crowdsecurity/crowdsec · warning

EOL after appname

Error message

EOL after appname

What it means

RFC5424 parser guard: the message buffer ends immediately after the APP-NAME field, so the required PROCID field is missing. Fires when position reaches the end of the buffer right after parsing APP-NAME.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:344

		return errors.New("EOL after Timestamp")
	}

	err = r.parseHostname()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after hostname")
	}

	err = r.parseAppName()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after appname")
	}

	err = r.parseProcID()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after ProcID")
	}

	err = r.parseMsgID()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after MSGID")

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the sender to include the complete header including PROCID and MSGID ('-' is a valid nil value)
2. Inspect intermediate proxies/relays for message truncation
3. Handle the error and retry with the RFC3164 parser or lenient PRI-stripping

Example fix

// before
line := "<13>1 2024-01-01T00:00:00Z host myapp" // truncated
// after
line := "<13>1 2024-01-01T00:00:00Z host myapp 1234 - - hello"

if err := p.Parse(line); err != nil {
    log.Printf("syslog line truncated after appname: %q: %v", line, err)
    return
}

When it happens

Trigger: Parse() where parseAppName() consumes through end of buffer, e.g. '<13>1 2024-01-01T00:00:00Z host myapp'.

Common situations: Truncated transmission; sender emits only a partial RFC5424 header; a proxy in the middle cutting messages; manual testing with incomplete strings.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• PRI must end with '>'
• version must be followed by a space
• EOL after timestamp
• EOL after PRI
• EOL after Version

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c994646f5aa41a3b. Report an issue: GitHub.