crowdsecurity/crowdsec · warning · ParseError

message too short

Error message

message too short

What it means

stripPRI parses the RFC3164/5424 <PRI> priority prefix from a syslog message. When the received message is fewer than 3 bytes it cannot contain '<PRI>' so the source returns a ParseError with reason 'message too short', carrying the raw message for diagnostics. This guards the parser from indexing out of bounds on truncated datagrams.

Solutions

1. Inspect the raw message in the ParseError to identify what peer/content sent the truncated line
2. Filter or drop empty/whitespace-only lines at the acquisition or forwarding layer before they reach crowdsec
3. Check the sending side for truncation or a misconfigured forwarder writing empty lines
4. Ignore if it's a network probe (scanner) hitting the syslog port

Example fix

// before: forwarder writes blank lines to syslog socket
logger.Printf("")
// after: skip empty messages before sending
if msg != "" { logger.Printf(msg) }

if len(msg) < 3 { /* skip or log before configuring the syslog source */ }
// at ops level: drop empty lines in forwarder
if strings.TrimSpace(line) == "" { continue }

When it happens

Trigger: parseLine hands stripPRI a message shorter than 3 characters, e.g. an empty or 1-2 byte UDP datagram, a line containing only whitespace/newline, or a truncated TCP stream fragment.

Common situations: Heartbeat/keepalive packets or empty lines sent to the syslog port; port scanners sending tiny probes; network fragmentation truncating datagrams; a forwarding rule (rsyslog, k8s, docker) emitting blank lines.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• EOL after appname
• EOL after hostname
• EOL after MSGID
• EOL after PRI
• EOL after ProcID

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d261bf97d4eb607d. Report an issue: GitHub.

Appendix: source

Thrown at pkg/acquisition/modules/syslog/run.go:169

func (e *ParseError) Fields() logrus.Fields {
	fields := logrus.Fields{
		"raw": string(e.RawMessage),
	}

	if e.RFC3164 != nil {
		fields["rfc3164_err"] = e.RFC3164.Error()
	}

	if e.RFC5424 != nil {
		fields["rfc5424_err"] = e.RFC5424.Error()
	}

	return fields
}

func stripPRI(msg []byte) (rest []byte, err error) {
	if len(msg) < 3 {
		return nil, &ParseError{Reason: errors.New("message too short"), RawMessage: msg}
	}

	if msg[0] != '<' {
		return nil, &ParseError{Reason: errors.New("missing PRI beginning"), RawMessage: msg}
	}

	end := bytes.Index(msg, []byte(">"))
	if end == -1 {
		return nil, &ParseError{Reason: errors.New("missing PRI end"), RawMessage: msg}
	}

	if end > 4 {
		return nil, &ParseError{Reason: errors.New("PRI too long"), RawMessage: msg}
	}

	for i := 1; i < end; i++ {
		if msg[i] < '0' || msg[i] > '9' {
			return nil, &ParseError{Reason: errors.New("PRI not a number"), RawMessage: msg}

View on GitHub (pinned to 909b515798)