{"record":{"id":"348dc58013f15d4b","repo":"crowdsecurity/crowdsec","slug":"missing-pri-end","errorCode":null,"errorMessage":"missing PRI end","messagePattern":"missing PRI end","errorType":"validation","errorClass":"ParseError","httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/run.go","lineNumber":178,"sourceCode":"\tif e.RFC5424 != nil {\n\t\tfields[\"rfc5424_err\"] = e.RFC5424.Error()\n\t}\n\n\treturn fields\n}\n\nfunc stripPRI(msg []byte) (rest []byte, err error) {\n\tif len(msg) < 3 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"message too short\"), RawMessage: msg}\n\t}\n\n\tif msg[0] != '<' {\n\t\treturn nil, &ParseError{Reason: errors.New(\"missing PRI beginning\"), RawMessage: msg}\n\t}\n\n\tend := bytes.Index(msg, []byte(\">\"))\n\tif end == -1 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"missing PRI end\"), RawMessage: msg}\n\t}\n\n\tif end > 4 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"PRI too long\"), RawMessage: msg}\n\t}\n\n\tfor i := 1; i < end; i++ {\n\t\tif msg[i] < '0' || msg[i] > '9' {\n\t\t\treturn nil, &ParseError{Reason: errors.New(\"PRI not a number\"), RawMessage: msg}\n\t\t}\n\t}\n\n\treturn msg[end+1:], nil\n}\n\nfunc (s *Source) parseLine(syslogLine syslogserver.SyslogMessage) (string, error) {\n\tvar line string\n","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/run.go#L160-L196","documentation":"After confirming the message starts with '<', stripPRI searches for the closing '>' that terminates the PRI field. If no '>' exists anywhere in the message the PRI is unterminated and the parser returns 'missing PRI end'.","triggerScenarios":"A message starting with '<' but containing no '>' anywhere, e.g. '<13some text' or truncated datagrams cut mid-header.","commonSituations":"TCP stream truncation splitting a syslog frame; a custom emitter writing '<PRI' without closing bracket; binary garbage sent to the syslog port; MTU-related datagram truncation.","solutions":["Check for TCP truncation; ensure the sender terminates each syslog frame correctly (RFC5424 octet counting or newline framing)","Fix the emitting device to write the full '<PRI>' header","Inspect the raw message in the ParseError to identify the source of malformed data"],"exampleFix":"// before: manual framing without closing PRI\nconn.Write([]byte(\"<13 partial\"))\n// after\nconn.Write([]byte(\"<13>partial\\n\"))","handlingStrategy":"validation","validationCode":"if strings.HasPrefix(msg, \"<\") && !strings.Contains(msg, \">\") { /* truncated; reject upstream */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use octet-counting (RFC5424) framing on TCP to avoid split frames","Ensure senders write complete '<PRI>' headers","Watch for MTU/truncation issues on UDP paths"],"tags":["syslog","parsing","truncation"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}