{"record":{"id":"b21cb52184720d9d","repo":"crowdsecurity/crowdsec","slug":"timestamp-is-not-valid-b21cb5","errorCode":null,"errorMessage":"timestamp is not valid","messagePattern":"timestamp is not valid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":116,"sourceCode":"\t\tc := r.buf[r.position]\n\t\tif c == ' ' {\n\t\t\tbreak\n\t\t}\n\t\ttimestamp = append(timestamp, c)\n\t\tr.position++\n\t}\n\n\tif len(timestamp) == 0 {\n\t\treturn errors.New(\"timestamp is empty\")\n\t}\n\n\tif r.position == r.len {\n\t\treturn errors.New(\"EOL after timestamp\")\n\t}\n\n\tdate, err := time.Parse(VALID_TIMESTAMP, string(timestamp))\n\tif err != nil {\n\t\treturn errors.New(\"timestamp is not valid\")\n\t}\n\n\tr.Timestamp = date\n\n\tr.position++\n\n\tif r.position >= r.len {\n\t\treturn errors.New(\"EOL after timestamp\")\n\t}\n\n\treturn nil\n}\n\nfunc (r *RFC5424) parseHostname() error {\n\tif r.buf[r.position] == NIL_VALUE {\n\t\tr.Hostname = \"\"\n\t\tr.position += 2\n\t\treturn nil","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L98-L134","documentation":"The collected timestamp is parsed with time.Parse using RFC 3339 with nanoseconds (time.RFC3339Nano). If the string doesn't match that layout — wrong format, missing timezone offset, or out-of-range components — the parser replaces the underlying error with this generic message and rejects the line.","triggerScenarios":"Calling RFC5424.Parse with timestamps like \"2024-01-01T00:00:00\" (no timezone), \"2024/01/01 00:00:00Z\", \"Jan  1 00:00:00\" (RFC 3164 style), or fractional seconds not accepted — anything time.Parse(RFC3339Nano, ...) fails on.","commonSituations":"Legacy devices emitting local time without UTC offset, senders using space-separated dates, or templates with the wrong timestamp format despite otherwise RFC 5424 structure.","solutions":["Configure the sender to emit an RFC 3339 timestamp with timezone, e.g. 2024-01-01T00:00:00.000000Z.","If the sender can't be fixed, use '-' (NILVALUE) as the timestamp so the parser substitutes the current time.","Test the exact timestamp string with time.Parse(time.RFC3339Nano, ts) to see the precise layout mismatch."],"exampleFix":"// before (no timezone offset)\nparser.Parse([]byte(\"<34>1 2024-01-01T00:00:00 host app 1 - msg\"))\n// after (RFC 3339 with offset)\nparser.Parse([]byte(\"<34>1 2024-01-01T00:00:00Z host app 1 - msg\"))","handlingStrategy":"validation","validationCode":"// Go: validate the timestamp as RFC 3339 before parsing\nfunc validTimestamp(line []byte) bool {\n\ti := bytes.IndexByte(line, '>')\n\tif i < 0 || len(line) < i+4 || line[i+1] != '1' {\n\t\treturn false\n\t}\n\trest := line[i+3:]\n\tsp := bytes.IndexByte(rest, ' ')\n\tif sp < 0 {\n\t\treturn false\n\t}\n\t_, err := time.Parse(time.RFC3339Nano, string(rest[:sp]))\n\treturn err == nil\n}","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(line); err != nil {\n\tif strings.Contains(err.Error(), \"timestamp is not valid\") {\n\t\t// substitute current time or fix the sender's timestamp format\n\t}\n}","preventionTips":["Configure senders for RFC 3339 timestamps with explicit timezone offset","Use '-' (NILVALUE) if the device cannot produce a compliant timestamp","Unit-test the sender's exact timestamp string against time.RFC3339Nano"],"tags":["syslog","rfc5424","timestamp","date-format"],"backgroundTag":"invalid-date-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}