{"record":{"id":"5895d4cba92549ff","repo":"crowdsecurity/crowdsec","slug":"hostname-is-empty","errorCode":null,"errorMessage":"hostname is empty","messagePattern":"hostname is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go","lineNumber":128,"sourceCode":"\nfunc (r *RFC3164) parseHostname() error {\n\thostname := []byte{}\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == ' ' {\n\t\t\tr.position++\n\t\t\tbreak\n\t\t}\n\t\thostname = append(hostname, c)\n\t\tr.position++\n\t}\n\tif r.strictHostname {\n\t\tif !utils.IsValidHostnameOrIP(string(hostname)) {\n\t\t\treturn errors.New(\"hostname is not valid\")\n\t\t}\n\t}\n\tif len(hostname) == 0 {\n\t\treturn errors.New(\"hostname is empty\")\n\t}\n\tr.Hostname = string(hostname)\n\treturn nil\n}\n\n//We do not enforce tag len as quite a lot of syslog client send tags with more than 32 chars\nfunc (r *RFC3164) parseTag() error {\n\ttag := []byte{}\n\ttmpPid := []byte{}\n\tpidEnd := false\n\thasPid := false\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif !utils.IsAlphaNumeric(c) {\n\t\t\tbreak\n\t\t}\n\t\ttag = append(tag, c)\n\t\tr.position++","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go#L110-L146","documentation":"parseHostname collects the bytes between the timestamp and the next space; if the very next byte is a space (or the message ends there), the collected hostname is empty and the parser returns 'hostname is empty'. It is thrown because RFC3164 requires a hostname field and r.Hostname cannot meaningfully be set to an empty string.","triggerScenarios":"Calling Parse on a message with two consecutive spaces after the timestamp ('<34>Feb  3 09:12:01  tag: msg'), or a message that ends immediately after the timestamp with nothing following.","commonSituations":"Log forwarders that strip or blank the hostname field; manually crafted test lines with an extra space; devices configured without a hostname emitting an empty field; truncation of long syslog lines that cuts the hostname off.","solutions":["Check the raw message bytes: there must be exactly one space between the timestamp and the hostname, and the hostname must be present.","Fix the emitting device or relay configuration so it includes a hostname field (e.g. set a hostname template in rsyslog/syslog-ng).","If your sources legitimately omit hostname, patch the pipeline upstream to insert a placeholder hostname before parsing.","If the line is being truncated in transit, increase the syslog line/max message size limit on the collector."],"exampleFix":"// before: double space, empty hostname field\nr.Parse([]byte(\"<34>Feb  3 09:12:01  sshd[123]: msg\")) // hostname is empty\n\n// after\nr.Parse([]byte(\"<34>Feb  3 09:12:01 myhost sshd[123]: msg\"))","handlingStrategy":"validation","validationCode":"func hasHostnameField(msg string) bool {\n\t// after PRI and 15-char syslog timestamp there must be a non-space hostname token\n\tconst tsLen = len(\"Jan 02 15:04:05\")\n\ti := strings.IndexByte(msg, '>')\n\tif i < 0 { return false }\n\trest := msg[i+1+tsLen:]\n\treturn len(rest) > 0 && rest[0] != ' '\n}","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(line); err != nil {\n\tif strings.Contains(err.Error(), \"hostname is empty\") {\n\t\tline = normalizeMissingHostname(line) // rewrite upstream or log and drop\n\t}\n}","preventionTips":["Ensure sender templates always emit a hostname field (rsyslog %hostname%, syslog-ng ${HOST})","Check raw bytes for double spaces between timestamp and hostname","Increase collector max line size so hostname is not truncated away","Add unit tests with representative lines from each real device"],"tags":["syslog","rfc3164","hostname","empty-field"],"backgroundTag":"empty-required-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}