{"record":{"id":"66be406d16954320","repo":"crowdsecurity/crowdsec","slug":"eol-after-pri","errorCode":null,"errorMessage":"EOL after PRI","messagePattern":"EOL after PRI","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":308,"sourceCode":"\t}\n\tr.Message = string(message)\n\treturn nil\n}\n\nfunc (r *RFC5424) Parse(message []byte) error {\n\tr.len = len(message)\n\tif r.len == 0 {\n\t\treturn errors.New(\"syslog line is empty\")\n\t}\n\tr.buf = message\n\n\terr := r.parsePRI()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after PRI\")\n\t}\n\n\terr = r.parseVersion()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after Version\")\n\t}\n\n\terr = r.parseTimestamp()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after Timestamp\")","sourceCodeStart":290,"sourceCodeEnd":326,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L290-L326","documentation":"The line ended immediately after the PRI (<PRI>) with no version field following. RFC5424 requires 'VERSION' (a 1-3 digit non-zero number) right after PRI, so a line like '<13>' or '<34>\\n' is truncated and cannot be a valid RFC5424 message.","triggerScenarios":"Parse([]byte(\"<13>\")) or any input where the cursor reaches the end of the buffer directly after parsePRI() consumes '<PRI>'.","commonSituations":"An RFC3164-style line (which has no version) is fed to the RFC5424 parser — in crowdsec's syslog source this is normal and triggers the RFC3164 fallback; a client sends a truncated message; a TCP stream was cut mid-line.","solutions":["Confirm the sender is emitting RFC5424 format with a version digit after PRI (e.g. '<34>1 ...')","If the line is genuinely RFC3164, this error is expected — let the RFC3164 parser handle it (crowdsec does this automatically in parseLine)","Check for TCP fragmentation/truncation between sender and collector"],"exampleFix":"// before (feeding RFC3164 line to 5424 parser)\np2.Parse([]byte(\"<34>Jan  1 00:00:00 host tag: msg\")) // EOL after PRI\n// after\nerr := p.Parse(line) // try RFC3164 first\nif err != nil {\n    err = p2.Parse(line) // RFC5424\n}","handlingStrategy":"try-catch","validationCode":"func looksRFC5424(line []byte) bool {\n    // PRI must be followed by a non-zero version digit and a space\n    end := bytes.IndexByte(line, '>')\n    return end > 0 && end < 5 && end+1 < len(line) && line[end+1] >= '1' && line[end+1] <= '9'\n}","typeGuard":null,"tryCatchPattern":"var pe *syslog.ParseError\nif err := p.Parse(line); err != nil {\n    if errors.As(err, &pe) {\n        log.Printf(\"bad syslog line %q: %v\", pe.RawMessage, err)\n    }\n    return // handle/fallback\n}","preventionTips":["Ensure senders emit the RFC5424 version field ('1') right after PRI","Rely on the RFC3164 fallback for legacy senders instead of forcing RFC5424","Watch for TCP framing issues that split lines mid-header"],"tags":["syslog","rfc5424","truncated-message","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}