crowdsecurity/crowdsec · warning

EOL after hostname

Error message

EOL after hostname

What it means

RFC5424 parser guard: the message buffer ends immediately after the HOSTNAME field, so the required space-separated APP-NAME field (or at least its separator) is missing. Fires when position reaches the end of the buffer right after parsing HOSTNAME.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:335

		return errors.New("EOL after Version")
	}

	err = r.parseTimestamp()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after Timestamp")
	}

	err = r.parseHostname()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after hostname")
	}

	err = r.parseAppName()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after appname")
	}

	err = r.parseProcID()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after ProcID")

View on GitHub (pinned to 909b515798)

Solutions

1. Update/fix the emitting device or library so the full header is sent (appname, procid, msgid, SD, message)
2. Check for message truncation in the transport (UDP size limits, TCP close mid-line)
3. Fall back to lenient parsing (RFC3164 attempt or stripPRI) for these lines

Example fix

// before
line := "<13>1 2024-01-01T00:00:00Z myhost" // truncated
// after
line := "<13>1 2024-01-01T00:00:00Z myhost myapp - - - hello"

if err := p.Parse(line); err != nil {
    log.Printf("syslog line truncated after hostname: %q: %v", line, err)
    return
}

When it happens

Trigger: Parse() where parseHostname() succeeds and leaves r.position at r.len — e.g. '<13>1 2024-01-01T00:00:00Z myhost'.

Common situations: Sender truncates the message after hostname (some embedded devices emit incomplete RFC5424); TCP stream cut mid-header; hand-written test input missing the remaining SD elements.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• PRI must end with '>'
• version must be followed by a space
• EOL after timestamp
• EOL after PRI
• EOL after Version

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c6e173d83c4fde7f. Report an issue: GitHub.