{"record":{"id":"512a668142112fbd","repo":"crowdsecurity/crowdsec","slug":"hostname-is-empty-512a66","errorCode":null,"errorMessage":"hostname is empty","messagePattern":"hostname is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":153,"sourceCode":"\t}\n\n\thostname := []byte{}\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == ' ' {\n\t\t\tr.position++\n\t\t\tbreak\n\t\t}\n\t\thostname = append(hostname, c)\n\t\tr.position++\n\t}\n\tif r.strictHostname {\n\t\tif !utils.IsValidHostnameOrIP(string(hostname)) {\n\t\t\treturn errors.New(\"hostname is not valid\")\n\t\t}\n\t}\n\tif len(hostname) == 0 {\n\t\treturn errors.New(\"hostname is empty\")\n\t}\n\tr.Hostname = string(hostname)\n\treturn nil\n}\n\nfunc (r *RFC5424) parseAppName() error {\n\tif r.buf[r.position] == NIL_VALUE {\n\t\tr.Tag = \"\"\n\t\tr.position += 2\n\t\treturn nil\n\t}\n\n\tappname := []byte{}\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == ' ' {\n\t\t\tr.position++\n\t\t\tbreak","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L135-L171","documentation":"Returned by parseHostname when the hostname field of an RFC5424 header was parsed to zero bytes — the character between the timestamp and the next space is missing (e.g. two consecutive spaces), so the hostname SD element is empty rather than the RFC5424 NIL value '-'.","triggerScenarios":"Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:153 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Send the RFC5424 NIL value '-' in the HOSTNAME field when there is no hostname","Fix the emitting syslog client to always send a non-empty hostname between TIMESTAMP and APP-NAME","If the source is a non-RFC5424 formatter, use a parser matching its actual format"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}