{"record":{"id":"b633f2e63e9c7b5f","repo":"crowdsecurity/crowdsec","slug":"unrecognized-syslog-message","errorCode":null,"errorMessage":"unrecognized syslog message","messagePattern":"unrecognized syslog message","errorType":"validation","errorClass":"ErrUnrecognized","httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/run.go","lineNumber":133,"sourceCode":"\n\tif appname != \"\" {\n\t\tret += \" \" + appname\n\t}\n\n\tif pid != \"\" {\n\t\tret += \"[\" + pid + \"]: \"\n\t} else {\n\t\tret += \": \"\n\t}\n\n\tif msg != \"\" {\n\t\tret += msg\n\t}\n\n\treturn ret\n}\n\nvar ErrUnrecognized = errors.New(\"unrecognized syslog message\")\n\ntype ParseError struct {\n\tReason     error\n\tRawMessage []byte\n\t// keep the both attempts for ErrUnrecognized\n\tRFC3164 error\n\tRFC5424 error\n}\n\nfunc (e *ParseError) Error() string {\n\treturn e.Reason.Error()\n}\n\nfunc (e *ParseError) Unwrap() error {\n\treturn e.Reason\n}\n\nfunc (e *ParseError) Fields() logrus.Fields {","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/run.go#L115-L151","documentation":"ErrUnrecognized is returned by Source.parseLine when the incoming syslog line fails BOTH the RFC3164 and RFC5424 parsers. The returned *ParseError carries the raw message plus each parser's individual error so the operator can see why both attempts failed. It means the line is not a recognizable syslog message at all.","triggerScenarios":"A UDP/TCP client sends a line to the crowdsec syslog datasource that neither parser accepts — e.g. a bare text line with no PRI, a malformed PRI, garbage bytes, or a truncated RFC5424 header combined with a non-RFC3164 layout.","commonSituations":"Log forwarders (rsyslog, syslog-ng) configured with a custom/nonstandard template; devices writing JSON or raw app logs directly to the syslog port; binary or partially corrupted datagrams; sending to the wrong port so crowdsec receives unrelated traffic.","solutions":["Inspect the ParseError fields (raw, rfc3164_err, rfc5424_err) to see exactly why both parsers failed","Fix the sender's syslog template so it emits valid RFC3164 or RFC5424 format (PRI + timestamp at minimum)","Set DisableRFCParser: true in the acquisition config if lines are arbitrary payloads with a PRI prefix — only the PRI is stripped","Verify the sender is targeting the crowdsec syslog datasource port and not sending non-syslog content"],"exampleFix":"// before: sender emits raw JSON to syslog port\n'{\"level\":\"info\",\"msg\":\"hi\"}'  -> ErrUnrecognized\n// after: wrap with a PRI, or use raw tail acquisition instead\n'<13>Jan  1 00:00:00 host app: {\"level\":\"info\",\"msg\":\"hi\"}'\n// or in acquis.yaml:\n// source: syslog\n//   DisableRFCParser: true","handlingStrategy":"try-catch","validationCode":"// check the line has a plausible PRI before sending to the syslog datasource\nfunc hasPRI(line []byte) bool {\n    if len(line) < 3 || line[0] != '<' { return false }\n    end := bytes.IndexByte(line, '>')\n    if end < 0 || end > 4 { return false }\n    for _, c := range line[1:end] {\n        if c < '0' || c > '9' { return false }\n    }\n    return true\n}","typeGuard":null,"tryCatchPattern":"var pe *syslog.ParseError\nline, err := src.ParseLine(msg)\nif err != nil {\n    if errors.As(err, &pe) && errors.Is(pe, syslog.ErrUnrecognized) {\n        log.Printf(\"unrecognized syslog line %q: rfc3164=%v rfc5424=%v\",\n            pe.RawMessage, pe.RFC3164, pe.RFC5424)\n    }\n    return\n}","preventionTips":["Keep rsyslog/syslog-ng templates standard so lines are valid RFC3164/5424","Enable DisableRFCParser only for senders that prefix a PRI to arbitrary payloads","Send non-syslog logs via file/tail acquisition, not the syslog port","Inspect ParseError.Fields() ('raw', 'rfc3164_err', 'rfc5424_err') when diagnosing senders"],"tags":["syslog","parsing","rfc3164","rfc5424","acquisition"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}