crowdsecurity/crowdsec · warning

EOL after Timestamp

Error message

EOL after Timestamp

What it means

In the sequential RFC5424 Parse, after the timestamp is parsed the input must still contain the hostname field; end-of-buffer at this point means the message was truncated after TIMESTAMP (fewer than the required header fields), so parsing stops with this error.

Solutions

  1. Fix the sender to emit the full header: hostname, appname, procid, msgid, structured data, then message
  2. Check network path for datagram truncation (UDP payload limits, MTU)
  3. Use lenient parsing (stripPRI / DisableRFCParser) if truncated lines must still be ingested

Example fix

// before
line := "<13>1 2024-01-01T00:00:00Z" // truncated
// after
line := "<13>1 2024-01-01T00:00:00Z myhost myapp 1234 ID1 - hello"
Defensive patterns

Strategy: try-catch

Try / catch

if err := p.Parse(line); err != nil {
    log.Printf("syslog line truncated after timestamp: %q: %v", line, err)
    return
}

Prevention

When it happens

Trigger: Parse([]byte("<13>1 2024-01-01T00:00:00Z")) — parseTimestamp() succeeds and the cursor reaches the end of buffer.

Common situations: Truncated network transmission (UDP datagram cut, TCP stream terminated mid-line); a buggy sender that stops building the message after the timestamp; manual test strings missing later fields.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/401f8e001c19832a. Report an issue: GitHub.

Appendix: source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:326

		return errors.New("EOL after PRI")
	}

	err = r.parseVersion()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after Version")
	}

	err = r.parseTimestamp()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after Timestamp")
	}

	err = r.parseHostname()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after hostname")
	}

	err = r.parseAppName()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after appname")

View on GitHub (pinned to 909b515798)