{"record":{"id":"54b3a60c6d874198","repo":"crowdsecurity/crowdsec","slug":"pri-not-a-number","errorCode":null,"errorMessage":"PRI not a number","messagePattern":"PRI not a number","errorType":"validation","errorClass":"ParseError","httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/run.go","lineNumber":187,"sourceCode":"\t\treturn nil, &ParseError{Reason: errors.New(\"message too short\"), RawMessage: msg}\n\t}\n\n\tif msg[0] != '<' {\n\t\treturn nil, &ParseError{Reason: errors.New(\"missing PRI beginning\"), RawMessage: msg}\n\t}\n\n\tend := bytes.Index(msg, []byte(\">\"))\n\tif end == -1 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"missing PRI end\"), RawMessage: msg}\n\t}\n\n\tif end > 4 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"PRI too long\"), RawMessage: msg}\n\t}\n\n\tfor i := 1; i < end; i++ {\n\t\tif msg[i] < '0' || msg[i] > '9' {\n\t\t\treturn nil, &ParseError{Reason: errors.New(\"PRI not a number\"), RawMessage: msg}\n\t\t}\n\t}\n\n\treturn msg[end+1:], nil\n}\n\nfunc (s *Source) parseLine(syslogLine syslogserver.SyslogMessage) (string, error) {\n\tvar line string\n\n\tlogger := s.logger.WithField(\"client\", syslogLine.Client)\n\tlogger.Tracef(\"raw: %s\", syslogLine)\n\n\tif s.metricsLevel != metrics.AcquisitionMetricsLevelNone {\n\t\tmetrics.SyslogDataSourceLinesReceived.With(prometheus.Labels{\"source\": syslogLine.Client, \"datasource_type\": ModuleName, \"acquis_type\": s.config.Labels[\"type\"]}).Inc()\n\t}\n\n\tif s.config.DisableRFCParser {\n\t\trest, err := stripPRI(syslogLine.Message)","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/run.go#L169-L205","documentation":"Returned by stripPRI when a character between '<' and '>' in the syslog PRI part is not an ASCII digit — the PRI value is not a number, e.g. '<ab>' or '<1x>'. The raw message is preserved in the returned ParseError for the caller to log.","triggerScenarios":"Messages like '<abc>msg' or '< 5>msg' where the PRI body contains letters, spaces or symbols.","commonSituations":"A custom or broken syslog emitter writing non-numeric priority; text formats that start with angle-bracket tags (e.g. '<error>') sent to the syslog port; corruption in transit.","solutions":["Fix the emitter to send a numeric PRI (facility*8+severity, range 0-191)","If the source emits '<tag>text' style prefixes, use a different datasource or pre-transform the log","Inspect the raw message in the ParseError to identify the producer"],"exampleFix":"// before\n<error>disk full\n// after\n<11>disk full  (facility 1, severity 3)","handlingStrategy":"validation","validationCode":"// validate PRI digits before sending\npri := 8*facility + severity\nif pri < 0 || pri > 191 { /* fix emitter */ }\nheader := fmt.Sprintf(\"<%d>\", pri)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Compute PRI numerically as facility*8+severity","Never embed tag names inside angle brackets sent to syslog","Verify emitter output with a packet capture or tcpdump"],"tags":["syslog","parsing","rfc3164"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}