{"record":{"id":"b49faf0dda763f4f","repo":"crowdsecurity/crowdsec","slug":"timestamp-is-empty","errorCode":null,"errorMessage":"timestamp is empty","messagePattern":"timestamp is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":107,"sourceCode":"\ttimestamp := []byte{}\n\n\tif r.buf[r.position] == NIL_VALUE {\n\t\tr.Timestamp = time.Now().UTC().Round(0)\n\t\tr.position += 2\n\t\treturn nil\n\t}\n\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == ' ' {\n\t\t\tbreak\n\t\t}\n\t\ttimestamp = append(timestamp, c)\n\t\tr.position++\n\t}\n\n\tif len(timestamp) == 0 {\n\t\treturn errors.New(\"timestamp is empty\")\n\t}\n\n\tif r.position == r.len {\n\t\treturn errors.New(\"EOL after timestamp\")\n\t}\n\n\tdate, err := time.Parse(VALID_TIMESTAMP, string(timestamp))\n\tif err != nil {\n\t\treturn errors.New(\"timestamp is not valid\")\n\t}\n\n\tr.Timestamp = date\n\n\tr.position++\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after timestamp\")\n\t}","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L89-L125","documentation":"parseTimestamp collects characters up to the next space as the timestamp, unless it sees the NIL_VALUE '-'. If the first character is a space (or the position already points at an immediate break with nothing collected), the timestamp is empty and the header is malformed per RFC 5424, which requires either '-' or an RFC 3339 timestamp.","triggerScenarios":"Calling RFC5424.Parse on a header with a double space after the version, e.g. \"<34>1  host ...\" — the first space ends collection immediately with zero bytes, producing this error (distinct from the NIL_VALUE '-' path which yields a synthetic now timestamp).","commonSituations":"A sender using a custom syslog template inserting an extra space, hand-crafted test messages, or a relay normalizing whitespace incorrectly.","solutions":["Fix the sender template so exactly one space separates version and timestamp.","Replace the empty field with '-' (NILVALUE) if the sender has no timestamp.","Inspect the raw line for consecutive spaces after the version digit."],"exampleFix":"// before (double space -> empty timestamp)\nparser.Parse([]byte(\"<34>1  2024-01-01T00:00:00Z host app 1 - msg\"))\n// after\nparser.Parse([]byte(\"<34>1 2024-01-01T00:00:00Z host app 1 - msg\"))","handlingStrategy":"validation","validationCode":"// Go: ensure exactly one space after version, then a timestamp or '-'\nre := regexp.MustCompile(`^<\\d{1,3}>1 [^ ]`)\nfunc headerOK(line []byte) bool { return re.Match(line) }","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(line); err != nil {\n\tif strings.Contains(err.Error(), \"timestamp is empty\") {\n\t\t// check sender template for a double space after version\n\t}\n}","preventionTips":["Check sender syslog templates for duplicated separators","Use '-' (NILVALUE) when the sender has no timestamp","Regex pre-check the header layout before parsing"],"tags":["syslog","rfc5424","parsing","empty-field"],"backgroundTag":"empty-required-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}