{"record":{"id":"e5679c403b714db2","repo":"crowdsecurity/crowdsec","slug":"hostname-is-not-valid-e5679c","errorCode":null,"errorMessage":"hostname is not valid","messagePattern":"hostname is not valid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":149,"sourceCode":"\tif r.buf[r.position] == NIL_VALUE {\n\t\tr.Hostname = \"\"\n\t\tr.position += 2\n\t\treturn nil\n\t}\n\n\thostname := []byte{}\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == ' ' {\n\t\t\tr.position++\n\t\t\tbreak\n\t\t}\n\t\thostname = append(hostname, c)\n\t\tr.position++\n\t}\n\tif r.strictHostname {\n\t\tif !utils.IsValidHostnameOrIP(string(hostname)) {\n\t\t\treturn errors.New(\"hostname is not valid\")\n\t\t}\n\t}\n\tif len(hostname) == 0 {\n\t\treturn errors.New(\"hostname is empty\")\n\t}\n\tr.Hostname = string(hostname)\n\treturn nil\n}\n\nfunc (r *RFC5424) parseAppName() error {\n\tif r.buf[r.position] == NIL_VALUE {\n\t\tr.Tag = \"\"\n\t\tr.position += 2\n\t\treturn nil\n\t}\n\n\tappname := []byte{}\n\tfor r.position < r.len {","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L131-L167","documentation":"When the parser is constructed with the WithStrictHostname option, parseHostname validates the collected hostname with utils.IsValidHostnameOrIP. If the field between the timestamp and appname is neither a valid hostname nor a valid IP, the parser rejects the line instead of accepting an arbitrary PRINTUSASCII token.","triggerScenarios":"Calling NewRFC5424Parser(WithStrictHostname()) then Parse on a header whose hostname field contains characters like '_', '@', '/', or is an FQDN label the validator rejects, e.g. \"<34>1 2024-01-01T00:00:00Z my_host@! app 1 - msg\".","commonSituations":"Devices emitting Windows-style hostnames with underscores, relays injecting placeholder tokens, or misconfigured syslog templates putting the tag/appname into the hostname slot.","solutions":["Fix the sender to emit a valid RFC 1123 hostname or IP in the hostname field (no underscores or special characters).","Drop WithStrictHostname() and construct the parser with NewRFC5424Parser() if you must accept arbitrary hostname tokens.","Log the offending hostname value and check utils.IsValidHostnameOrIP against it to understand which rule fails."],"exampleFix":"// before (underscore hostname, strict mode)\np := rfc5424.NewRFC5424Parser(rfc5424.WithStrictHostname())\np.Parse([]byte(\"<34>1 2024-01-01T00:00:00Z my_host app 1 - msg\"))\n// after (valid hostname)\np.Parse([]byte(\"<34>1 2024-01-01T00:00:00Z my-host.example.com app 1 - msg\"))\n// or relax:\np := rfc5424.NewRFC5424Parser()","handlingStrategy":"validation","validationCode":"// Go: pre-check the hostname token when strict mode is on\nfunc hostnameLooksValid(line []byte) bool {\n\tparts := bytes.SplitN(line, []byte(\" \"), 5)\n\tif len(parts) < 5 {\n\t\treturn false\n\t}\n\th := string(parts[3])\n\treturn h == \"-\" || net.ParseIP(h) != nil ||\n\t\t(reValidHost.MatchString(h)) // e.g. ^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$\n}","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(line); err != nil {\n\tif strings.Contains(err.Error(), \"hostname is not valid\") {\n\t\t// fix sender hostname or construct parser without WithStrictHostname()\n\t}\n}","preventionTips":["Only enable WithStrictHostname() when senders are known to emit valid hostnames/IPs","Sanitize device hostnames (no underscores/special chars) at the source","Test representative lines against utils.IsValidHostnameOrIP before enabling strict mode"],"tags":["syslog","rfc5424","hostname","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}