{"record":{"id":"c6e173d83c4fde7f","repo":"crowdsecurity/crowdsec","slug":"eol-after-hostname","errorCode":null,"errorMessage":"EOL after hostname","messagePattern":"EOL after hostname","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":335,"sourceCode":"\t\treturn errors.New(\"EOL after Version\")\n\t}\n\n\terr = r.parseTimestamp()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after Timestamp\")\n\t}\n\n\terr = r.parseHostname()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after hostname\")\n\t}\n\n\terr = r.parseAppName()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after appname\")\n\t}\n\n\terr = r.parseProcID()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after ProcID\")","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L317-L353","documentation":"RFC5424 parser guard: the message buffer ends immediately after the HOSTNAME field, so the required space-separated APP-NAME field (or at least its separator) is missing. Fires when position reaches the end of the buffer right after parsing HOSTNAME.","triggerScenarios":"Parse() where parseHostname() succeeds and leaves r.position at r.len — e.g. '<13>1 2024-01-01T00:00:00Z myhost'.","commonSituations":"Sender truncates the message after hostname (some embedded devices emit incomplete RFC5424); TCP stream cut mid-header; hand-written test input missing the remaining SD elements.","solutions":["Update/fix the emitting device or library so the full header is sent (appname, procid, msgid, SD, message)","Check for message truncation in the transport (UDP size limits, TCP close mid-line)","Fall back to lenient parsing (RFC3164 attempt or stripPRI) for these lines"],"exampleFix":"// before\nline := \"<13>1 2024-01-01T00:00:00Z myhost\" // truncated\n// after\nline := \"<13>1 2024-01-01T00:00:00Z myhost myapp - - - hello\"","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := p.Parse(line); err != nil {\n    log.Printf(\"syslog line truncated after hostname: %q: %v\", line, err)\n    return\n}","preventionTips":["Configure emitting devices to output full RFC5424 headers","Use nil value '-' for unknown app-name instead of omitting the field","Monitor ParseError fields logs to spot senders that consistently truncate at the same point"],"tags":["syslog","rfc5424","truncated-message","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}