{"record":{"id":"6376b24194efb3ae","repo":"vectordotdev/vector","slug":"invalid-timestamp-6376b2","errorCode":null,"errorMessage":"invalid timestamp","messagePattern":"invalid timestamp","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/sources/journald.rs","lineNumber":883,"sourceCode":"        LogNamespace::Vector => log\n            .get(metadata_path!(JournaldConfig::NAME, \"metadata\"))\n            .and_then(|meta| {\n                meta.get(path!(SOURCE_TIMESTAMP))\n                    .or_else(|| meta.get(path!(RECEIVED_TIMESTAMP)))\n            }),\n        LogNamespace::Legacy => log\n            .get(event_path!(SOURCE_TIMESTAMP))\n            .or_else(|| log.get(event_path!(RECEIVED_TIMESTAMP))),\n    };\n\n    let timestamp = timestamp_value\n        .filter(|&ts| ts.is_bytes())\n        .and_then(|ts| ts.as_str().unwrap().parse::<u64>().ok())\n        .map(|ts| {\n            chrono::Utc\n                .timestamp_opt((ts / 1_000_000) as i64, (ts % 1_000_000) as u32 * 1_000)\n                .single()\n                .expect(\"invalid timestamp\")\n        });\n\n    // Add timestamp.\n    match log_namespace {\n        LogNamespace::Vector => {\n            log.insert(metadata_path!(\"vector\", \"ingest_timestamp\"), Utc::now());\n\n            if let Some(ts) = timestamp {\n                log.insert(metadata_path!(JournaldConfig::NAME, \"timestamp\"), ts);\n            }\n        }\n        LogNamespace::Legacy => {\n            if let Some(ts) = timestamp {\n                log.maybe_insert(log_schema().timestamp_key_target_path(), ts);\n            }\n        }\n    }\n","sourceCodeStart":865,"sourceCodeEnd":901,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/src/sources/journald.rs#L865-L901","documentation":"The journald source consumes the journalctl export format; timestamp fields such as __REALTIME_TIMESTAMP arrive as microsecond strings parsed to u64, then chrono::Utc.timestamp_opt(ts / 1_000_000, ts % 1_000_000 * 1_000).single().expect(\"invalid timestamp\"). Microsecond values beyond chrono's representable window (about 8.2e18 microseconds, year ~262143) make single() return None and the expect panics the source task.","triggerScenarios":"Feeding the journald source a crafted or corrupt export stream (or HTTP/gRPC payload in that format) whose timestamp field is a huge u64 such as u64::MAX, or placeholder/sentinel test values; healthy systemd journals never produce them.","commonSituations":"Replaying captured or fuzzed journal exports, custom journald forwarders, test fixtures with sentinel timestamps.","solutions":["Sanitize or bound the producer's timestamp fields before they reach Vector","Patch: match on .single() (or pre-filter ts) and skip events with out-of-range timestamps, with a warning","Upgrade Vector once graceful handling lands"],"exampleFix":"// before\n.map(|ts| {\n    chrono::Utc\n        .timestamp_opt((ts / 1_000_000) as i64, (ts % 1_000_000) as u32 * 1_000)\n        .single()\n        .expect(\"invalid timestamp\")\n});\n\n// after\n.and_then(|ts| {\n    chrono::Utc\n        .timestamp_opt((ts / 1_000_000) as i64, (ts % 1_000_000) as u32 * 1_000)\n        .single()\n})\n// and, if preferred, log when the result is None instead of silently dropping","handlingStrategy":"validation","validationCode":"const MAX_VALID_MICROS: u64 = 8_210_266_876_799_000_000; // ~chrono max\n\nfn valid_journald_micros(ts: u64) -> bool {\n    ts <= MAX_VALID_MICROS\n}\n\n// before parsing:\nif !valid_journald_micros(ts) {\n    warn!(message = \"dropping event with out-of-range journal timestamp\", ts);\n    return None;\n}","typeGuard":"fn journal_micros_to_datetime(ts: u64) -> Option<chrono::DateTime<chrono::Utc>> {\n    chrono::Utc\n        .timestamp_opt((ts / 1_000_000) as i64, (ts % 1_000_000) as u32 * 1_000)\n        .single()\n}","tryCatchPattern":"let timestamp = timestamp_value.and_then(|ts| {\n    chrono::Utc\n        .timestamp_opt((ts / 1_000_000) as i64, (ts % 1_000_000) as u32 * 1_000)\n        .single()\n});\n// None: proceed without a source timestamp and log at debug/warn","preventionTips":["Sanitize replayed/fuzzed journal export data before feeding it to Vector","Bound u64 timestamp fields at the ingest boundary","Never expect() on parsed external numeric fields","Add fixture tests with extreme timestamp values to the journald source"],"tags":["rust","panic","timestamp","journald","systemd"],"backgroundTag":"timestamp-out-of-range","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}