crowdsecurity/crowdsec · error

hostname is not valid

Error message

hostname is not valid

What it means

parseHostname reads bytes up to the next space as the hostname, and when the parser is created with the WithStrictHostname() option it validates that value with utils.IsValidHostnameOrIP. If the field contains characters that make it neither a valid hostname nor an IP, it returns 'hostname is not valid'. It exists because strict mode guarantees only well-formed hostnames/IPs end up in RFC3164.Hostname.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:124

	}
	r.position++
	return nil
}

func (r *RFC3164) parseHostname() error {
	hostname := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++
			break
		}
		hostname = append(hostname, c)
		r.position++
	}
	if r.strictHostname {
		if !utils.IsValidHostnameOrIP(string(hostname)) {
			return errors.New("hostname is not valid")
		}
	}
	if len(hostname) == 0 {
		return errors.New("hostname is empty")
	}
	r.Hostname = string(hostname)
	return nil
}

//We do not enforce tag len as quite a lot of syslog client send tags with more than 32 chars
func (r *RFC3164) parseTag() error {
	tag := []byte{}
	tmpPid := []byte{}
	pidEnd := false
	hasPid := false
	for r.position < r.len {
		c := r.buf[r.position]
		if !utils.IsAlphaNumeric(c) {

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect the offending message's token after the timestamp and check it with utils.IsValidHostnameOrIP to see exactly why it fails.
2. Drop the WithStrictHostname() option if your sources emit non-RFC-compliant hostnames (underscores, placeholders) and you do not need strict validation.
3. Fix the sending device or add a relay/rewrite so it emits a valid hostname or IP as the third field.
4. Ensure the hostname field is present in the message; a missing hostname makes the tag text be read as hostname and fail validation.
5. Update the acquisition source configuration so messages from that device are not routed through this strict parser.

Example fix

// before
parser := NewRFC3164Parser(WithStrictHostname())
parser.Parse([]byte("<34>Feb  3 09:12:01 my_host sshd[123]: msg")) // hostname is not valid

// after: remove strict mode for non-RFC hostnames
parser := NewRFC3164Parser()
parser.Parse([]byte("<34>Feb  3 09:12:01 my_host sshd[123]: msg"))

func hostnameTokenLooksValid(msg string) bool {
	// hostname is the token right after PRI + timestamp (32 chars for 'Jan 02 15:04:05')
	const tsLen = len("Jan 02 15:04:05")
	start := 1 + len("<34>") + tsLen + 1
	if len(msg) <= start { return false }
	rest := msg[start:]
	tok := rest
	if i := strings.IndexByte(rest, ' '); i >= 0 { tok = rest[:i] }
	return utils.IsValidHostnameOrIP(tok)
}

func isPlausibleHostname(s string) bool {
	if s == "" || len(s) > 255 { return false }
	for _, c := range s {
		if !(c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' || c == '-' || c == '.') {
			return false
		}
	}
	return true
}

if err := parser.Parse(line); err != nil {
	if strings.Contains(err.Error(), "hostname is not valid") {
		log.Warnf("non-RFC hostname in %q, dropping strict mode or rejecting", line)
	}
}

When it happens

Trigger: Calling Parse (after NewRFC3164Parser(WithStrictHostname())) on a message whose token after the timestamp is not a valid hostname or IP: spaces are absent so the whole remaining text is grabbed, or the token contains characters like '_', '/', '#', trailing punctuation, or a bare label like '-' .

Common situations: Messages missing the hostname field entirely so the tag text ('sshd[123]:...') is parsed as the hostname and rejected; devices emitting hostnames with underscores (invalid per RFC but common); relay servers that substitute a placeholder like '-' or '[unknown]'; enabling WithStrictHostname after previously accepting lax input.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• hostname is empty
• hostname is not valid
• timestamp is not valid
• tag is empty
• pid inside tag must be a number

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a6cbb2f1842298b2. Report an issue: GitHub.