{"record":{"id":"d264d60aa5ef6908","repo":"crowdsecurity/crowdsec","slug":"eol-after-sd","errorCode":null,"errorMessage":"EOL after SD","messagePattern":"EOL after SD","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":371,"sourceCode":"\t\treturn errors.New(\"EOL after ProcID\")\n\t}\n\n\terr = r.parseMsgID()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after MSGID\")\n\t}\n\n\terr = r.parseStructuredData()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after SD\")\n\t}\n\n\terr = r.parseMessage()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\nfunc NewRFC5424Parser(opts ...RFC5424Option) *RFC5424 {\n\tr := &RFC5424{}\n\tfor _, opt := range opts {\n\t\topt(r)\n\t}\n\treturn r\n}\n","sourceCodeStart":353,"sourceCodeEnd":389,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L353-L389","documentation":"The line ended right after the structured data with no free-form message following. After parsing SD, the parser requires a non-empty MSG portion (parseMessage returns 'message is empty' only at exact end; this check catches the same truncated shape). Input like '<13>1 <ts> host app proc msgid [x@1 y]' is rejected.","triggerScenarios":"Parse() where parseStructuredData() consumes the rest of the buffer and r.position >= r.len, e.g. '<13>1 2024-01-01T00:00:00Z host app 1234 ID47 -' followed by nothing (with the cursor past end rather than exactly at the SD terminator).","commonSituations":"Sender emits the full header but no message content (empty syslog event); transport drops the trailing message; a relay strips the message body.","solutions":["Fix the sender to include the actual message after the structured data","If events legitimately have no message, skip or ignore them upstream rather than parsing","Check relays/proxies that may strip message content"],"exampleFix":"// before\nline := \"<13>1 2024-01-01T00:00:00Z host app 1234 ID47 [exampleSDID@32473 iUT]\" // no msg\n// after\nline := \"<13>1 2024-01-01T00:00:00Z host app 1234 ID47 [exampleSDID@32473 iUT] something happened\"","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := p.Parse(line); err != nil {\n    log.Printf(\"syslog line has no message after SD: %q: %v\", line, err)\n    return\n}","preventionTips":["Senders must include a message body after structured data","Skip message-less events at the sender instead of emitting them","Watch relays that strip the free-form message portion"],"tags":["syslog","rfc5424","truncated-message","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}