crowdsecurity/crowdsec · error

msgid is empty

Error message

msgid is empty

What it means

parseMsgID scans the MSGID field up to the next space; reaching end of buffer with zero characters collected (and no NILVALUE '-') means the mandatory MSGID is absent, so the message violates RFC 5424.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:238

	if r.buf[r.position] == NIL_VALUE {
		r.MsgID = ""
		r.position += 2
		return nil
	}

	msgid := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++
			break
		}
		msgid = append(msgid, c)
		r.position++
	}

	if len(msgid) == 0 {
		return errors.New("msgid is empty")
	}

	if len(msgid) > 32 {
		return errors.New("msgid is too long")
	}

	r.MsgID = string(msgid)
	return nil
}

func (r *RFC5424) parseStructuredData() error {
	done := false
	if r.buf[r.position] == NIL_VALUE {
		r.position += 2
		return nil
	}
	if r.buf[r.position] != '[' {
		return errors.New("structured data must start with '[' or be '-'")

View on GitHub (pinned to 909b515798)

Solutions

1. Send '-' as MSGID when the sender has no message ID
2. Fix the sender to emit a non-empty MSGID or the NIL value

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:238 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/40fa3baebc0cc431. Report an issue: GitHub.