crowdsecurity/crowdsec · warning · ParseError

message too short

Error message

message too short

What it means

stripPRI parses the RFC3164/5424 <PRI> priority prefix from a syslog message. When the received message is fewer than 3 bytes it cannot contain '<PRI>' so the source returns a ParseError with reason 'message too short', carrying the raw message for diagnostics. This guards the parser from indexing out of bounds on truncated datagrams.

Source

Thrown at pkg/acquisition/modules/syslog/run.go:169

func (e *ParseError) Fields() logrus.Fields {
	fields := logrus.Fields{
		"raw": string(e.RawMessage),
	}

	if e.RFC3164 != nil {
		fields["rfc3164_err"] = e.RFC3164.Error()
	}

	if e.RFC5424 != nil {
		fields["rfc5424_err"] = e.RFC5424.Error()
	}

	return fields
}

func stripPRI(msg []byte) (rest []byte, err error) {
	if len(msg) < 3 {
		return nil, &ParseError{Reason: errors.New("message too short"), RawMessage: msg}
	}

	if msg[0] != '<' {
		return nil, &ParseError{Reason: errors.New("missing PRI beginning"), RawMessage: msg}
	}

	end := bytes.Index(msg, []byte(">"))
	if end == -1 {
		return nil, &ParseError{Reason: errors.New("missing PRI end"), RawMessage: msg}
	}

	if end > 4 {
		return nil, &ParseError{Reason: errors.New("PRI too long"), RawMessage: msg}
	}

	for i := 1; i < end; i++ {
		if msg[i] < '0' || msg[i] > '9' {
			return nil, &ParseError{Reason: errors.New("PRI not a number"), RawMessage: msg}

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect the raw message in the ParseError to identify what peer/content sent the truncated line
2. Filter or drop empty/whitespace-only lines at the acquisition or forwarding layer before they reach crowdsec
3. Check the sending side for truncation or a misconfigured forwarder writing empty lines
4. Ignore if it's a network probe (scanner) hitting the syslog port

Example fix

// before: forwarder writes blank lines to syslog socket
logger.Printf("")
// after: skip empty messages before sending
if msg != "" { logger.Printf(msg) }

if len(msg) < 3 { /* skip or log before configuring the syslog source */ }
// at ops level: drop empty lines in forwarder
if strings.TrimSpace(line) == "" { continue }

When it happens

Trigger: parseLine hands stripPRI a message shorter than 3 characters, e.g. an empty or 1-2 byte UDP datagram, a line containing only whitespace/newline, or a truncated TCP stream fragment.

Common situations: Heartbeat/keepalive packets or empty lines sent to the syslog port; port scanners sending tiny probes; network fragmentation truncating datagrams; a forwarding rule (rsyslog, k8s, docker) emitting blank lines.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• timestamp is not valid
• tag is empty
• pid inside tag must be a number
• pid inside tag must be closed with ']'
• message is empty

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d261bf97d4eb607d. Report an issue: GitHub.