What causes "syslog line is empty" in crowdsecurity/crowdsec?

Fix the sender so it does not emit empty datagrams or bare newlines to the syslog socket

syslog line is empty

Error message

syslog line is empty

What it means

The RFC5424 parser's Parse() method received a zero-length byte slice. An empty line carries no PRI, version, or any other syslog field, so there is nothing to parse and the parser fails immediately before touching the buffer.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:298

	if r.position == r.len {
		return errors.New("message is empty")
	}

	message := []byte{}

	for r.position < r.len {
		c := r.buf[r.position]
		message = append(message, c)
		r.position++
	}
	r.Message = string(message)
	return nil
}

func (r *RFC5424) Parse(message []byte) error {
	r.len = len(message)
	if r.len == 0 {
		return errors.New("syslog line is empty")
	}
	r.buf = message

	err := r.parsePRI()
	if err != nil {
		return err
	}

	if r.position >= r.len {
		return errors.New("EOL after PRI")
	}

	err = r.parseVersion()
	if err != nil {
		return err
	}

	if r.position >= r.len {

View on GitHub (pinned to 909b515798)

Solutions

Fix the sender so it does not emit empty datagrams or bare newlines to the syslog socket
Skip/ignore empty lines in the ingestion layer before handing them to the RFC5424 parser
If parsing manually, check len(message) == 0 and short-circuit instead of calling Parse

Example fix

// before
p := rfc5424.NewRFC5424Parser()
err := p.Parse(line) // panics-free but errors on empty line
// after
if len(line) == 0 {
    return nil // skip blank line
}
err := p.Parse(line)

Defensive patterns

Strategy: validation

Validate before calling

if len(line) == 0 {
    return nil // skip empty line before calling Parse
}

Prevention

Filter blank lines at the socket/reader layer before parsing
In tests, never pass nil or empty slices to Parse
Monitor your syslog source for empty datagrams — they indicate a misbehaving sender

When it happens

Trigger: Calling (*RFC5424).Parse(nil) or Parse([]byte("")). In the syslog source this happens when the syslog server delivers an empty datagram or a line consisting only of the newline terminator.

Common situations: A sender (log shipper, network device, test client) writes an empty UDP packet or a bare '\n' to the syslog socket; a custom acquisition pipeline feeding blank lines; reading from a socket that delivered an empty frame on connect.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c036c3536e12e04d. Report an issue: GitHub.