From c9fc8079c4ffb3ba57b722a8119bf0b1a997b306 Mon Sep 17 00:00:00 2001
From: Aliaksandr Valialkin <valyala@victoriametrics.com>
Date: Fri, 28 Jun 2024 14:09:26 +0200
Subject: [PATCH] app/vlinsert/syslog: properly skip empty lines in Syslog
 protocol

Updates https://github.com/VictoriaMetrics/VictoriaMetrics/issues/6548
---
 app/vlinsert/syslog/syslog.go      | 5 +++++
 app/vlinsert/syslog/syslog_test.go | 9 +++++++++
 docs/VictoriaLogs/CHANGELOG.md     | 2 ++
 3 files changed, 16 insertions(+)

diff --git a/app/vlinsert/syslog/syslog.go b/app/vlinsert/syslog/syslog.go
index 0a4f7cb036..935c6b7ee8 100644
--- a/app/vlinsert/syslog/syslog.go
+++ b/app/vlinsert/syslog/syslog.go
@@ -405,6 +405,7 @@ func (slr *syslogLineReader) nextLine() bool {
 		return false
 	}
 
+again:
 	prefix, err := slr.br.ReadSlice(' ')
 	if err != nil {
 		if err != io.EOF {
@@ -420,6 +421,10 @@ func (slr *syslogLineReader) nextLine() bool {
 	for len(prefix) > 0 && prefix[0] == '\n' {
 		prefix = prefix[1:]
 	}
+	if len(prefix) == 0 {
+		// An empty prefix or a prefix with empty lines - try reading yet another prefix.
+		goto again
+	}
 
 	if prefix[0] >= '0' && prefix[0] <= '9' {
 		// This is octet-counting method. See https://www.ietf.org/archive/id/draft-gerhards-syslog-plain-tcp-07.html#msgxfer
diff --git a/app/vlinsert/syslog/syslog_test.go b/app/vlinsert/syslog/syslog_test.go
index e984d197a8..7eb329b852 100644
--- a/app/vlinsert/syslog/syslog_test.go
+++ b/app/vlinsert/syslog/syslog_test.go
@@ -30,10 +30,19 @@ func TestSyslogLineReader_Success(t *testing.T) {
 	}
 
 	f("", nil)
+	f("\n", nil)
+	f("\n\n\n", nil)
+
 	f("foobar", []string{"foobar"})
+	f("foobar\n", []string{"foobar\n"})
+	f("\n\nfoo\n\nbar\n\n", []string{"foo\n\nbar\n\n"})
+
+	f(`Jun  3 12:08:33 abcd systemd: Starting Update the local ESM caches...`, []string{"Jun  3 12:08:33 abcd systemd: Starting Update the local ESM caches..."})
 
 	f(`Jun  3 12:08:33 abcd systemd: Starting Update the local ESM caches...
+
 48 <165>Jun  4 12:08:33 abcd systemd[345]: abc defg<123>1 2023-06-03T17:42:12.345Z mymachine.example.com appname 12345 ID47 [exampleSDID@32473 iut="3" eventSource="Application 123 = ] 56" eventID="11211"] This is a test message with structured data.
+
 `, []string{
 		"Jun  3 12:08:33 abcd systemd: Starting Update the local ESM caches...",
 		"<165>Jun  4 12:08:33 abcd systemd[345]: abc defg",
diff --git a/docs/VictoriaLogs/CHANGELOG.md b/docs/VictoriaLogs/CHANGELOG.md
index eefa66c362..7b66f16e2b 100644
--- a/docs/VictoriaLogs/CHANGELOG.md
+++ b/docs/VictoriaLogs/CHANGELOG.md
@@ -21,6 +21,8 @@ according to [these docs](https://docs.victoriametrics.com/victorialogs/quicksta
 
 * FEATURE: add ability to return top `N` `"fields"` groups from  [`/select/logsql/hits` HTTP endpoint](https://docs.victoriametrics.com/victorialogs/querying/#querying-hits-stats), by specifying `fields_limit=N` query arg. This query arg is going to be used in [this feature request](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/6545).
 
+* BUGFIX: fix `runtime error: index out of range [0] with length 0` panic when empty lines are ingested via [Syslog format](https://docs.victoriametrics.com/victorialogs/data-ingestion/syslog/) by Cisco controllers. See [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/6548).
+
 ## [v0.24.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v0.24.0-victorialogs)
 
 Released at 2024-06-27