crowdsecurity/crowdsec · error

procid is too long

Error message

procid is too long

What it means

RFC5424 parser guard: the PROCID field exceeded the 128-byte maximum length permitted by the syslog spec. The parser reads PROCID up to the next space and rejects values longer than 128 characters, which indicates a malformed or non-conforming sender.

Solutions

  1. Shorten the PROCID emitted by the syslog client to at most 128 characters
  2. Verify space separation between PROCID and MSGID fields
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:212 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c66966aa018ad199. Report an issue: GitHub.

Appendix: source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:212

	}

	procid := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++
			break
		}
		procid = append(procid, c)
		r.position++
	}

	if len(procid) == 0 {
		return errors.New("procid is empty")
	}

	if len(procid) > 128 {
		return errors.New("procid is too long")
	}

	r.PID = string(procid)
	return nil
}

func (r *RFC5424) parseMsgID() error {
	if r.buf[r.position] == NIL_VALUE {
		r.MsgID = ""
		r.position += 2
		return nil
	}

	msgid := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++

View on GitHub (pinned to 909b515798)