crowdsecurity/crowdsec · warning

EOL after Version

Error message

EOL after Version

What it means

Truncation guard in Parse: after successfully parsing the VERSION field, the input is already exhausted, so the mandatory TIMESTAMP field cannot be read. Indicates a header cut short after '<PRI>VERSION'.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:317

	}
	r.buf = message

	err := r.parsePRI()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after PRI")
	}

	err = r.parseVersion()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after Version")
	}

	err = r.parseTimestamp()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after Timestamp")
	}

	err = r.parseHostname()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after hostname")

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the sender to emit the complete header (timestamp at minimum, e.g. '<13>1 2024-01-01T00:00:00Z ...')
2. Increase UDP payload size / check for MTU or TCP truncation issues
3. If the truncated line should still be processed, set DisableRFCParser or use stripPRI-style lenient parsing

Example fix

// before
line := "<13>1" // truncated
// after
line := "<13>1 2024-01-01T00:00:00Z host app procid msgid - msg"

// naive check: header must contain at least PRI, version and a timestamp
func headerComplete(line []byte, minFields int) bool {
    return bytes.Count(line, []byte(" ")) >= minFields
}
if bytes.Count(line, []byte(" ")) < 2 { return errTruncated }

if err := p.Parse(line); err != nil {
    log.Printf("truncated syslog line %q: %v", line, err)
    return
}

When it happens

Trigger: Parse([]byte("<13>1")) or input where parseVersion() consumes to the end of the buffer and r.position >= r.len afterwards.

Common situations: A message cut off mid-header by TCP segmentation or a small UDP payload limit; a sender that emits an incomplete RFC5424 header; testing with hand-crafted partial strings.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• PRI must end with '>'
• version must be followed by a space
• EOL after timestamp
• EOL after PRI
• EOL after Timestamp

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6960418df12d48e4. Report an issue: GitHub.