{"record":{"id":"a29da8cb540964d1","repo":"crowdsecurity/crowdsec","slug":"timestamp-is-not-valid","errorCode":null,"errorMessage":"timestamp is not valid","messagePattern":"timestamp is not valid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go","lineNumber":100,"sourceCode":"}\n\nfunc (r *RFC3164) parseTimestamp() error {\n\tvalidTs := false\n\tfor _, layout := range VALID_TIMESTAMPS {\n\t\ttsLen := len(layout)\n\t\tif r.position+tsLen > r.len {\n\t\t\tcontinue\n\t\t}\n\t\tt, err := time.Parse(layout, string(r.buf[r.position:r.position+tsLen]))\n\t\tif err == nil {\n\t\t\tvalidTs = true\n\t\t\tr.Timestamp = t\n\t\t\tr.position += tsLen\n\t\t\tbreak\n\t\t}\n\t}\n\tif !validTs {\n\t\treturn errors.New(\"timestamp is not valid\")\n\t}\n\tif r.useCurrentYear {\n\t\tif r.Timestamp.Year() == 0 {\n\t\t\tr.Timestamp = time.Date(time.Now().Year(), r.Timestamp.Month(), r.Timestamp.Day(), r.Timestamp.Hour(), r.Timestamp.Minute(), r.Timestamp.Second(), r.Timestamp.Nanosecond(), r.Timestamp.Location())\n\t\t}\n\t}\n\tr.position++\n\treturn nil\n}\n\nfunc (r *RFC3164) parseHostname() error {\n\thostname := []byte{}\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == ' ' {\n\t\t\tr.position++\n\t\t\tbreak\n\t\t}","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go#L82-L118","documentation":"parseTimestamp in the RFC3164 syslog parser tries each layout in VALID_TIMESTAMPS (RFC3339 and four 'Jan 02 15:04:05 [2006]' variants) against the fixed-length slice of the message starting at the current position. If none of them parses, it returns 'timestamp is not valid'. It is thrown because RFC3164 mandates a timestamp immediately after the PRI, and without one the parser cannot position the rest of the fields.","triggerScenarios":"Calling RFC3164.Parse on a message whose bytes right after '<PRI>' do not exactly match one of the supported layouts: RFC3339, 'Jan 02 15:04:05', 'Jan _2 15:04:05' (space-padded day), or their ' 2006'-year suffixed variants. Includes truncated timestamps (fewer than 15 chars remaining), ISO8601 with different offsets, and the RFC5424 'YYYY-MM-DDTHH:MM:SS' form.","commonSituations":"Feeding RFC5424-formatted messages (ISO timestamps with T separator) into the RFC3164 parser; receiving syslog from devices emitting 'Feb  3 09:12:01' with double spaces where the '_2' layout length does not line up; messages with the timestamp omitted entirely; a parser instance reused after a failed Parse left r.position mid-buffer.","solutions":["Check the timestamp format actually emitted by the source: run the raw syslog line through a manual time.Parse with the VALID_TIMESTAMPS layouts from pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go to see which one it matches.","If the source emits RFC5424-style ISO timestamps, use the RFC5424 parser instead of RFC3164 (or route messages accordingly in the syslog acquisition config).","Ensure the message passed to Parse starts exactly at '<PRI>' with no leading spaces/BOM; leading bytes shift r.position and corrupt the timestamp slice.","If the day is space-padded ('Feb  3'), confirm the '_2' layout slice lines up — the parser uses fixed layout lengths, so any extra/missing character breaks the match.","If the parser instance is reused across messages, construct a fresh one via NewRFC3164Parser per parse or reset position, since a prior failure leaves r.position advanced."],"exampleFix":"// before: RFC5424 timestamp fed to RFC3164 parser\nr.Parse([]byte(\"<34>2024-02-03T09:12:01Z host tag: msg\")) // timestamp is not valid\n\n// after: either RFC3164 format\nr.Parse([]byte(\"<34>Feb  3 09:12:01 host tag: msg\"))\n// or use the RFC5424 parser for ISO timestamps","handlingStrategy":"validation","validationCode":"layouts := []string{time.RFC3339, \"Jan 02 15:04:05 2006\", \"Jan _2 15:04:05 2006\", \"Jan 02 15:04:05\", \"Jan _2 15:04:05\"}\nfunc hasSupportedRFC3164Timestamp(msg string, priLen int) bool {\n\trest := msg[priLen:]\n\tfor _, l := range layouts {\n\t\tif len(rest) >= len(l) {\n\t\t\tif _, err := time.Parse(l, rest[:len(l)]); err == nil {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\t}\n\treturn false\n}","typeGuard":"func isRFC3164TimestampPrefix(s string) bool {\n\tfor _, l := range []string{time.RFC3339, \"Jan 02 15:04:05\", \"Jan _2 15:04:05\"} {\n\t\tif len(s) >= len(l) {\n\t\t\tif _, err := time.Parse(l, s[:len(l)]); err == nil {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\t}\n\treturn false\n}","tryCatchPattern":"var rpe *rfc3164.RFC3164\nif err := rpe.Parse(line); err != nil {\n\tif strings.Contains(err.Error(), \"timestamp is not valid\") {\n\t\t// fall back to RFC5424 parser or store raw line for manual inspection\n\t}\n}","preventionTips":["Confirm the source device's timestamp format against VALID_TIMESTAMPS before wiring it to this parser","Use the RFC5424 parser for ISO/8601 'T'-separated timestamps","Strip leading whitespace/BOM so Parse starts exactly at '<PRI>'","Construct a fresh parser (NewRFC3164Parser) per message to avoid stale r.position from a previous failure"],"tags":["syslog","rfc3164","timestamp","parsing"],"backgroundTag":"invalid-date-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}