{"record":{"id":"5645baf87e2f646a","repo":"crowdsecurity/crowdsec","slug":"tag-is-empty","errorCode":null,"errorMessage":"tag is empty","messagePattern":"tag is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go","lineNumber":149,"sourceCode":"\treturn nil\n}\n\n//We do not enforce tag len as quite a lot of syslog client send tags with more than 32 chars\nfunc (r *RFC3164) parseTag() error {\n\ttag := []byte{}\n\ttmpPid := []byte{}\n\tpidEnd := false\n\thasPid := false\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif !utils.IsAlphaNumeric(c) {\n\t\t\tbreak\n\t\t}\n\t\ttag = append(tag, c)\n\t\tr.position++\n\t}\n\tif len(tag) == 0 {\n\t\treturn errors.New(\"tag is empty\")\n\t}\n\tr.Tag = string(tag)\n\n\tif r.position == r.len {\n\t\treturn nil\n\t}\n\n\tc := r.buf[r.position]\n\tif c == '[' {\n\t\thasPid = true\n\t\tr.position++\n\t\tfor r.position < r.len {\n\t\t\tc = r.buf[r.position]\n\t\t\tif c == ']' {\n\t\t\t\tpidEnd = true\n\t\t\t\tr.position++\n\t\t\t\tbreak\n\t\t\t}","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go#L131-L167","documentation":"parseTag reads alphanumeric bytes at the start of the message content as the TAG; if the first non-PRI/timestamp/hostname content character is not alphanumeric, no tag bytes are collected and it returns 'tag is empty'. It is thrown because the RFC3164 CONTENT field begins with TAG and the parser cannot produce a valid Tag value otherwise.","triggerScenarios":"Calling Parse on a message whose content (after hostname) begins with a non-alphanumeric character: e.g. content starts with ':', ' ', '[' , '-' or punctuation instead of a tag like 'sshd'. Also when the message ends right after the hostname, leaving nothing to parse as tag.","commonSituations":"Messages missing the TAG field entirely (some devices send '<PRI><TS> host message' with no tag); a leading space anomaly making parseHostname consume the tag as hostname, leaving an empty tag; applications emitting free-form messages without a syslog tag; test messages like '<34>Feb  3 09:12:01 host : msg'.","solutions":["Verify the message follows RFC3164 CONTENT = TAG + optional '[pid]' + ':' + MSG; the first character after the hostname space must be alphanumeric.","Prepend a tag at the source (rsyslog template with %programname%, syslog-ng ${PROGRAM}) for devices that do not emit one.","Ensure exactly one space separates hostname and tag — an extra space makes parseHostname swallow the tag and leaves tag empty.","If messages legitimately have no tag, route them through a parser path that tolerates missing tags or normalize them upstream before acquisition.","Inspect the raw line: if the message ends after the hostname, the sender is dropping CONTENT — fix the emitter."],"exampleFix":"// before: content starts with ':' — no TAG field\nr.Parse([]byte(\"<34>Feb  3 09:12:01 host : connection lost\")) // tag is empty\n\n// after\nr.Parse([]byte(\"<34>Feb  3 09:12:01 host app: connection lost\"))","handlingStrategy":"validation","validationCode":"func contentStartsWithTag(msg string) bool {\n\t// locate start of CONTENT: after '<PRI> timestamp hostname '\n\tparts := strings.SplitN(msg, \" \", 4)\n\treturn len(parts) == 4 && len(parts[3]) > 0 && isAlphaNumeric(parts[3][0])\n}\n\nfunc isAlphaNumeric(c byte) bool {\n\treturn c >= '0' && c <= '9' || c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z'\n}","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(line); err != nil {\n\tif strings.Contains(err.Error(), \"tag is empty\") {\n\t\tline = prependDefaultTag(line, \"unknown\") // rewrite or drop\n\t}\n}","preventionTips":["Configure senders to always emit a program/tag (rsyslog %programname%)","Ensure exactly one space between hostname and TAG so parseHostname does not swallow it","Add a ':' after the tag when the message body starts with punctuation","Test the parser with raw samples from every emitting device before deploying"],"tags":["syslog","rfc3164","tag","parsing"],"backgroundTag":"empty-required-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}