{"record":{"id":"c994646f5aa41a3b","repo":"crowdsecurity/crowdsec","slug":"eol-after-appname","errorCode":null,"errorMessage":"EOL after appname","messagePattern":"EOL after appname","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":344,"sourceCode":"\t\treturn errors.New(\"EOL after Timestamp\")\n\t}\n\n\terr = r.parseHostname()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after hostname\")\n\t}\n\n\terr = r.parseAppName()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after appname\")\n\t}\n\n\terr = r.parseProcID()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after ProcID\")\n\t}\n\n\terr = r.parseMsgID()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after MSGID\")","sourceCodeStart":326,"sourceCodeEnd":362,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L326-L362","documentation":"RFC5424 parser guard: the message buffer ends immediately after the APP-NAME field, so the required PROCID field is missing. Fires when position reaches the end of the buffer right after parsing APP-NAME.","triggerScenarios":"Parse() where parseAppName() consumes through end of buffer, e.g. '<13>1 2024-01-01T00:00:00Z host myapp'.","commonSituations":"Truncated transmission; sender emits only a partial RFC5424 header; a proxy in the middle cutting messages; manual testing with incomplete strings.","solutions":["Fix the sender to include the complete header including PROCID and MSGID ('-' is a valid nil value)","Inspect intermediate proxies/relays for message truncation","Handle the error and retry with the RFC3164 parser or lenient PRI-stripping"],"exampleFix":"// before\nline := \"<13>1 2024-01-01T00:00:00Z host myapp\" // truncated\n// after\nline := \"<13>1 2024-01-01T00:00:00Z host myapp 1234 - - hello\"","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := p.Parse(line); err != nil {\n    log.Printf(\"syslog line truncated after appname: %q: %v\", line, err)\n    return\n}","preventionTips":["Always emit all header fields, using '-' for nil PROCID","Check proxies/relays for message truncation","Keep syslog templates in rsyslog/syslog-ng standard (RSYSLOG_SyslogProtocol23Format for RFC5424)"],"tags":["syslog","rfc5424","truncated-message","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}