{"record":{"id":"b5d193c136aa6dac","repo":"crowdsecurity/crowdsec","slug":"pri-too-long","errorCode":null,"errorMessage":"PRI too long","messagePattern":"PRI too long","errorType":"validation","errorClass":"ParseError","httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/syslog/run.go","lineNumber":182,"sourceCode":"\treturn fields\n}\n\nfunc stripPRI(msg []byte) (rest []byte, err error) {\n\tif len(msg) < 3 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"message too short\"), RawMessage: msg}\n\t}\n\n\tif msg[0] != '<' {\n\t\treturn nil, &ParseError{Reason: errors.New(\"missing PRI beginning\"), RawMessage: msg}\n\t}\n\n\tend := bytes.Index(msg, []byte(\">\"))\n\tif end == -1 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"missing PRI end\"), RawMessage: msg}\n\t}\n\n\tif end > 4 {\n\t\treturn nil, &ParseError{Reason: errors.New(\"PRI too long\"), RawMessage: msg}\n\t}\n\n\tfor i := 1; i < end; i++ {\n\t\tif msg[i] < '0' || msg[i] > '9' {\n\t\t\treturn nil, &ParseError{Reason: errors.New(\"PRI not a number\"), RawMessage: msg}\n\t\t}\n\t}\n\n\treturn msg[end+1:], nil\n}\n\nfunc (s *Source) parseLine(syslogLine syslogserver.SyslogMessage) (string, error) {\n\tvar line string\n\n\tlogger := s.logger.WithField(\"client\", syslogLine.Client)\n\tlogger.Tracef(\"raw: %s\", syslogLine)\n\n\tif s.metricsLevel != metrics.AcquisitionMetricsLevelNone {","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/run.go#L164-L200","documentation":"The PRI field in RFC3164/5424 is at most '<316>' style — 3 digits plus brackets, so the '>' can appear at index at most 4. If the closing '>' appears later, the PRI field is abnormally long and stripPRI rejects the message with 'PRI too long'.","triggerScenarios":"A message like '<12345>msg' where '>' is at index 5 or beyond, or messages with a very long prefix starting with '<' before any '>'.","commonSituations":"A device emitting an extended/invalid header (e.g. including timestamp inside angle brackets); a non-syslog protocol whose text happens to start with '<' (XML, HTML) sent to the syslog port.","solutions":["Fix the sender to emit a compliant 1-3 digit PRI (0-191)","Route XML/HTML or other '<'-prefixed text to a proper datasource instead of syslog","Verify device firmware/config for nonstandard syslog framing"],"exampleFix":"// before: overlong pseudo-PRI\n<12345678>message\n// after\n<134>message","handlingStrategy":"validation","validationCode":"// PRI body must be 1-3 digits: match '<[0-9]{1,3}>'\nif matched, _ := regexp.MatchString(`^<[0-9]{1,3}>`, msg); !matched { /* invalid PRI */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Emit PRI values 0-191 only","Keep non-syslog '<'-prefixed formats (XML/HTML) out of the syslog datasource","Test devices' syslog output format before production"],"tags":["syslog","parsing","rfc3164"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}