crowdsecurity/crowdsec · warning

EOL after SD

Error message

EOL after SD

What it means

The line ended right after the structured data with no free-form message following. After parsing SD, the parser requires a non-empty MSG portion (parseMessage returns 'message is empty' only at exact end; this check catches the same truncated shape). Input like '<13>1 <ts> host app proc msgid [x@1 y]' is rejected.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:371

		return errors.New("EOL after ProcID")
	}

	err = r.parseMsgID()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after MSGID")
	}

	err = r.parseStructuredData()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after SD")
	}

	err = r.parseMessage()
	if err != nil {
		return err
	}

	return nil
}

func NewRFC5424Parser(opts ...RFC5424Option) *RFC5424 {
	r := &RFC5424{}
	for _, opt := range opts {
		opt(r)
	}
	return r
}

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the sender to include the actual message after the structured data
2. If events legitimately have no message, skip or ignore them upstream rather than parsing
3. Check relays/proxies that may strip message content

Example fix

// before
line := "<13>1 2024-01-01T00:00:00Z host app 1234 ID47 [exampleSDID@32473 iUT]" // no msg
// after
line := "<13>1 2024-01-01T00:00:00Z host app 1234 ID47 [exampleSDID@32473 iUT] something happened"

if err := p.Parse(line); err != nil {
    log.Printf("syslog line has no message after SD: %q: %v", line, err)
    return
}

When it happens

Trigger: Parse() where parseStructuredData() consumes the rest of the buffer and r.position >= r.len, e.g. '<13>1 2024-01-01T00:00:00Z host app 1234 ID47 -' followed by nothing (with the cursor past end rather than exactly at the SD terminator).

Common situations: Sender emits the full header but no message content (empty syslog event); transport drops the trailing message; a relay strips the message body.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• PRI must end with '>'
• version must be followed by a space
• EOL after timestamp
• EOL after PRI
• EOL after Version

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d264d60aa5ef6908. Report an issue: GitHub.