crowdsecurity/crowdsec · error

hostname is empty

Error message

hostname is empty

What it means

Returned by parseHostname when the hostname field of an RFC5424 header was parsed to zero bytes — the character between the timestamp and the next space is missing (e.g. two consecutive spaces), so the hostname SD element is empty rather than the RFC5424 NIL value '-'.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:153

	}

	hostname := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++
			break
		}
		hostname = append(hostname, c)
		r.position++
	}
	if r.strictHostname {
		if !utils.IsValidHostnameOrIP(string(hostname)) {
			return errors.New("hostname is not valid")
		}
	}
	if len(hostname) == 0 {
		return errors.New("hostname is empty")
	}
	r.Hostname = string(hostname)
	return nil
}

func (r *RFC5424) parseAppName() error {
	if r.buf[r.position] == NIL_VALUE {
		r.Tag = ""
		r.position += 2
		return nil
	}

	appname := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++
			break

View on GitHub (pinned to 909b515798)

Solutions

1. Send the RFC5424 NIL value '-' in the HOSTNAME field when there is no hostname
2. Fix the emitting syslog client to always send a non-empty hostname between TIMESTAMP and APP-NAME
3. If the source is a non-RFC5424 formatter, use a parser matching its actual format

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:153 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/512a668142112fbd. Report an issue: GitHub.