crowdsecurity/crowdsec · error

procid is too long

Error message

procid is too long

What it means

RFC5424 parser guard: the PROCID field exceeded the 128-byte maximum length permitted by the syslog spec. The parser reads PROCID up to the next space and rejects values longer than 128 characters, which indicates a malformed or non-conforming sender.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:212

	}

	procid := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++
			break
		}
		procid = append(procid, c)
		r.position++
	}

	if len(procid) == 0 {
		return errors.New("procid is empty")
	}

	if len(procid) > 128 {
		return errors.New("procid is too long")
	}

	r.PID = string(procid)
	return nil
}

func (r *RFC5424) parseMsgID() error {
	if r.buf[r.position] == NIL_VALUE {
		r.MsgID = ""
		r.position += 2
		return nil
	}

	msgid := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++

View on GitHub (pinned to 909b515798)

Solutions

1. Shorten the PROCID emitted by the syslog client to at most 128 characters
2. Verify space separation between PROCID and MSGID fields

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:212 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c66966aa018ad199. Report an issue: GitHub.