{"record":{"id":"160eb7556b4f156c","repo":"crowdsecurity/crowdsec","slug":"missing-pri-beginning","errorCode":null,"errorMessage":"missing PRI beginning","messagePattern":"missing PRI beginning","errorType":"validation","errorClass":"ParseError","httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/run.go","lineNumber":173,"sourceCode":"\n\tif e.RFC3164 != nil {\n\t\tfields[\"rfc3164_err\"] = e.RFC3164.Error()\n\t}\n\n\tif e.RFC5424 != nil {\n\t\tfields[\"rfc5424_err\"] = e.RFC5424.Error()\n\t}\n\n\treturn fields\n}\n\nfunc stripPRI(msg []byte) (rest []byte, err error) {\n\tif len(msg) < 3 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"message too short\"), RawMessage: msg}\n\t}\n\n\tif msg[0] != '<' {\n\t\treturn nil, &ParseError{Reason: errors.New(\"missing PRI beginning\"), RawMessage: msg}\n\t}\n\n\tend := bytes.Index(msg, []byte(\">\"))\n\tif end == -1 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"missing PRI end\"), RawMessage: msg}\n\t}\n\n\tif end > 4 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"PRI too long\"), RawMessage: msg}\n\t}\n\n\tfor i := 1; i < end; i++ {\n\t\tif msg[i] < '0' || msg[i] > '9' {\n\t\t\treturn nil, &ParseError{Reason: errors.New(\"PRI not a number\"), RawMessage: msg}\n\t\t}\n\t}\n\n\treturn msg[end+1:], nil","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/run.go#L155-L191","documentation":"stripPRI expects every syslog message to start with '<' opening the PRI priority field. If the first byte is not '<' the message is not valid syslog framing, so a ParseError 'missing PRI beginning' is returned with the raw message attached.","triggerScenarios":"parseLine receives a message whose first byte is not '<': plain-text lines without a PRI header forwarded to the syslog datasource.","commonSituations":"A forwarder configured to send raw application text instead of RFC3164/5424-framed messages; JSON lines or logfmt sent directly to the syslog port; a device with 'PRI-less' syslog mode enabled.","solutions":["Enable PRI framing / RFC3164 or RFC5424 mode on the sending device or forwarder","Send non-syslog text through a proper syslog emitter (logger, rsyslog, syslog-ng) instead of raw TCP/UDP","Use a file or journal datasource for plain-text logs instead of the syslog source","Check the raw message in the ParseError to identify the offending producer"],"exampleFix":"// before: raw text to syslog port\necho \"plain message\" | nc -u host 514\n// after\nlogger -t myapp \"plain message\"","handlingStrategy":"validation","validationCode":"if !strings.HasPrefix(msg, \"<\") { /* route to plain-text datasource instead */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use RFC3164/5424-compliant emitters (logger, rsyslog, syslog-ng)","Don't pipe raw application text to the syslog port","Verify device syslog framing mode is enabled"],"tags":["syslog","parsing","format"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}