{"record":{"id":"b4cb79d2a5984639","repo":"crowdsecurity/crowdsec","slug":"eol-after-timestamp","errorCode":null,"errorMessage":"EOL after timestamp","messagePattern":"EOL after timestamp","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":111,"sourceCode":"\t\tr.position += 2\n\t\treturn nil\n\t}\n\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == ' ' {\n\t\t\tbreak\n\t\t}\n\t\ttimestamp = append(timestamp, c)\n\t\tr.position++\n\t}\n\n\tif len(timestamp) == 0 {\n\t\treturn errors.New(\"timestamp is empty\")\n\t}\n\n\tif r.position == r.len {\n\t\treturn errors.New(\"EOL after timestamp\")\n\t}\n\n\tdate, err := time.Parse(VALID_TIMESTAMP, string(timestamp))\n\tif err != nil {\n\t\treturn errors.New(\"timestamp is not valid\")\n\t}\n\n\tr.Timestamp = date\n\n\tr.position++\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after timestamp\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L93-L129","documentation":"After collecting a non-empty timestamp, parseTimestamp checks that the buffer has not ended. RFC 5424 requires hostname, appname, procid, msgid and structured data after the timestamp, so a line ending right after the timestamp is truncated and rejected.","triggerScenarios":"Calling RFC5424.Parse on \"<34>1 2024-01-01T00:00:00Z\" — the timestamp loop stops at end of buffer with r.position == r.len, before any time parsing occurs.","commonSituations":"A device emitting timestamp-only messages, TCP framing dropping the rest of the frame, or a regex/filter upstream cutting the line.","solutions":["Fix framing so complete syslog frames are delivered (octet counting per RFC 6587 for TCP).","Verify the sending device includes hostname/appname/procid/msgid/structured-data after the timestamp.","Check any intermediate transformation (forwarder, log shipper) isn't truncating the message."],"exampleFix":"// before (nothing after timestamp)\nparser.Parse([]byte(\"<34>1 2024-01-01T00:00:00Z\"))\n// after (full header + message)\nparser.Parse([]byte(\"<34>1 2024-01-01T00:00:00Z host app 1 - msg\"))","handlingStrategy":"validation","validationCode":"// Go: require content after the timestamp token\nfunc hasFieldsAfterTimestamp(line []byte) bool {\n\t// header must have at least '<P>1 TS host ...'\n\tparts := bytes.SplitN(line, []byte(\" \"), 5)\n\treturn len(parts) == 5 && len(parts[3]) > 0\n}","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(line); err != nil {\n\tif strings.Contains(err.Error(), \"EOL after timestamp\") {\n\t\t// flag the sender; frame is incomplete\n\t}\n}","preventionTips":["Verify senders emit the full header (hostname onwards) after the timestamp","Use octet-counted TCP framing to avoid truncation","Inspect intermediate forwarders for line-cutting transformations"],"tags":["syslog","rfc5424","parsing","truncated-message"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}