{"record":{"id":"c036c3536e12e04d","repo":"crowdsecurity/crowdsec","slug":"syslog-line-is-empty","errorCode":null,"errorMessage":"syslog line is empty","messagePattern":"syslog line is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":298,"sourceCode":"\tif r.position == r.len {\n\t\treturn errors.New(\"message is empty\")\n\t}\n\n\tmessage := []byte{}\n\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tmessage = append(message, c)\n\t\tr.position++\n\t}\n\tr.Message = string(message)\n\treturn nil\n}\n\nfunc (r *RFC5424) Parse(message []byte) error {\n\tr.len = len(message)\n\tif r.len == 0 {\n\t\treturn errors.New(\"syslog line is empty\")\n\t}\n\tr.buf = message\n\n\terr := r.parsePRI()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after PRI\")\n\t}\n\n\terr = r.parseVersion()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L280-L316","documentation":"The RFC5424 parser's Parse() method received a zero-length byte slice. An empty line carries no PRI, version, or any other syslog field, so there is nothing to parse and the parser fails immediately before touching the buffer.","triggerScenarios":"Calling (*RFC5424).Parse(nil) or Parse([]byte(\"\")). In the syslog source this happens when the syslog server delivers an empty datagram or a line consisting only of the newline terminator.","commonSituations":"A sender (log shipper, network device, test client) writes an empty UDP packet or a bare '\\n' to the syslog socket; a custom acquisition pipeline feeding blank lines; reading from a socket that delivered an empty frame on connect.","solutions":["Fix the sender so it does not emit empty datagrams or bare newlines to the syslog socket","Skip/ignore empty lines in the ingestion layer before handing them to the RFC5424 parser","If parsing manually, check len(message) == 0 and short-circuit instead of calling Parse"],"exampleFix":"// before\np := rfc5424.NewRFC5424Parser()\nerr := p.Parse(line) // panics-free but errors on empty line\n// after\nif len(line) == 0 {\n    return nil // skip blank line\n}\nerr := p.Parse(line)","handlingStrategy":"validation","validationCode":"if len(line) == 0 {\n    return nil // skip empty line before calling Parse\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Filter blank lines at the socket/reader layer before parsing","In tests, never pass nil or empty slices to Parse","Monitor your syslog source for empty datagrams — they indicate a misbehaving sender"],"tags":["syslog","rfc5424","empty-input","parsing"],"backgroundTag":"empty-required-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}