crowdsecurity/crowdsec · error

appname is empty

Error message

appname is empty

What it means

Returned by parseAppName when the APPNAME field of an RFC5424 message parsed to zero bytes: the byte(s) between the hostname separator and the next space yielded no characters, and the field was not the NIL value '-' which is handled earlier.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:178

	if r.buf[r.position] == NIL_VALUE {
		r.Tag = ""
		r.position += 2
		return nil
	}

	appname := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++
			break
		}
		appname = append(appname, c)
		r.position++
	}

	if len(appname) == 0 {
		return errors.New("appname is empty")
	}

	if len(appname) > 48 {
		return errors.New("appname is too long")
	}

	r.Tag = string(appname)
	return nil
}

func (r *RFC5424) parseProcID() error {
	if r.buf[r.position] == NIL_VALUE {
		r.PID = ""
		r.position += 2
		return nil
	}

	procid := []byte{}

View on GitHub (pinned to 909b515798)

Solutions

1. Send '-' as APPNAME when the sender has no app name
2. Fix the sender to emit a non-empty APPNAME (PRINTUSASCII per RFC5424)
3. Validate outgoing messages with an RFC5424 linter before shipping

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:178 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a19c1606e6501fbb. Report an issue: GitHub.