{"record":{"id":"8abfbffe4edc8cbc","repo":"crowdsecurity/crowdsec","slug":"message-is-empty","errorCode":null,"errorMessage":"message is empty","messagePattern":"message is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go","lineNumber":193,"sourceCode":"\n\tif hasPid && !pidEnd {\n\t\treturn errors.New(\"pid inside tag must be closed with ']'\")\n\t}\n\n\tif hasPid {\n\t\tr.PID = string(tmpPid)\n\t}\n\treturn nil\n}\n\nfunc (r *RFC3164) parseMessage() error {\n\terr := r.parseTag()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position == r.len {\n\t\treturn errors.New(\"message is empty\")\n\t}\n\n\tc := r.buf[r.position]\n\n\tif c == ':' {\n\t\tr.position++\n\t}\n\n\tfor {\n\t\tif r.position >= r.len {\n\t\t\treturn errors.New(\"message is empty\")\n\t\t}\n\t\tc := r.buf[r.position]\n\t\tif c != ' ' {\n\t\t\tbreak\n\t\t}\n\t\tr.position++\n\t}","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go#L175-L211","documentation":"After successfully parsing the tag in an RFC3164 message, the parser expects at least one more character (the ':' separator and/or the message body). If the input ends exactly at the end of the tag, there is no message content, so parseMessage throws \"message is empty\".","triggerScenarios":"Calling RFC3164.Parse on a message that contains only PRI + timestamp + hostname + tag with nothing after it, e.g. `\"<34>Oct 11 22:14:15 mymachine sshd\"` or `\"<34>Oct 11 22:14:15 mymachine sshd[1234]\"`.","commonSituations":"Producers emitting log lines with a tag but no content (empty log statement), truncated syslog datagrams (UDP payload cut at tag boundary), forwarding pipelines dropping the message part, test fixtures that stop at the tag.","solutions":["Ensure the syslog producer sends a non-empty message after the tag: `tag[pid]: actual message text`","Truncate/blank lines at the acquisition source: filter empty-content lines before feeding them to Parse","If your source legitimately emits tag-only lines, skip them in caller code instead of parsing them","Check network/reader configuration (max line length, datagram size) that may cut the message portion"],"exampleFix":"// before\nr.Parse([]byte(\"<34>Oct 11 22:14:15 mymachine sshd[1234]\"))\n// after\nr.Parse([]byte(\"<34>Oct 11 22:14:15 mymachine sshd[1234]: Accepted password for user\"))","handlingStrategy":"validation","validationCode":"func hasMessageAfterTag(line []byte) bool {\n\t// RFC3164: PRI + timestamp(15) + space + hostname + space + tag...\n\t// cheap check: at least one space-separated field count and non-empty tail\n\treturn len(bytes.TrimSpace(line)) > 0 && bytes.Count(line, []byte(\" \")) >= 3\n}","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(msg); err != nil {\n\tif strings.Contains(err.Error(), \"message is empty\") {\n\t\tlog.Debugf(\"ignoring tag-only syslog line: %q\", msg)\n\t\treturn nil\n\t}\n\treturn err\n}","preventionTips":["Filter blank/tag-only lines at acquisition before parsing","Fix producers that log with an empty message body","Watch for UDP datagram truncation (MTU) that cuts off message content","Keep the ':' separator convention so tag parsing and message parsing stay aligned"],"tags":["go","syslog","rfc3164","parsing","empty-message"],"backgroundTag":"empty-required-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}