crowdsecurity/crowdsec · warning

EOL after MSGID

Error message

EOL after MSGID

What it means

The line ended immediately after the MSGID, before the structured data. RFC5424 mandates STRUCTURED-DATA (or '-') after MSGID, so input like '<13>1 <ts> host app proc msgid' is truncated and rejected.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:362

		return errors.New("EOL after appname")
	}

	err = r.parseProcID()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after ProcID")
	}

	err = r.parseMsgID()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after MSGID")
	}

	err = r.parseStructuredData()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after SD")
	}

	err = r.parseMessage()
	if err != nil {
		return err
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the sender to append STRUCTURED-DATA ('-' if none) and the message after it
2. Verify no intermediary truncates lines (TCP framing, UDP size)
3. Fall back to RFC3164 parsing or lenient PRI stripping for these lines

Example fix

// before
line := "<13>1 2024-01-01T00:00:00Z host app 1234 ID47" // truncated
// after
line := "<13>1 2024-01-01T00:00:00Z host app 1234 ID47 - hello world"

if err := p.Parse(line); err != nil {
    log.Printf("syslog line truncated after msgid: %q: %v", line, err)
    return
}

When it happens

Trigger: Parse() where parseMsgID() succeeds leaving r.position at r.len, e.g. '<13>1 2024-01-01T00:00:00Z host app 1234 ID47'.

Common situations: Transport truncation; senders that stop after the MSGID thinking the message part is optional (it is not here — parseMessage errors on an empty remainder too); incomplete manual test strings.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• PRI must end with '>'
• version must be followed by a space
• EOL after timestamp
• EOL after PRI
• EOL after Version

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/42426a0a66ac5590. Report an issue: GitHub.