crowdsecurity/crowdsec · error

message is empty

Error message

message is empty

What it means

After successfully parsing the tag in an RFC3164 message, the parser expects at least one more character (the ':' separator and/or the message body). If the input ends exactly at the end of the tag, there is no message content, so parseMessage throws "message is empty".

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:193

	if hasPid && !pidEnd {
		return errors.New("pid inside tag must be closed with ']'")
	}

	if hasPid {
		r.PID = string(tmpPid)
	}
	return nil
}

func (r *RFC3164) parseMessage() error {
	err := r.parseTag()
	if err != nil {
		return err
	}

	if r.position == r.len {
		return errors.New("message is empty")
	}

	c := r.buf[r.position]

	if c == ':' {
		r.position++
	}

	for {
		if r.position >= r.len {
			return errors.New("message is empty")
		}
		c := r.buf[r.position]
		if c != ' ' {
			break
		}
		r.position++
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure the syslog producer sends a non-empty message after the tag: `tag[pid]: actual message text`
2. Truncate/blank lines at the acquisition source: filter empty-content lines before feeding them to Parse
3. If your source legitimately emits tag-only lines, skip them in caller code instead of parsing them
4. Check network/reader configuration (max line length, datagram size) that may cut the message portion

Example fix

// before
r.Parse([]byte("<34>Oct 11 22:14:15 mymachine sshd[1234]"))
// after
r.Parse([]byte("<34>Oct 11 22:14:15 mymachine sshd[1234]: Accepted password for user"))

func hasMessageAfterTag(line []byte) bool {
	// RFC3164: PRI + timestamp(15) + space + hostname + space + tag...
	// cheap check: at least one space-separated field count and non-empty tail
	return len(bytes.TrimSpace(line)) > 0 && bytes.Count(line, []byte(" ")) >= 3
}

if err := parser.Parse(msg); err != nil {
	if strings.Contains(err.Error(), "message is empty") {
		log.Debugf("ignoring tag-only syslog line: %q", msg)
		return nil
	}
	return err
}

When it happens

Trigger: Calling RFC3164.Parse on a message that contains only PRI + timestamp + hostname + tag with nothing after it, e.g. `"<34>Oct 11 22:14:15 mymachine sshd"` or `"<34>Oct 11 22:14:15 mymachine sshd[1234]"`.

Common situations: Producers emitting log lines with a tag but no content (empty log statement), truncated syslog datagrams (UDP payload cut at tag boundary), forwarding pipelines dropping the message part, test fixtures that stop at the tag.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• pid inside tag must be closed with ']'
• timestamp is not valid
• tag is empty
• pid inside tag must be a number
• PRI must start with '<'

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8abfbffe4edc8cbc. Report an issue: GitHub.