{"record":{"id":"92de6c4e6b89d9be","repo":"crowdsecurity/crowdsec","slug":"pid-inside-tag-must-be-a-number","errorCode":null,"errorMessage":"pid inside tag must be a number","messagePattern":"pid inside tag must be a number","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go","lineNumber":169,"sourceCode":"\tr.Tag = string(tag)\n\n\tif r.position == r.len {\n\t\treturn nil\n\t}\n\n\tc := r.buf[r.position]\n\tif c == '[' {\n\t\thasPid = true\n\t\tr.position++\n\t\tfor r.position < r.len {\n\t\t\tc = r.buf[r.position]\n\t\t\tif c == ']' {\n\t\t\t\tpidEnd = true\n\t\t\t\tr.position++\n\t\t\t\tbreak\n\t\t\t}\n\t\t\tif c < '0' || c > '9' {\n\t\t\t\treturn errors.New(\"pid inside tag must be a number\")\n\t\t\t}\n\t\t\ttmpPid = append(tmpPid, c)\n\t\t\tr.position++\n\t\t}\n\t}\n\n\tif hasPid && !pidEnd {\n\t\treturn errors.New(\"pid inside tag must be closed with ']'\")\n\t}\n\n\tif hasPid {\n\t\tr.PID = string(tmpPid)\n\t}\n\treturn nil\n}\n\nfunc (r *RFC3164) parseMessage() error {\n\terr := r.parseTag()","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go#L151-L187","documentation":"After reading the alphanumeric TAG, parseTag optionally parses a PID bracketed as 'tag[123]'. Every byte between '[' and ']' must be a digit; if a non-digit appears, it returns 'pid inside tag must be a number'. It is thrown because rfc3164 PIDs are numeric and the parser stores them in RFC3164.PID as a numeric string.","triggerScenarios":"Calling Parse on a message whose tag contains a bracketed value with non-digit characters, e.g. 'kernel[abc]:' or 'app[x1]:'; also a tag like 'systemd[1a]' mid-stream. Also cases where '[' is part of the message body and gets attached because the preceding tag is alphanumeric (e.g. 'md[raid error]' style text).","commonSituations":"Applications emitting bracketed non-numeric suffixes (thread names, raid arrays, instance names) that look like PIDs; a message body starting with word[...] where the bracket content is not a PID; templating bugs that place '%proc%' or a hostname inside the brackets.","solutions":["Inspect the raw message around the '[' following the tag; ensure the enclosed value is the numeric PID (e.g. 'sshd[1234]:') or that '[' is not a PID at all.","Fix the emitting application/template so the bracketed suffix contains only digits, or remove the bracket suffix entirely.","If '[' belongs to the message body, insert a ':' right after the tag (e.g. 'tag: [something] msg') so the bracketed text is treated as message content... note the parser treats '[' immediately after the tag as a PID regardless, so best to change the message format at the source.","Preprocess/rewrite such lines upstream (regex normalization) before syslog acquisition so bracketed non-numeric tokens are escaped or separated.","If the source cannot be fixed, route these messages to the RFC5424 parser or a custom parsing path that tolerates non-numeric bracket content."],"exampleFix":"// before: non-numeric bracket content\nr.Parse([]byte(\"<34>Feb  3 09:12:01 host md[raid]: resync\")) // pid inside tag must be a number\n\n// after: numeric pid, or colon before message\nr.Parse([]byte(\"<34>Feb  3 09:12:01 host md: [raid] resync\"))","handlingStrategy":"validation","validationCode":"func pidBracketIsNumeric(msg string) bool {\n\t// find tag token then check any immediately-following [ ... ] holds digits only\n\tparts := strings.SplitN(msg, \" \", 4)\n\tif len(parts) < 4 { return true }\n\ttag := parts[3]\n\ti := strings.IndexByte(tag, '[')\n\tif i < 0 { return true }\n\tj := strings.IndexByte(tag[i+1:], ']')\n\tif j < 0 { return false }\n\tpid := tag[i+1 : i+1+j]\n\tfor _, c := range []byte(pid) {\n\t\tif c < '0' || c > '9' { return false }\n\t}\n\treturn true\n}","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(line); err != nil {\n\tif strings.Contains(err.Error(), \"pid inside tag must be a number\") {\n\t\tline = escapeBracketsAfterTag(line) // rewrite, e.g. move '[' content after ':'\n\t}\n}","preventionTips":["Keep bracketed suffixes after the tag strictly numeric (real PIDs)","Avoid message bodies that begin with word[...] — prefix a ':' after the tag","Normalize/escape bracketed non-numeric tokens upstream before acquisition","Cover such edge lines in unit tests before enabling this parser in production"],"tags":["syslog","rfc3164","tag","pid","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}