{"record":{"id":"36b4f8af37b3573d","repo":"crowdsecurity/crowdsec","slug":"pri-must-end-with","errorCode":null,"errorMessage":"PRI must end with '>'","messagePattern":"PRI must end with '>'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go","lineNumber":77,"sourceCode":"\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == '>' {\n\t\t\tr.position++\n\t\t\tbreak\n\t\t}\n\t\tif c < '0' || c > '9' {\n\t\t\treturn errors.New(\"PRI must be a number\")\n\t\t}\n\t\tpri = pri*10 + int(c-'0')\n\t\tr.position++\n\t}\n\n\tif pri > 999 {\n\t\treturn errors.New(\"PRI must be up to 3 characters long\")\n\t}\n\n\tif r.position == r.len && r.buf[r.position-1] != '>' {\n\t\treturn errors.New(\"PRI must end with '>'\")\n\t}\n\n\tr.PRI = pri\n\treturn nil\n}\n\nfunc (r *RFC3164) parseTimestamp() error {\n\tvalidTs := false\n\tfor _, layout := range VALID_TIMESTAMPS {\n\t\ttsLen := len(layout)\n\t\tif r.position+tsLen > r.len {\n\t\t\tcontinue\n\t\t}\n\t\tt, err := time.Parse(layout, string(r.buf[r.position:r.position+tsLen]))\n\t\tif err == nil {\n\t\t\tvalidTs = true\n\t\t\tr.Timestamp = t\n\t\t\tr.position += tsLen","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go#L59-L95","documentation":"Validation in RFC3164 parsePRI: the buffer ended without the closing '>' of the PRI part (the last consumed character is not '>'). The priority field must be terminated by '>' before the timestamp; a truncated datagram stops here.","triggerScenarios":"Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:77 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check for truncated datagrams — UDP clamping or MTU issues can cut messages short","Ensure the sender writes the complete '<PRI>' frame before the timestamp","If messages are deliberately minimal, they still need the full bracketed PRI to parse as RFC3164"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}