crowdsecurity/crowdsec · warning

EOL after Timestamp

Error message

EOL after Timestamp

What it means

In the sequential RFC5424 Parse, after the timestamp is parsed the input must still contain the hostname field; end-of-buffer at this point means the message was truncated after TIMESTAMP (fewer than the required header fields), so parsing stops with this error.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:326

		return errors.New("EOL after PRI")
	}

	err = r.parseVersion()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after Version")
	}

	err = r.parseTimestamp()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after Timestamp")
	}

	err = r.parseHostname()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after hostname")
	}

	err = r.parseAppName()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after appname")

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the sender to emit the full header: hostname, appname, procid, msgid, structured data, then message
2. Check network path for datagram truncation (UDP payload limits, MTU)
3. Use lenient parsing (stripPRI / DisableRFCParser) if truncated lines must still be ingested

Example fix

// before
line := "<13>1 2024-01-01T00:00:00Z" // truncated
// after
line := "<13>1 2024-01-01T00:00:00Z myhost myapp 1234 ID1 - hello"

if err := p.Parse(line); err != nil {
    log.Printf("syslog line truncated after timestamp: %q: %v", line, err)
    return
}

When it happens

Trigger: Parse([]byte("<13>1 2024-01-01T00:00:00Z")) — parseTimestamp() succeeds and the cursor reaches the end of buffer.

Common situations: Truncated network transmission (UDP datagram cut, TCP stream terminated mid-line); a buggy sender that stops building the message after the timestamp; manual test strings missing later fields.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• PRI must end with '>'
• version must be followed by a space
• EOL after timestamp
• EOL after PRI
• EOL after Version

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/401f8e001c19832a. Report an issue: GitHub.