crowdsecurity/crowdsec · error

appname is too long

Error message

appname is too long

What it means

Returned by parseAppName when the APPNAME field exceeds 48 characters, the maximum length CrowdSec's RFC5424 parser accepts for this field. The field is read up to the next space, so an over-long token (often a misformatted message where a later field spills into APPNAME) triggers it.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:182

	}

	appname := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++
			break
		}
		appname = append(appname, c)
		r.position++
	}

	if len(appname) == 0 {
		return errors.New("appname is empty")
	}

	if len(appname) > 48 {
		return errors.New("appname is too long")
	}

	r.Tag = string(appname)
	return nil
}

func (r *RFC5424) parseProcID() error {
	if r.buf[r.position] == NIL_VALUE {
		r.PID = ""
		r.position += 2
		return nil
	}

	procid := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++

View on GitHub (pinned to 909b515798)

Solutions

1. Shorten the APPNAME emitted by the syslog client to at most 48 characters
2. Check that earlier header fields are properly space-separated so APPNAME doesn't absorb following fields

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:182 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ec3c8ca48b9b4222. Report an issue: GitHub.