors on an empty remainder too); incomplete manual test strings.","solutions":["Fix the sender to append STRUCTURED-DATA ('-' if none) and the message after it","Verify no intermediary truncates lines (TCP framing, UDP size)","Fall back to RFC3164 parsing or lenient PRI stripping for these lines"],"exampleFix":"// before\nline := \"<13>1 2024-01-01T00:00:00Z host app 1234 ID47\" // truncated\n// after\nline := \"<13>1 2024-01-01T00:00:00Z host app 1234 ID47 - hello world\"","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := p.Parse(line); err != nil {\n    log.Printf(\"syslog line truncated after msgid: %q: %v\", line, err)\n    return\n}","preventionTips":["Append STRUCTURED-DATA ('-' if none) and the message before sending","Remember the message part is mandatory for this parser","Check for truncation in TCP framing or size-limited relays"],"tags":["syslog","rfc5424","truncated-message","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}