{"record":{"id":"d261bf97d4eb607d","repo":"crowdsecurity/crowdsec","slug":"message-too-short","errorCode":null,"errorMessage":"message too short","messagePattern":"message too short","errorType":"validation","errorClass":"ParseError","httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/run.go","lineNumber":169,"sourceCode":"func (e *ParseError) Fields() logrus.Fields {\n\tfields := logrus.Fields{\n\t\t\"raw\": string(e.RawMessage),\n\t}\n\n\tif e.RFC3164 != nil {\n\t\tfields[\"rfc3164_err\"] = e.RFC3164.Error()\n\t}\n\n\tif e.RFC5424 != nil {\n\t\tfields[\"rfc5424_err\"] = e.RFC5424.Error()\n\t}\n\n\treturn fields\n}\n\nfunc stripPRI(msg []byte) (rest []byte, err error) {\n\tif len(msg) < 3 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"message too short\"), RawMessage: msg}\n\t}\n\n\tif msg[0] != '<' {\n\t\treturn nil, &ParseError{Reason: errors.New(\"missing PRI beginning\"), RawMessage: msg}\n\t}\n\n\tend := bytes.Index(msg, []byte(\">\"))\n\tif end == -1 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"missing PRI end\"), RawMessage: msg}\n\t}\n\n\tif end > 4 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"PRI too long\"), RawMessage: msg}\n\t}\n\n\tfor i := 1; i < end; i++ {\n\t\tif msg[i] < '0' || msg[i] > '9' {\n\t\t\treturn nil, &ParseError{Reason: errors.New(\"PRI not a number\"), RawMessage: msg}","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/run.go#L151-L187","documentation":"stripPRI parses the RFC3164/5424 <PRI> priority prefix from a syslog message. When the received message is fewer than 3 bytes it cannot contain '<PRI>' so the source returns a ParseError with reason 'message too short', carrying the raw message for diagnostics. This guards the parser from indexing out of bounds on truncated datagrams.","triggerScenarios":"parseLine hands stripPRI a message shorter than 3 characters, e.g. an empty or 1-2 byte UDP datagram, a line containing only whitespace/newline, or a truncated TCP stream fragment.","commonSituations":"Heartbeat/keepalive packets or empty lines sent to the syslog port; port scanners sending tiny probes; network fragmentation truncating datagrams; a forwarding rule (rsyslog, k8s, docker) emitting blank lines.","solutions":["Inspect the raw message in the ParseError to identify what peer/content sent the truncated line","Filter or drop empty/whitespace-only lines at the acquisition or forwarding layer before they reach crowdsec","Check the sending side for truncation or a misconfigured forwarder writing empty lines","Ignore if it's a network probe (scanner) hitting the syslog port"],"exampleFix":"// before: forwarder writes blank lines to syslog socket\nlogger.Printf(\"\")\n// after: skip empty messages before sending\nif msg != \"\" { logger.Printf(msg) }","handlingStrategy":"validation","validationCode":"if len(msg) < 3 { /* skip or log before configuring the syslog source */ }\n// at ops level: drop empty lines in forwarder\nif strings.TrimSpace(line) == \"\" { continue }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Silence keepalive/heartbeat emission to the syslog port","Drop empty lines in your log shipper before forwarding","Monitor ParseError occurrences to spot producers sending truncated data"],"tags":["syslog","parsing","input-validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}