{"record":{"id":"315e9b24dcbde0b8","repo":"crowdsecurity/crowdsec","slug":"pri-must-start-with","errorCode":null,"errorMessage":"PRI must start with '<'","messagePattern":"PRI must start with '<'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go","lineNumber":54,"sourceCode":"}\n\nfunc WithCurrentYear() RFC3164Option {\n\treturn func(r *RFC3164) {\n\t\tr.useCurrentYear = true\n\t}\n}\n\nfunc WithStrictHostname() RFC3164Option {\n\treturn func(r *RFC3164) {\n\t\tr.strictHostname = true\n\t}\n}\n\nfunc (r *RFC3164) parsePRI() error {\n\tpri := 0\n\n\tif r.buf[r.position] != '<' {\n\t\treturn errors.New(\"PRI must start with '<'\")\n\t}\n\n\tr.position++\n\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == '>' {\n\t\t\tr.position++\n\t\t\tbreak\n\t\t}\n\t\tif c < '0' || c > '9' {\n\t\t\treturn errors.New(\"PRI must be a number\")\n\t\t}\n\t\tpri = pri*10 + int(c-'0')\n\t\tr.position++\n\t}\n\n\tif pri > 999 {","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go#L36-L72","documentation":"Validation in the RFC3164 syslog parser's parsePRI (called from Parse): the first character of the message is not '<'. RFC 3164 requires the PRI part to be an angle-bracket-delimited priority value at the very start of the datagram; anything else means the payload is not an RFC3164 message.","triggerScenarios":"Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:54 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure senders emit '<PRI>TIMESTAMP HOST TAG: MSG' with the leading '<'","If the source emits RFC5424 or plain text, configure the syslog datasource to use the right parser/format instead of RFC3164","Check for a stray prefix (BOM, newline) injected before the priority by a proxy or load balancer"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}