crowdsecurity/crowdsec · error

hostname is not valid

Error message

hostname is not valid

What it means

When the parser is constructed with the WithStrictHostname option, parseHostname validates the collected hostname with utils.IsValidHostnameOrIP. If the field between the timestamp and appname is neither a valid hostname nor a valid IP, the parser rejects the line instead of accepting an arbitrary PRINTUSASCII token.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:149

	if r.buf[r.position] == NIL_VALUE {
		r.Hostname = ""
		r.position += 2
		return nil
	}

	hostname := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++
			break
		}
		hostname = append(hostname, c)
		r.position++
	}
	if r.strictHostname {
		if !utils.IsValidHostnameOrIP(string(hostname)) {
			return errors.New("hostname is not valid")
		}
	}
	if len(hostname) == 0 {
		return errors.New("hostname is empty")
	}
	r.Hostname = string(hostname)
	return nil
}

func (r *RFC5424) parseAppName() error {
	if r.buf[r.position] == NIL_VALUE {
		r.Tag = ""
		r.position += 2
		return nil
	}

	appname := []byte{}
	for r.position < r.len {

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the sender to emit a valid RFC 1123 hostname or IP in the hostname field (no underscores or special characters).
2. Drop WithStrictHostname() and construct the parser with NewRFC5424Parser() if you must accept arbitrary hostname tokens.
3. Log the offending hostname value and check utils.IsValidHostnameOrIP against it to understand which rule fails.

Example fix

// before (underscore hostname, strict mode)
p := rfc5424.NewRFC5424Parser(rfc5424.WithStrictHostname())
p.Parse([]byte("<34>1 2024-01-01T00:00:00Z my_host app 1 - msg"))
// after (valid hostname)
p.Parse([]byte("<34>1 2024-01-01T00:00:00Z my-host.example.com app 1 - msg"))
// or relax:
p := rfc5424.NewRFC5424Parser()

// Go: pre-check the hostname token when strict mode is on
func hostnameLooksValid(line []byte) bool {
	parts := bytes.SplitN(line, []byte(" "), 5)
	if len(parts) < 5 {
		return false
	}
	h := string(parts[3])
	return h == "-" || net.ParseIP(h) != nil ||
		(reValidHost.MatchString(h)) // e.g. ^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$
}

if err := parser.Parse(line); err != nil {
	if strings.Contains(err.Error(), "hostname is not valid") {
		// fix sender hostname or construct parser without WithStrictHostname()
	}
}

When it happens

Trigger: Calling NewRFC5424Parser(WithStrictHostname()) then Parse on a header whose hostname field contains characters like '_', '@', '/', or is an FQDN label the validator rejects, e.g. "<34>1 2024-01-01T00:00:00Z my_host@! app 1 - msg".

Common situations: Devices emitting Windows-style hostnames with underscores, relays injecting placeholder tokens, or misconfigured syslog templates putting the tag/appname into the hostname slot.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• hostname is not valid
• hostname is empty
• PRI must start with '<'
• PRI must be a number
• PRI must be up to 3 characters long

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e5679c403b714db2. Report an issue: GitHub.