crowdsecurity/crowdsec · warning

EOL after ProcID

Error message

EOL after ProcID

What it means

RFC5424 parser guard: the message buffer ends immediately after the PROCID field, so the required MSGID field is missing. Fires when position reaches the end of the buffer right after parsing PROCID.

Solutions

  1. Fix the sender to complete the header — MSGID and STRUCTURED-DATA may both be '-'
  2. Check for truncation at relays/proxies or UDP payload limits
  3. Parse leniently (stripPRI) if these lines should still be ingested

Example fix

// before
line := "<13>1 2024-01-01T00:00:00Z host app 1234" // truncated
// after
line := "<13>1 2024-01-01T00:00:00Z host app 1234 ID47 - hello"
Defensive patterns

Strategy: try-catch

Try / catch

if err := p.Parse(line); err != nil {
    log.Printf("syslog line truncated after procid: %q: %v", line, err)
    return
}

Prevention

When it happens

Trigger: Parse() where parseProcID() succeeds and the cursor reaches r.len, e.g. '<13>1 2024-01-01T00:00:00Z host app 1234'.

Common situations: Message cut off in transport; sender bug producing partial headers; crafted test inputs that omit the trailing fields.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5ff4c884f37747ef. Report an issue: GitHub.

Appendix: source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:353

		return errors.New("EOL after hostname")
	}

	err = r.parseAppName()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after appname")
	}

	err = r.parseProcID()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after ProcID")
	}

	err = r.parseMsgID()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after MSGID")
	}

	err = r.parseStructuredData()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after SD")

View on GitHub (pinned to 909b515798)