{"record":{"id":"5ff4c884f37747ef","repo":"crowdsecurity/crowdsec","slug":"eol-after-procid","errorCode":null,"errorMessage":"EOL after ProcID","messagePattern":"EOL after ProcID","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":353,"sourceCode":"\t\treturn errors.New(\"EOL after hostname\")\n\t}\n\n\terr = r.parseAppName()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after appname\")\n\t}\n\n\terr = r.parseProcID()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after ProcID\")\n\t}\n\n\terr = r.parseMsgID()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after MSGID\")\n\t}\n\n\terr = r.parseStructuredData()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after SD\")","sourceCodeStart":335,"sourceCodeEnd":371,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L335-L371","documentation":"RFC5424 parser guard: the message buffer ends immediately after the PROCID field, so the required MSGID field is missing. Fires when position reaches the end of the buffer right after parsing PROCID.","triggerScenarios":"Parse() where parseProcID() succeeds and the cursor reaches r.len, e.g. '<13>1 2024-01-01T00:00:00Z host app 1234'.","commonSituations":"Message cut off in transport; sender bug producing partial headers; crafted test inputs that omit the trailing fields.","solutions":["Fix the sender to complete the header — MSGID and STRUCTURED-DATA may both be '-'","Check for truncation at relays/proxies or UDP payload limits","Parse leniently (stripPRI) if these lines should still be ingested"],"exampleFix":"// before\nline := \"<13>1 2024-01-01T00:00:00Z host app 1234\" // truncated\n// after\nline := \"<13>1 2024-01-01T00:00:00Z host app 1234 ID47 - hello\"","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := p.Parse(line); err != nil {\n    log.Printf(\"syslog line truncated after procid: %q: %v\", line, err)\n    return\n}","preventionTips":["Emit '-' for nil MSGID rather than stopping the message","Verify transports preserve the whole datagram","Test with the full canonical example from RFC5424 section 6.5"],"tags":["syslog","rfc5424","truncated-message","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}