{"record":{"id":"0a10f2d68efa056b","repo":"crowdsecurity/crowdsec","slug":"pid-inside-tag-must-be-closed-with","errorCode":null,"errorMessage":"pid inside tag must be closed with ']'","messagePattern":"pid inside tag must be closed with '\\]'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go","lineNumber":177,"sourceCode":"\t\thasPid = true\n\t\tr.position++\n\t\tfor r.position < r.len {\n\t\t\tc = r.buf[r.position]\n\t\t\tif c == ']' {\n\t\t\t\tpidEnd = true\n\t\t\t\tr.position++\n\t\t\t\tbreak\n\t\t\t}\n\t\t\tif c < '0' || c > '9' {\n\t\t\t\treturn errors.New(\"pid inside tag must be a number\")\n\t\t\t}\n\t\t\ttmpPid = append(tmpPid, c)\n\t\t\tr.position++\n\t\t}\n\t}\n\n\tif hasPid && !pidEnd {\n\t\treturn errors.New(\"pid inside tag must be closed with ']'\")\n\t}\n\n\tif hasPid {\n\t\tr.PID = string(tmpPid)\n\t}\n\treturn nil\n}\n\nfunc (r *RFC3164) parseMessage() error {\n\terr := r.parseTag()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif r.position == r.len {\n\t\treturn errors.New(\"message is empty\")\n\t}\n","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go#L159-L195","documentation":"RFC3164 syslog tags may embed a process ID in brackets, e.g. `sshd[1234]:`. The parser reads digits after the '[' and requires a closing ']' before the buffer ends. If input runs out while inside the bracket, parseTag throws this error.","triggerScenarios":"Calling RFC3164.Parse on a message whose tag contains '[' but the input ends before a ']' appears, e.g. `\"<34>Oct 11 22:14:15 host sshd[123\"` (truncated line, no ']' or trailing content).","commonSituations":"Truncated syslog lines from a network socket that cut mid-packet, log shippers or tailers chopping lines at buffer boundaries, hand-crafted test messages missing the ']', or a relay that strips trailing characters.","solutions":["Ensure the tag's PID bracket is closed: emit `tag[pid]:` not `tag[pid:` in the syslog producer","Check the source of the log line for truncation (socket timeouts, max-line-length settings in rsyslog/syslog-ng or the acquisition reader)","If the tag has no PID, remove the '[' entirely — a bare '[' after the tag always starts a PID section in this parser","Sanitize/validate lines before parsing: reject lines that end inside a bracket"],"exampleFix":"// before\nr.Parse([]byte(\"<34>Oct 11 22:14:15 mymachine sshd[1234\"))\n// after\nr.Parse([]byte(\"<34>Oct 11 22:14:15 mymachine sshd[1234]: session opened\"))","handlingStrategy":"validation","validationCode":"func hasUnclosedTagPid(line []byte) bool {\n\ti := bytes.IndexByte(line, '[')\n\tif i < 0 {\n\t\treturn false\n\t}\n\treturn !bytes.Contains(line[i+1:], []byte(\"]\"))\n}\n// skip or reject lines where hasUnclosedTagPid(msg) is true before Parse","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(msg); err != nil {\n\tif strings.Contains(err.Error(), \"must be closed with ']'\") {\n\t\tlog.Debugf(\"skipping truncated syslog line: %v\", err)\n\t\treturn nil\n\t}\n\treturn err\n}","preventionTips":["Set adequate max line lengths in syslog relays and the acquisition reader to avoid truncation","Validate syslog format at the emitting application, not only at parse time","Unit-test parser input with realistic complete lines including `tag[pid]:` form","Log the raw offending line when this error occurs to spot producers that truncate"],"tags":["go","syslog","rfc3164","parsing","malformed-input"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}