{"record":{"id":"6960418df12d48e4","repo":"crowdsecurity/crowdsec","slug":"eol-after-version","errorCode":null,"errorMessage":"EOL after Version","messagePattern":"EOL after Version","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":317,"sourceCode":"\t}\n\tr.buf = message\n\n\terr := r.parsePRI()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after PRI\")\n\t}\n\n\terr = r.parseVersion()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after Version\")\n\t}\n\n\terr = r.parseTimestamp()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after Timestamp\")\n\t}\n\n\terr = r.parseHostname()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after hostname\")","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L299-L335","documentation":"Truncation guard in Parse: after successfully parsing the VERSION field, the input is already exhausted, so the mandatory TIMESTAMP field cannot be read. Indicates a header cut short after '<PRI>VERSION'.","triggerScenarios":"Parse([]byte(\"<13>1\")) or input where parseVersion() consumes to the end of the buffer and r.position >= r.len afterwards.","commonSituations":"A message cut off mid-header by TCP segmentation or a small UDP payload limit; a sender that emits an incomplete RFC5424 header; testing with hand-crafted partial strings.","solutions":["Fix the sender to emit the complete header (timestamp at minimum, e.g. '<13>1 2024-01-01T00:00:00Z ...')","Increase UDP payload size / check for MTU or TCP truncation issues","If the truncated line should still be processed, set DisableRFCParser or use stripPRI-style lenient parsing"],"exampleFix":"// before\nline := \"<13>1\" // truncated\n// after\nline := \"<13>1 2024-01-01T00:00:00Z host app procid msgid - msg\"","handlingStrategy":"try-catch","validationCode":"// naive check: header must contain at least PRI, version and a timestamp\nfunc headerComplete(line []byte, minFields int) bool {\n    return bytes.Count(line, []byte(\" \")) >= minFields\n}\nif bytes.Count(line, []byte(\" \")) < 2 { return errTruncated }","typeGuard":null,"tryCatchPattern":"if err := p.Parse(line); err != nil {\n    log.Printf(\"truncated syslog line %q: %v\", line, err)\n    return\n}","preventionTips":["Increase UDP payload limits / avoid MTU truncation","Fix senders that build partial headers","Test senders with full example lines: '<13>1 2024-01-01T00:00:00Z h a p i - m'"],"tags":["syslog","rfc5424","truncated-message","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}