{"record":{"id":"12c6b9302bfa41bc","repo":"crowdsecurity/crowdsec","slug":"pri-must-start-with-12c6b9","errorCode":null,"errorMessage":"PRI must start with '<'","messagePattern":"PRI must start with '<'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":47,"sourceCode":"const NIL_VALUE = '-'\n\nvar VALID_TIMESTAMPS = []string{\n\ttime.RFC3339,\n}\n\nconst VALID_TIMESTAMP = time.RFC3339Nano\n\nfunc WithStrictHostname() RFC5424Option {\n\treturn func(r *RFC5424) {\n\t\tr.strictHostname = true\n\t}\n}\n\nfunc (r *RFC5424) parsePRI() error {\n\tpri := 0\n\n\tif r.buf[r.position] != '<' {\n\t\treturn errors.New(\"PRI must start with '<'\")\n\t}\n\n\tr.position++\n\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == '>' {\n\t\t\tr.position++\n\t\t\tbreak\n\t\t}\n\t\tif c < '0' || c > '9' {\n\t\t\treturn errors.New(\"PRI must be a number\")\n\t\t}\n\t\tpri = pri*10 + int(c-'0')\n\t\tr.position++\n\t}\n\n\tif pri > 999 {","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L29-L65","documentation":"RFC5424 messages must begin with a PRI field enclosed in angle brackets, e.g. `<165>1 ...`. parsePRI checks the first byte of the buffer and throws this error if it is not '<', meaning the input does not look like an RFC5424 syslog message at all.","triggerScenarios":"Calling RFC5424.Parse on a message starting with anything other than '<': an RFC3164-format line fed to the RFC5424 parser, raw text without a PRI, a message whose PRI was already stripped by an upstream relay, or leading whitespace/BOM before '<'.","commonSituations":"Configuring the syslog acquisition with the wrong RFC version for the incoming format (clients sending BSD-style RFC3164 lines to an RFC5424 parser), a proxy stripping the `<PRI>` header, UTF-8 BOM bytes preceding the PRI, debugging with a raw log line pasted from a file.","solutions":["Verify the incoming format matches the parser: RFC5424 lines look like `<165>1 2023-... host app - - msg`; if messages look like `<34>Oct 11 ...` they are RFC3164 — use the RFC3164 parser/config instead","Ensure no relay/load balancer strips or rewrites the PRI header before the message reaches crowdsec","Strip BOM or leading whitespace from the input before parsing","Check the syslog client configuration to make sure it emits RFC5424 (e.g. `SyslogFormat` rfc5424 in rsyslog/rsyslog template or syslog-ng flags(syslog-protocol))"],"exampleFix":"// before\nrfc5424Parser.Parse([]byte(\"Oct 11 22:14:15 mymachine sshd: msg\")) // RFC3164-style\n// after\nrfc5424Parser.Parse([]byte(\"<34>1 2023-10-11T22:14:15.003Z mymachine sshd 1234 - msg\"))","handlingStrategy":"validation","validationCode":"func looksLikeRFC5424(msg []byte) bool {\n\treturn len(msg) > 0 && msg[0] == '<'\n}\n// choose parser based on format detection before calling Parse","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(msg); err != nil {\n\tif strings.Contains(err.Error(), \"PRI must start with '<'\") {\n\t\tlog.Debugf(\"non-RFC5424 message (missing <PRI>), dropping: %q\", msg)\n\t\treturn nil\n\t}\n\treturn err\n}","preventionTips":["Match the acquisition `format` config (rfc5424 vs rfc3164) to what your syslog clients actually send","Strip BOM/leading whitespace from input before parsing","Verify relays or TLS terminators are not stripping the PRI header","Sniff the first byte of incoming lines to auto-select the correct parser family"],"tags":["go","syslog","rfc5424","parsing","malformed-input"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}